Nameservers agree on the SOA serial

Every authoritative server for a zone should be serving the same version of it, and the SOA serial is how they say which version that is. This check asks each nameserver separately, with recursion off, and compares the serials they report — which is a thing a recursive resolver cannot tell you, because it returns one merged answer with the server identity erased.

Disagreement means at least one server is serving stale data. Whether that matters depends on what changed: if the difference is a record nobody touched recently, nothing visible happens. If you changed a record ten minutes ago, then roughly one query in N gets the old answer, where N is the number of nameservers — and which one a given person gets is effectively random.

Transient disagreement immediately after an edit is normal and expected; secondaries take a moment to transfer. Persistent disagreement is a replication fault: a NOTIFY not being sent or not being accepted, a zone transfer refused by an ACL, a secondary that has lost its connection to the primary, or a serial that went backwards and left secondaries refusing an update they consider older than what they hold.

Re-check after a few minutes first. If the serials converge, replication is working and you caught it mid-flight.

If they do not, look at the primary's NOTIFY configuration and the secondaries' transfer ACLs — those two account for most of it. The secondary's logs will usually name the reason, which is faster than inferring it from the outside.

Check that the serial only ever increases. A zone regenerated from a template with a lower serial than the one already published leaves every secondary correctly refusing the update, and the fix is to publish a serial above the highest one in circulation rather than to force the transfer.