This page lists every .dk domain whose delegation includes the nameserver ns1.dyna-ns.net, together with its IP addresses, network, zone-transfer and ANY-query behaviour, the protocols and RFCs it supports (TCP, EDNS, cookies, NSID, DNS over TLS/HTTPS …), the nameserver sets it is used in and how fast those sets answer. Use it to size a DNS provider, audit a migration or find domains still pointing at an old server. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.
The nameserver ns1.dyna-ns.net appears in the delegation of 355 .dk domains in our dataset — 0.03% of every scanned .dk domain. The full list is below — here is how those domains look under the hood.
On the DNSSEC side, 0 (0.0%) validate as secure — below the zone-wide average of 64.0%, while 351 (98.9%) are unsigned, with none failing validation outright — a further 4 come back indeterminate.
Delegation health looks clean, too: none of these domains currently register as lame delegations at this nameserver.
Response time: across 355 timed domains, our resolver needed 255 ms on average to answer an A query and 225 ms for an NS query. Per nameserver set below.
| Protocol / feature | Standard | Supported | What it is |
|---|---|---|---|
| DNS over TCP | RFC 7766, RFC 9210 | Yes | Required for every nameserver: large answers, DNSSEC and truncation fall back to TCP. |
| EDNS(0) | RFC 6891 | Yes UDP buffer 1232 | Extension mechanism behind DNSSEC, cookies and every other option below. |
| EDNS version negotiation | RFC 6891 | BADVERS (correct) | A query with EDNS version 1 must get BADVERS back. |
| Unknown EDNS options | RFC 6891 | Ignored (correct) | An option the server does not know must be ignored, not make the query fail. |
| DNS cookies | RFC 7873, RFC 9018 | No | Lightweight server cookies against spoofing and amplification. |
| NSID | RFC 5001 | Yes cph03 | Names the server instance that answered (useful behind anycast). |
| TCP keepalive | RFC 7828 | No | Announces how long an idle TCP connection is kept open. |
| Client subnet (ECS) | RFC 7871 | No | Lets the nameserver tailor answers to the client's network (CDNs, geo-DNS). |
| Extended DNS errors | RFC 8914 | — | Explains a refusal or failure with an error code, seen on a query outside its zones. |
| ZONEVERSION | RFC 9660 | No | Reports the zone serial it answered from. |
| DNS error reporting | RFC 9567 | No | Advertises a reporting agent resolvers can send failures to. |
| Refuses recursion | RFC 5358 | Yes | An authoritative server should not resolve other people's names for anyone who asks. |
| DNS over TLS (DoT) | RFC 7858, RFC 9539 | No | Encrypted transport on port 853 (resolver-to-authoritative per RFC 9539). |
| DNS over HTTPS (DoH) | RFC 8484 | No | Encrypted transport on port 443 (/dns-query). Rare on authoritatives. |
| DNS over QUIC (DoQ) | RFC 9250 | Not probed | Our probe tool cannot speak QUIC yet. |
Probed over IPv4 at 162.159.27.158 with questions about malkodirigentskolen.dk, a zone it serves. Other addresses of an anycast or multi-server setup can differ. AXFR, IXFR and minimal ANY answers (RFC 8482) are in the probe card above. “No” for an encrypted transport means nothing answered on its port while plain DNS did. Zone-wide adoption.
| Nameserver set | Domains | Avg response (A) | NS lookup |
|---|---|---|---|
| ns1.dyna-ns.net · ns2.dyna-ns.net | 355 | 255 ms | 225 ms |
Times are the scanner's own lookups through its resolver on each domain's latest scan, so they include resolver overhead; compare sets with each other rather than reading them as raw authoritative round-trip times.
Loading…