The parent servers are not providing glue for all your nameservers. This means that they are supplying the NS records (host.example.com), but not supplying the A records.
That may cause some extra milliseconds in DNS. This will usually occur if your DNS servers are not in the same TLD as your domain
Skip glue checking. Make sure the nameservers domain is good standing
Nameservers A records
Some servers does not provide A records for nameservers.
missing A record(s) for (ns-195-b.gandi.net,ns-248-c.gandi.net,ns-127-a.gandi.net) at nameserver 18.104.22.168
missing A record(s) for (ns-195-b.gandi.net,ns-127-a.gandi.net,ns-248-c.gandi.net) at nameserver 22.214.171.124
Nameservers report identical NS records
The NS records at all your nameservers are identical.
Some nameservers does not respond:
Nameserver name validity
All of the NS records that your nameservers report are valid (no IPs or partial domain names).
Number of nameservers
You have 3 nameservers. You must have at least 2 nameservers (RFC2182 section 5 recommends at least 3 nameservers), and preferably no more than 7.
All the nameservers listed at the parent servers answer authoritatively for your domain.
Missing (stealth) nameservers
All your nameservers are also listed at the parent servers.
Root missing nameservers
All of the nameservers listed at the parent nameservers are also listed as NS records at your nameservers.
Nameservers on separate class C's
Nameservers are in a different networks.
All of your NS records appear to use public IPs.
SOA record is:
All your nameservers agree that your SOA serial number is 1518574572 That means that all your nameservers are using the same data.
SOA (Start of Authority) record states that your master (primary) name server is: ns1.gandi.net, but that server is not listed at the parent servers.
SOA serial number is: 1518574572 This appears to be in the recommended format of YYYYMMDDnn, where 'nn' is the revision. This number must be incremented every time you make a DNS change.
SOA Retry interval is : 10800 seconds. This seems OK. (Values about 3600-7200 seconds is good if not using DNS NOTIFY; RFC1912 2.2 recommends a value between 1200 to 43200 seconds (20 minutes to 12 hours)). This value determines how often secondary/slave nameservers check with the master for updates.
SOA Retry interval is : 3600 seconds. This seems OK. (Values about 120-7200 seconds is good). The retry value is the amount of time your secondary/slave nameservers will wait to contact the master nameserver again if the last attempt failed.
SOA Expire time is : 604800 seconds. This seems OK. (Values 604800 to 2419200 seconds (1-4 weeks) is good). RFC1912 suggests 2-4 weeks. This is how long a secondary/slave nameserver will wait before considering its DNS data stale if it can't reach the primary nameserver.
SOA Expire time is : 10800 seconds. This seems OK. (about 300 to 86400 seconds or 5 min - 24 hours is good). RFC2308 suggests a value of 1-3 hours. This value used to determine the default (technically, minimum) TTL (time-to-live) for DNS entries, but now is used for negative caching.
Trace to tcfsh2017gra.xyz
lookup tcfsh2017gra.xyz at A.ROOT-SERVERS.NET(126.96.36.199) 7 ms
A.ROOT-SERVERS.NET(188.8.131.52) refer to x.nic.xyz(184.108.40.206)
lookup tcfsh2017gra.xyz at x.nic.xyz(220.127.116.11) 184 ms
x.nic.xyz(18.104.22.168) refer to ns-195-b.gandi.net(unknow IP)
extra IP lookup for ns-195-b.gandi.net at root server A.ROOT-SERVERS.NET(22.214.171.124)
lookup ns-195-b.gandi.net at A.ROOT-SERVERS.NET(126.96.36.199) 5 ms
A.ROOT-SERVERS.NET(188.8.131.52) refer to e.gtld-servers.net(184.108.40.206)
lookup ns-195-b.gandi.net at e.gtld-servers.net(220.127.116.11) 41 ms
e.gtld-servers.net(18.104.22.168) refer to dns0.gandi.net(22.214.171.124)
lookup ns-195-b.gandi.net at dns0.gandi.net(126.96.36.199) 176 ms
got A record 'ns-195-b.gandi.net IN A 188.8.131.52' from ns-195-b.gandi.net(184.108.40.206)
lookup tcfsh2017gra.xyz at ns-195-b.gandi.net(220.127.116.11) 174 ms
got A record 'tcfsh2017gra.xyz IN A 18.104.22.168' from tcfsh2017gra.xyz(22.214.171.124)