Nameserver Lookup

Find the authoritative nameservers (NS records) and their corresponding IP addresses for a domain.

About Nameservers

Nameservers (NS records) determine which DNS servers are authoritative for a domain. When you type a domain name into your browser, the global root servers query these specific nameservers to find the IP address of your website.

DNS best practices recommend having at least two nameservers located on different network segments to ensure high availability and redundancy.

Our Nameserver Lookup returns the name servers a domain is delegated to at the registry, alongside the NS records published inside the zone itself. Comparing the two is how you catch the delegation mismatches that cause intermittent, hard-to-diagnose DNS failures.

What are Nameservers?

Nameservers are the authoritative DNS servers that hold a domain zone file and answer definitively for its records. Changing them moves the entire domain to a different DNS provider.

Delegation is recorded in two places. The registry holds the delegation you set through your registrar, and this is what resolvers are referred to when they walk down from the root. The zone itself also contains NS records, published by the nameservers you are delegated to.

Both should list exactly the same servers. When they diverge, resolvers may cache either answer depending on the path they took, which produces failures that affect some users and not others with no obvious pattern.

Authoritative servers holding the domain zone file
Delegation is stored at the registry and mirrored in the zone
Set through your registrar, not through DNS records alone
Two to four servers is standard practice
A mismatch between registry and zone causes intermittent failures

Why Nameserver Configuration Matters

Nameservers sit at the top of the DNS dependency chain, so an error there takes down the website, email and every subdomain simultaneously. There is no partial failure mode and no graceful degradation.

They are equally the top of the security chain. Whoever controls your nameservers controls every record in your domain and can silently redirect your website and intercept your mail, all while the domain still appears to be yours in WHOIS. This is why registrar locks, registry locks and multi-factor authentication on DNS accounts matter more than almost any other control.

A nameserver error takes down every service at once
Whoever controls them controls every DNS record you publish
Registry and zone mismatches cause failures for some users only
All nameservers at one provider is a single point of failure
Nameserver changes are the clearest signal of a domain hijack

How This Nameserver Lookup Works

The tool retrieves the delegation from WHOIS and the NS records from DNS, then compares them.

Validates the domain input against format and SSRF safety checks
Queries WHOIS for the nameservers recorded at the registry
Queries DNS for the NS records published inside the zone
Resolves each nameserver hostname to its current IP address
Compares both lists and flags any divergence

How to Use the Nameserver Lookup

Enter the domain name you want to check
Run the lookup to query both WHOIS and DNS
Confirm the registry delegation matches the zone NS records
Check that at least two nameservers are listed
Verify each nameserver hostname resolves to a valid address

Understanding Your Nameserver Results

The lookup compares two sources and reports on the servers themselves:

Field / Value	Meaning
`Registry delegation`	The nameservers recorded at the registry through your registrar. This is what resolvers are referred to when they descend from the root zone.
`Zone NS records`	The NS records published inside the zone by the authoritative servers. These should match the registry delegation exactly.
`Mismatch`	The two lists differ. Resolvers may cache either, so failures appear intermittent and affect only some users. This should be corrected promptly.
`Resolved IP`	The address each nameserver hostname currently resolves to. A blank value means the nameserver hostname itself is broken.
`Server count`	Two to four is standard and most registries require at least two. A single nameserver is a single point of failure for the entire domain.
`Provider diversity`	Whether all nameservers belong to one company. Critical domains sometimes split delegation across two independent providers to survive a provider-wide outage.

Common Problems & How to Fix Them

Resolvers may use either set depending on the path they took, so the domain works for some users and fails for others with no discernible pattern.

Decide which list is correct, then make both agree. Update the delegation at your registrar, or correct the NS records inside the zone at your DNS provider. This commonly happens after a provider migration where one half of the change was overlooked.

Any outage or maintenance on that single host takes the entire domain offline, including email.

Add a second nameserver. Nearly every DNS provider supplies several by default, so this is usually a matter of listing all of them at your registrar rather than only the first.

NS records commonly carry a TTL of 24 or 48 hours, so the old delegation remains cached long after the change.

The correct sequence is to build the complete zone at the new provider first, verify it answers correctly when queried directly, then switch the delegation at the registrar, and only remove the old zone once propagation has finished. Skipping the verification step is what turns a migration into an outage.

The delegation names a host with no A or AAAA record, so resolvers cannot reach it.

This is usually a leftover from a previous provider. Remove the obsolete entry, or if it is meant to be in use, add the missing glue record at your registrar — glue is required when a nameserver lives inside the domain it serves.

A provider-wide outage takes your domain completely offline, and such outages do happen.

For critical domains, delegate to two independent DNS providers serving identical zone data. It adds operational complexity, so weigh it against how much a total DNS outage would cost you.

Best Practices

Use at least two nameservers, ideally on separate networks
Keep registry delegation and zone NS records identical
Verify the new provider answers correctly before switching delegation
Never delete the old zone until propagation has fully completed
Consider split delegation across two providers for critical domains
Check that every nameserver hostname resolves to a valid address
Review nameserver configuration as part of regular domain auditing

Security Recommendations

Enable registrar lock and, for high-value domains, registry lock so nameservers cannot be changed without verification
Monitor nameserver records for unexpected changes, since a silent swap is a complete domain takeover
Use multi-factor authentication on both registrar and DNS provider accounts
Remove delegation to providers or accounts you no longer control, which enables dangling delegation attacks
Enable DNSSEC so resolvers can verify answers genuinely came from your authoritative servers
Confirm your nameservers refuse anonymous zone transfers, which would otherwise disclose your entire zone

Frequently Asked Questions

Nameservers are the authoritative DNS servers that hold your domain zone file and answer definitively for its records. Changing them moves your entire domain to a different DNS provider.

They are stored separately — the registry holds the delegation set through your registrar, and the zone contains its own NS records. They can drift apart after a migration where only one side was updated, and the result is intermittent failures.

Two to four. Most registries require a minimum of two, because a single nameserver is a single point of failure that can take down your website and email together.

Up to 48 hours. NS records typically carry long TTLs, so the old delegation stays cached well after the change. Always build and verify the new zone before switching, and leave the old zone running throughout.

A glue record supplies a nameserver IP address at the parent zone. It is required when the nameserver lives inside the domain it serves — ns1.example.com serving example.com — because resolution would otherwise be circular.

Yes, and it is a sound resilience measure for critical domains. Both providers must serve identical zone data, kept in sync by zone transfer or an API pipeline. It protects against a complete outage at either one.

The entire domain stops resolving — website, email and every subdomain simultaneously. Unlike most DNS errors there is no partial failure, because nameservers sit at the top of the dependency chain.