---
title: "verify serials across the nameservers · RUAL Documentation"
description: "Ask every nameserver which serial it is actually serving, and whether they agree."
canonical: https://docs.rual.nl/block-types/dns/dnszone_verify
language: en
---

[Cluster](https://docs.rual.nl/cluster)

[Blocks](https://docs.rual.nl/block-types)

[Interfaces](https://docs.rual.nl/interfaces)

[Blueprints](https://docs.rual.nl/blueprints)

[Tutorials](https://docs.rual.nl/tutorials)

[Home automation](https://docs.rual.nl/home-automation)

[Examples](https://docs.rual.nl/examples)

[Reference](https://docs.rual.nl/reference)

[Architecture](https://docs.rual.nl/architecture)

[Troubleshooting](https://docs.rual.nl/troubleshooting)

Other

# verify serials across the nameservers

This block is part of the [`dns`](https://docs.rual.nl/block-types/dns) group and was last modified in core [`v15.0.0`](https://docs.rual.nl/core-versions/150000).

Ask every nameserver which serial it is actually serving, and whether they agree.

- flow `flow`

- Zone required `value` The zone name, for example deverence.nl.

- Nameservers required `array` Each {name, host, port, user, key_path, known_hosts_path}. Paths only : never key material.

- Expected serial `number` The serial this render produced. Set it to assert the push took, not just that the nodes agree.

- flow `flow`

- Success `condition` True when every node could be asked.

- Zone `value` The zone that was verified.

- Agree `condition` True only when every node answered with the same serial.

- Serial `value` The serial they agree on, when they do.

- Matches expected `condition` True when the agreed serial is the one this render produced.

- Results `array` Per node: name, host, serial, answered, output.

- Answered count `number` How many nodes are serving the zone.

- Node count `number` How many nodes were asked.

- Error `value` What disagrees, or which nodes did not answer.

Runs dig SOA for this zone on every nameserver and reports the serial each one is actually serving. Health here is dig, not a status endpoint: serial disagreement is the only failure that matters and it is invisible from the store's own copy, because a push that succeeded on two nodes and silently did nothing on the third looks identical from there. The query runs ON the node against 127.0.0.1, which is a fact about the network rather than a preference: a host cannot reach its own VM's public address (macvlan hairpin), and asking a resolver would answer from a cache. agree is true only when every node answered AND they all gave the same serial. Agreement is checked between the nodes, not against a number computed here : a locally derived serial could be wrong the same way twice. Pass expect_serial (the render's serial) to also assert the push actually took; matches_expected then reports whether the agreed serial is the one just rendered. Each node is {name, host, port, user, key_path, known_hosts_path}: paths only, never key material.

| `dig soa` |
| --- |
| `serial agreement` |
| `verify zone` |

A typical wiring for [verify serials across the nameservers](https://docs.rual.nl/block-types/dns/dnszone_verify): a [function trigger](https://docs.rual.nl/block-types/globals/trigger_custom_function) starts the flow; [value](https://docs.rual.nl/block-types/value/value_default) feeds the `zone` pin; [with values](https://docs.rual.nl/block-types/array/array_of_values) feeds the `nodes` pin; the `flow` out pin feeds [debug](https://docs.rual.nl/block-types/state%2520ui/state_debug).

[![Studio canvas example for the verify serials across the nameservers block: typical wiring for verify serials across the nameservers.](https://docs.rual.nl/canvas-examples/dnszone_verify.png)](https://docs.rual.nl/canvas-examples/dnszone_verify.png?v=3)

## Used in these guides

These documentation pages use or explain this block:

- [DNS Zone Blocks](https://docs.rual.nl/reference/dns-blocks)

## Version history

Introduced in [`v15.0.0`](https://docs.rual.nl/core-versions/150000).

- [Back to `dns`](https://docs.rual.nl/block-types/dns): Return to the main group to view all sub-groups

- [Back to `DNS zones`](https://docs.rual.nl/block-types/dns?group=DNS%20zones): Return to the group to view all blocks within this group

Was this page helpful? [Tell us what to improve](https://docs.rual.nl/support) · RUAL Docs is an integral component of the [RUAL ecosystem](https://rual.nl)