HomeDNS ToolsNS Lookup (Nameserver Checker)
DNS Tool

NS Lookup (Nameserver Checker)

Lookup NS records to find the authoritative nameservers for a domain. Validate DNS provider cutovers and troubleshoot authority issues fast.

Purpose
Find authoritative DNS
Confirm which nameservers answer for your domain.
Best For
DNS migrations
Avoid mismatched zones during cutovers.
Tip
After confirming NS, query an authoritative server directly to verify A/MX/TXT answers.
Waiting for input
Enter a domain, then press Lookup
How to Use

Use NS Lookup (Nameserver Checker) in 4 Steps

01
Enter domain
Type the domain you want to check (e.g. example.com).
02
Lookup NS
Press Lookup to fetch the authoritative nameserver set.
03
Validate authority
Confirm which DNS provider is authoritative for the domain.
04
Troubleshoot
If you're migrating DNS, confirm old/new zones match before switching.

What is an NS Lookup?

An NS lookup (nameserver lookup) queries the DNS system for NS records — the records that identify which authoritative nameservers are responsible for a domain's DNS zone. NS records are the foundation of DNS: they tell the global internet where to ask when resolving records for a domain.

Every domain registered with a registrar has at least two NS records pointing to authoritative nameservers. When a resolver needs to look up example.com, it asks the .com TLD servers for the NS set, then sends its query directly to one of those nameservers. The answer returned by the authoritative nameserver is final — not cached from elsewhere.

Major DNS Providers — NS Record Formats

Each DNS provider uses a distinct nameserver hostname pattern. Identifying the pattern in an NS record immediately tells you which provider hosts the zone.

ProviderNS Record FormatExample
Cloudflare*.ns.cloudflare.comaria.ns.cloudflare.com
AWS Route 53ns-*.awsdns-*.{co.uk|com|net|org}ns-123.awsdns-45.com
Google Cloud DNSns-cloud-*.googledomains.comns-cloud-a1.googledomains.com
Namecheap (FreeDNS)dns*.registrar-servers.comdns1.registrar-servers.com
GoDaddyns*.domaincontrol.comns49.domaincontrol.com
Cloudflare (Registrar)*.ns.cloudflare.com(same as above)
DigitalOceanns{1,2,3}.digitalocean.comns1.digitalocean.com
Azure DNSns{1,2,3,4}-*.azure-dns.{com|net|org|info}ns1-01.azure-dns.com
Vercel DNSns1.vercel-dns.comns1.vercel-dns.com
Squarespacens{1,2}.squarespace.comns1.squarespace.com

If the NS records do not match your intended provider, the DNS zone is being served by the wrong authoritative server — all subsequent record changes to your intended provider will have no effect.

Why NS Records Matter

  • DNS migrations: when you move between providers, you update NS records at the registrar. Until propagated, the old provider remains authoritative — changes at the new provider are invisible to most resolvers.
  • Propagation debugging: if your NS set is wrong, no amount of waiting will fix propagation — resolvers are querying the wrong authority.
  • Incident response: unexpected NS changes are a sign of domain hijacking. Verify NS records during any DNS incident before chasing A or MX records.
  • Email deliverability: MX records are served by the authoritative nameserver. Wrong NS = wrong MX = mail delivery failures.

How to Change Nameservers

Changing authoritative nameservers is done at the registrar (e.g., GoDaddy, Namecheap, Google Domains), not at the DNS provider. The process:

  1. Replicate all existing DNS records at the new provider before changing NS. Missing records cause outages.
  2. Lower the TTL on your current NS records to 300s (5 minutes) 24–48 hours in advance so old NS caches expire quickly after the switch.
  3. Log into your registrar and update the nameserver fields to the new provider's NS hostnames.
  4. Verify with NS Lookup that resolvers worldwide are returning the new NS set.
  5. Monitor A, MX, and TXT record resolution for 24–48 hours post-cutover.

Authoritative vs Recursive DNS

Authoritative nameservers host the zone file and return final answers. Recursive resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1, ISP resolvers) query authoritative servers and cache results for users. NS Lookup queries both to show the delegated authority (from the TLD) and the live NS records.

CLI Commands

# Get NS set for a domain
dig example.com NS +short
# Query authoritative nameserver directly (bypass cache)
dig @ns1.yourdnsprovider.com example.com A
# Trace delegation from root to authoritative (shows full path)
dig +trace example.com NS
# Windows equivalent
nslookup -type=NS example.com

Frequently Asked Questions

What does an NS record do?
An NS (nameserver) record lists the authoritative nameservers for a domain. These nameservers host the domain’s DNS zone and are the source of truth for its records.
Why do NS records matter during a DNS provider migration?
When you switch DNS providers, you typically update the registrar nameservers (NS). During the cutover, mismatched zones between old and new providers can cause inconsistent results.
How is NS lookup different from DNS propagation checking?
NS lookup shows which nameservers are authoritative. Propagation checking compares answers from many recursive resolvers to see where caches have updated.
What is the difference between authoritative and recursive DNS?
Authoritative nameservers host the zone data. Recursive resolvers query authoritative servers and cache results for users (ISPs, Google, Cloudflare, enterprise resolvers).
What should I check after changing nameservers?
Verify the NS set, then confirm the authoritative answers for key records (A/AAAA, MX, TXT) from the new provider, and use propagation checks to observe cache convergence.
When to Use
• Switching DNS providers (validate NS cutover)
• Debugging "wrong DNS" issues
• Confirming authority during incidents
CLI Reference
# Find NS
dig example.com NS +short
# Check SOA
dig example.com SOA +short
Free Newsletter

Get guides like this by email

DNS, email auth, and security playbooks delivered when they publish. No spam.