NS Lookup (Nameserver Checker)
Lookup NS records to find the authoritative nameservers for a domain. Validate DNS provider cutovers and troubleshoot authority issues fast.
Use NS Lookup (Nameserver Checker) in 4 Steps
What is an NS Lookup?
An NS lookup (nameserver lookup) queries the DNS system for NS records — the records that identify which authoritative nameservers are responsible for a domain's DNS zone. NS records are the foundation of DNS: they tell the global internet where to ask when resolving records for a domain.
Every domain registered with a registrar has at least two NS records pointing to authoritative nameservers. When a resolver needs to look up example.com, it asks the .com TLD servers for the NS set, then sends its query directly to one of those nameservers. The answer returned by the authoritative nameserver is final — not cached from elsewhere.
Major DNS Providers — NS Record Formats
Each DNS provider uses a distinct nameserver hostname pattern. Identifying the pattern in an NS record immediately tells you which provider hosts the zone.
| Provider | NS Record Format | Example |
|---|---|---|
| Cloudflare | *.ns.cloudflare.com | aria.ns.cloudflare.com |
| AWS Route 53 | ns-*.awsdns-*.{co.uk|com|net|org} | ns-123.awsdns-45.com |
| Google Cloud DNS | ns-cloud-*.googledomains.com | ns-cloud-a1.googledomains.com |
| Namecheap (FreeDNS) | dns*.registrar-servers.com | dns1.registrar-servers.com |
| GoDaddy | ns*.domaincontrol.com | ns49.domaincontrol.com |
| Cloudflare (Registrar) | *.ns.cloudflare.com | (same as above) |
| DigitalOcean | ns{1,2,3}.digitalocean.com | ns1.digitalocean.com |
| Azure DNS | ns{1,2,3,4}-*.azure-dns.{com|net|org|info} | ns1-01.azure-dns.com |
| Vercel DNS | ns1.vercel-dns.com | ns1.vercel-dns.com |
| Squarespace | ns{1,2}.squarespace.com | ns1.squarespace.com |
If the NS records do not match your intended provider, the DNS zone is being served by the wrong authoritative server — all subsequent record changes to your intended provider will have no effect.
Why NS Records Matter
- DNS migrations: when you move between providers, you update NS records at the registrar. Until propagated, the old provider remains authoritative — changes at the new provider are invisible to most resolvers.
- Propagation debugging: if your NS set is wrong, no amount of waiting will fix propagation — resolvers are querying the wrong authority.
- Incident response: unexpected NS changes are a sign of domain hijacking. Verify NS records during any DNS incident before chasing A or MX records.
- Email deliverability: MX records are served by the authoritative nameserver. Wrong NS = wrong MX = mail delivery failures.
How to Change Nameservers
Changing authoritative nameservers is done at the registrar (e.g., GoDaddy, Namecheap, Google Domains), not at the DNS provider. The process:
- Replicate all existing DNS records at the new provider before changing NS. Missing records cause outages.
- Lower the TTL on your current NS records to 300s (5 minutes) 24–48 hours in advance so old NS caches expire quickly after the switch.
- Log into your registrar and update the nameserver fields to the new provider's NS hostnames.
- Verify with NS Lookup that resolvers worldwide are returning the new NS set.
- Monitor A, MX, and TXT record resolution for 24–48 hours post-cutover.
Authoritative vs Recursive DNS
Authoritative nameservers host the zone file and return final answers. Recursive resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1, ISP resolvers) query authoritative servers and cache results for users. NS Lookup queries both to show the delegated authority (from the TLD) and the live NS records.
CLI Commands
Frequently Asked Questions
Get guides like this by email
DNS, email auth, and security playbooks delivered when they publish. No spam.