NS Lookup

What NS records do

NS records name the authoritative nameservers for a zone: the servers that hold its records and answer for them. They exist in two places. The parent zone (for example.com, the .com registry) lists your nameservers as a delegation, and that list is what you change at your registrar. Your own zone lists them again. Resolvers start at the parent, follow its delegation to your servers, and from then on trust the copy in your zone. When the two lists differ, different resolvers can end up asking different servers, which is how one visitor sees an old website and another the new one.

Glue records and when you need them

If a nameserver lives inside the zone it serves, such as ns1.example.com for example.com, a resolver cannot find its address without first asking that same server. The registry breaks the loop by publishing the address next to the delegation; that address is the glue record. Nameservers in another domain, such as ns1.provider.net, need no glue. You manage glue at your registrar, usually under a name like "child nameservers" or "register host". When a nameserver gets a new IP address, the glue has to be updated there as well, or resolvers keep using the old address.

How to read the result

The first table shows the nameservers the zone itself publishes, with the addresses each one resolves to and whether it needs glue. The second table shows the delegation the registry returns over RDAP, including any glue addresses, and whether each nameserver appears in both lists. A nameserver without an address cannot be reached at all. A mismatch between the two lists, or glue that differs from the nameserver's A record, is worth fixing at the registrar. A name below the registered domain (www.example.com) has no NS records of its own, so the lookup shows the zone it belongs to.

Common nameserver problems

The most common one follows a move to a new DNS provider: the zone is set up at the new provider, but the nameservers at the registrar are never changed, or the old provider's servers stay in the list after the move and keep answering with stale data. Others are glue left pointing at an address the server no longer uses, an NS record that names a CNAME (not allowed by RFC 2181), and a zone served by one nameserver, or by several that all sit in the same network, so a single outage takes the domain offline. RFC 2182 recommends at least two nameservers in separate networks.

NS lookup and the nslookup command

nslookup is a command-line tool that queries any record type, not only NS records; nslookup -type=ns example.com is the equivalent of this page. For other record types use the DNS Lookup tool. To check that every nameserver really answers for the zone and serves the same version of it, query each one directly: dig +nssearch example.com prints the SOA serial every nameserver returns, and dig @ns1.example.com example.com SOA +norecurse asks one server on its own. This page reads the NS set through a public resolver and checks that each nameserver has an address; it does not send queries to the nameservers themselves.

Primary sources

• RFC 1034: domain concepts, delegation and glue
• RFC 2182: selection and operation of secondary DNS servers