NS Lookup - Nameserver Configuration Analysis

An NS lookup identifies the authoritative nameservers for a domain, revealing its DNS infrastructure and delegation chain. Use robtex.com to verify nameserver delegation and troubleshoot resolution failures.

Nameserver Fundamentals

Nameservers are the source of truth for a domain's DNS records. When resolvers need records for example.com, they ask example.com's nameservers.

NS lookup returns:

  • Nameserver hostnames - The servers authoritative for the domain
  • Nameserver IPs - Where those hostnames resolve (glue records when in-bailiwick)
  • NS source flags - Whether each NS comes from the zone itself, parent delegation, or is the SOA primary
  • Response consistency - Whether all nameservers return matching data

NS Record Flags

DNS Ninja tracks where each NS record originated:

  • Zone NS - Listed in the domain's own NS records
  • Delegated NS - Present in the parent zone's delegation
  • SOA mname - The primary nameserver from the SOA record

Mismatches between these sources indicate configuration problems. A healthy domain has all three agreeing.

How DNS Delegation Works

Domain delegation creates a chain of authority. The .com registry tells resolvers which nameservers are authoritative for example.com. Those nameservers then answer queries for the domain.

This delegation must match at both levels:

  1. The parent zone (registry) must list the domain's nameservers
  2. The nameservers must be configured to serve the zone

Mismatches cause resolution failures. A domain's NS records and registry delegation must agree.

Nameserver Infrastructure Patterns

Registrar nameservers - Basic hosting included with domain registration. Adequate for simple sites, limited features.

Managed DNS providers - Cloudflare, Route 53, NS1, etc. offer enhanced features: anycast, DDoS protection, advanced routing.

Self-hosted - Organizations running their own nameservers. Requires redundancy, monitoring, and security expertise.

Hidden primary - Primary server hidden from public queries, with public secondaries serving requests. Adds security through obscurity.

NS Lookup for Troubleshooting

Delegation check - Verify registry delegation matches zone NS records. Mismatches cause intermittent resolution failures.

Propagation issues - After nameserver changes, old delegation may be cached. Query parent zones directly to verify updates.

Nameserver health - Ensure all listed nameservers respond and return consistent data. One failing server causes partial outages.

Reverse NS Lookup

Find all domains using a specific nameserver. Enter a nameserver hostname to discover:

  • Every domain delegated to that nameserver
  • Infrastructure sharing patterns (hosting providers, CDNs)
  • Potential blast radius if that nameserver fails

This reveals how much of the internet depends on specific DNS infrastructure.

→ Check nameservers on robtex.com

FAQ

How many nameservers should a domain have?
Minimum two for redundancy. Most domains use two to four. More isn't necessarily better - it increases consistency challenges.
Why do nameserver changes take so long?
Registry updates and TTL caching. Parent zone NS records have long TTLs. Changes can take 24-48 hours to propagate fully.
What are glue records?
IP addresses for nameservers within the zone they serve. If ns1.example.com is a nameserver for example.com, the parent zone needs the IP to avoid circular dependency.
Can different nameservers return different records?
They shouldn't. Zone transfers or configuration management should keep all nameservers synchronized. Inconsistency causes unpredictable behavior.
How do I find all domains on a nameserver?
Use reverse NS lookup. Enter a nameserver hostname to see every domain delegated to it. A "Previously NS for" section shows domains that used to delegate but no longer do.
Can I see which domains previously used a nameserver?
Yes. The "Previously NS for" section appears below the current "NS for" table on any nameserver's page. It lists domains that historically delegated to this nameserver but have since moved to different nameservers.