DNS · NS
NS record lookup
NS records list the authoritative name servers for a domain — the servers that hold the zone's actual records. The first stop for any DNS resolution chain after the TLD.
beginner
NS
How to look it up
Four ways to query — pick by what's available on your machine.
digdig NS example.com +short
dig (trace)dig NS example.com +trace
dotdigdotdig ns example.com
Sample response
ns1.dns-provider.net. ns2.dns-provider.net. ns3.dns-provider.net. ns4.dns-provider.net.
Format
List of FQDN hostnames, ending with trailing dot. Order is not significant — resolvers usually round-robin or pick the lowest-RTT.
Common pitfalls
- NS at parent (e.g. `.com`) MUST match NS at zone (the domain's own NS records). Mismatch = 'lame delegation' — slow or broken resolution.
- NS pointing to a CNAME is forbidden (RFC 2181). NS targets must be A/AAAA.
- When migrating DNS providers, both old and new NS often coexist for ~48h to allow propagation. Update at registrar then both providers, then cleanup.
Why it matters for security
security relevance
NS pointing to deprovisioned hosts = subdomain takeover. Compromise of a name server = full DNS takeover. Use multiple geographically diverse NS providers for redundancy.
Use cases
- Verify DNS migration completed
- Audit current name server provider
- Diagnose 'domain doesn't resolve' issues
- Pre-migration sanity check
Look up DNS without flag soup
dotdig is a friendly DNS resolver — formatted output, custom resolver support, DNSSEC validation. Zero-config alternative to dig.
Open dotdig