Home › Tools › Network & DNS › Network & DNS Tools

NS Record Lookup

ns-lookup

Inspect authoritative nameservers and quickly validate delegation.

Enter a target and run the tool.

Related DNS Tools

About NS Lookup

NS (Nameserver) records identify the authoritative DNS servers responsible for answering all queries about a domain. When a recursive resolver needs to look up any DNS record — an A address, an MX mail server, a TXT policy record — it first finds the NS records for the domain to know which servers are the official source of truth. The AT USE NS lookup tool queries live DNS via DNS-over-HTTPS and returns every authoritative nameserver currently published for the domain you enter. Use it to verify a DNS provider migration completed at the registrar, to confirm delegation matches the intended hosting setup, or to diagnose intermittent resolution failures caused by inconsistent nameserver configuration. No account required, no rate limits for normal use.

How to look up NS records

  1. Enter the domain you want to inspect in the input field — for example, example.com. Enter only the apex domain; NS records live at the zone root, not at subdomains.
  2. Click Lookup. The tool queries a public DNS-over-HTTPS resolver and returns all NS records currently published for that domain.
  3. Review the list of nameserver hostnames returned. A typical result shows 2 to 4 nameservers from the same provider — for example, Cloudflare domains return a pair like aria.ns.cloudflare.com and rick.ns.cloudflare.com; AWS Route 53 domains return four nameservers in the awsdns-*.com/.net/.org/.co.uk pattern.
  4. Compare the result against your registrar's nameserver configuration. If the registrar and this lookup agree, delegation is correct and all further DNS queries for this domain route through the right servers. If they disagree, a change you made at the registrar has not propagated yet.

Results come from an external public resolver rather than your local network, so they show the public view — the same result an external user or service would get when resolving this domain.

How DNS delegation works

The Domain Name System is a hierarchy. At the top are the root servers. Below them are the TLD servers (one set for .com, another for .net, and so on). When you register a domain and set nameservers at your registrar, the registrar instructs the TLD servers to publish a delegation: "for example.com, ask these nameservers." Every recursive resolver in the world follows this chain — root → TLD → authoritative nameservers — each time it resolves a name it has not recently cached.

Your registrar's nameserver configuration is therefore the authoritative source of what NS records the world sees. Your DNS provider (Cloudflare, Route 53, Google Cloud DNS, Namecheap, etc.) hosts the zone data, but none of it matters unless the registrar delegates correctly. This is why NS mismatches — where the registrar has old nameservers and your DNS provider's zone contains updated records — cause intermittent or complete resolution failures.

Nameserver changes propagate based on the TTL of the NS records in the parent zone (the TLD zone), which is controlled by the TLD registry. For .com and .net, this is typically 172,800 seconds (48 hours). In practice most resolvers see nameserver changes within a few hours once the registrar submits the update, but full propagation can take up to 48 hours.

Common use cases

  • DNS provider migration verification — confirm that a registrar-level nameserver update propagated after switching to a new DNS provider. Verify the new provider's nameservers appear and the old provider's servers are no longer listed.
  • Registrar transfer validation — check that a completed domain transfer preserved the correct nameserver configuration and did not leave the domain pointing at generic registrar placeholder nameservers.
  • Multi-provider DNS health check — verify all expected nameservers from both providers appear in the NS record set when running a high-availability dual-DNS setup, confirming redundancy is intact.
  • Domain portfolio audit — quickly inspect a group of domains to confirm all are delegated to the intended DNS provider and none are pointing at legacy, deprecated, or third-party nameservers.

How to use this tool

  1. Enter the domain you want to inspect (for example, example.com).
  2. Click "Lookup" to query the authoritative nameservers via DNS-over-HTTPS.
  3. Review the list of NS hostnames returned for the domain.
  4. Compare the result against your registrar configuration to confirm delegation matches.

Frequently asked questions

How many nameservers should a domain have?

Most DNS providers configure 2 to 4 nameservers per domain for redundancy. Fewer than 2 creates a single point of failure — if the only nameserver is unreachable, the domain stops resolving entirely. The DNS specification requires at least 2 nameservers for any zone.

Why do my registrar's nameservers differ from what this lookup returns?

Your registrar's control panel shows what you have configured, which is submitted to the parent TLD registry. This lookup queries a live resolver, which reflects what the TLD registry has published. Differences usually mean the registrar's update has not yet propagated to the TLD servers — typically a matter of hours, up to 48 hours at most.

How long do nameserver changes take to propagate?

NS changes at the registrar level propagate through the TLD zone, whose TTL is controlled by the registry (typically 172,800 seconds, or 48 hours, for .com/.net). In practice most resolvers pick up the change within a few hours of the registrar confirming the update.

Can I use nameservers from multiple providers simultaneously?

Yes. Multi-provider DNS is a valid high-availability architecture. All nameservers in the NS record set must serve identical zone data; inconsistent records across providers cause random resolution behavior depending on which server a resolver queries.

What is a glue record and when does it matter?

A glue record is an A/AAAA record in the parent zone (the TLD zone) that gives the IP address of a nameserver whose hostname falls within the zone it serves. For example, if your nameserver is ns1.example.com and it is the authoritative server for example.com, a resolver cannot find ns1.example.com without first finding example.com — a circular dependency. The registrar breaks this circle by submitting a glue record to the TLD registry. If you set up self-hosted nameservers under your own domain, your registrar will ask for the nameserver IP addresses so it can submit glue records.

Does changing NS records affect my email or website immediately?

Changing NS records delegates all DNS lookups to new nameservers. If the new nameservers do not have your A, MX, and other records configured identically to the old zone, services will break when resolvers switch over. Always replicate all existing records in the new DNS provider's zone before updating the NS records at the registrar.