Free Tool
Nameserver Lookup
Check the nameservers for any domain. See NS records, the IP addresses behind each nameserver, the DNS provider running them, and a delegation health grade. Free, no signup required.
What You Get
Here's an example of a nameserver report. Try it above with any domain.
Nameserver Health: A
example.com — 2 nameservers found in 38ms · Cloudflare
A nameserver lookup starts with the domain's NS records — the servers the registry says are authoritative for your DNS. Those nameservers hold every other record you have, so if they are wrong or unreachable, nothing else about your DNS matters.
This tool then does the part a plain dig NS skips: it resolves each nameserver hostname to its IPv4 and IPv6 addresses, so you can see immediately whether a listed nameserver is actually reachable, how many separate networks your delegation spans, and which provider runs your DNS. It also compares the SOA primary against the NS set to catch half-finished migrations.
How It Works
Enter Domain
Type any domain name or URL. We'll extract the hostname and query its nameservers.
We Resolve the Delegation
We read the NS records, resolve every nameserver to its IPv4 and IPv6 addresses, and fetch the zone's SOA record.
Get Your Report
See each nameserver, its provider, redundancy across networks, SOA consistency, and a health grade. Copy, download, or share.
Nameserver Glossary
Plain-language definitions of the terms that come up in a nameserver lookup.
NS record
The record type that declares which nameservers are authoritative for a domain's DNS zone. Resolvers read the NS records from the parent zone (the TLD registry) to learn where to send every subsequent query for your domain.
Registry vs zone delegation
NS records are set in two places: at the registry (via your registrar, telling .com where to find your DNS) and inside your own DNS zone. Both should agree. If your registrar points at Cloudflare but your zone still claims Route 53, the delegation is inconsistent — and registry-level NS changes carry TTLs of 24–48 hours, so there is no way to rush the fix.
Glue records
The IP addresses of your nameservers, stored at the registry alongside the delegation. Without glue, a resolver looking for ns1.example.com would need to resolve example.com first — which requires ns1.example.com. Glue breaks that circle. This tool resolves each nameserver hostname to show you whether that lookup works at all.
SOA record
Start of Authority. Holds the zone's metadata: the primary nameserver, the admin contact, a serial number that increments on every change, and the refresh/retry/expire timers that secondary nameservers use to decide when to pull a fresh copy of the zone.
Registrar vs DNS host
Two separate jobs that are often — but not always — the same company. Your registrar controls the domain registration and which nameservers the registry publishes. Your DNS host runs those nameservers and holds the actual records. Pointing NS records at a new provider moves the DNS without moving the registration.
Secondary DNS
A second, independent set of nameservers that keeps a synchronised copy of your zone, usually via AXFR/IXFR zone transfers. It is the standard defence against a single DNS provider having a bad day — the 2016 Dyn outage taught a lot of large sites this lesson at once.
Delegation and propagation
Changing nameservers updates the delegation at the registry. Resolvers worldwide keep caching the old NS records until their TTL expires, so both old and new nameservers must serve correct data during the overlap — typically up to 48 hours.
Common Nameserver Problems
What a nameserver lookup can tell you is broken — and why each one matters.
Single nameserverOne nameserver is one point of failure
Every RFC and every registry recommends at least two nameservers. With one, a single host or network outage makes your entire domain unresolvable — the website, the API, and the email all go dark at once. Add a second nameserver, ideally on a different network.
Lame delegationA listed nameserver does not answer for the zone
The parent zone delegates your domain to a nameserver that either does not resolve or does not hold the zone. Resolvers that happen to pick that nameserver get no answer, so the domain fails intermittently — which is far harder to debug than a total outage. If a nameserver here shows as not resolving, that is a lame delegation.
SOA mismatchSOA primary is not in the NS record set
The SOA record names the zone's primary nameserver. When that hostname does not appear in the NS records, it is usually a leftover from a migration you thought was finished. It rarely breaks resolution outright, but it confuses secondary-DNS transfers and monitoring tools, and it is a reliable sign that the zone was never fully cleaned up.
Single networkAll nameservers sit in the same network
Two nameservers in one /16 give you host redundancy but not network redundancy — a routing problem takes them down together. One important exception: anycast providers like Cloudflare and Route 53 deliberately serve every nameserver from a single announced prefix, which is reachable from hundreds of locations worldwide. This tool knows the difference and only flags a shared network when it is genuinely a shared failure domain.
No IPv6No nameserver has an AAAA record
IPv6-only resolvers cannot reach an IPv4-only nameserver directly and must rely on translation, which adds latency and a failure mode you do not control. Every major managed DNS provider publishes IPv6 addresses for its nameservers — if yours does not, that is worth asking about.
Unexpected changeNameservers changed and nobody noticed
A nameserver change is exactly what a domain hijack looks like — an attacker who gains registrar access repoints delegation to their own DNS and takes over your traffic and email. It is also what a fumbled migration looks like. Either way, you want to find out from an alert, not from a customer.
Check Nameservers From the Command Line
Prefer a terminal? These are the equivalent lookups — including the one that bypasses every cache.
Find a domain's nameservers
dig example.com NS +shortThe quickest check on macOS or Linux. On Windows, use nslookup -type=ns example.com instead.
Ask the registry directly
dig example.com NS @a.gtld-servers.net +shortQueries the .com TLD servers directly, bypassing every cache. This is what the registry actually publishes — use it when a change seems not to have taken effect.
Test one specific nameserver
dig @ns1.example-dns.com example.com A +shortAsks a single nameserver for a record. If this returns nothing while other nameservers answer, that nameserver is lame — it is listed in the delegation but does not serve the zone.
Common DNS Providers and Their Nameservers
Your nameserver hostnames reveal who runs your DNS. The tool above recognises these and many more automatically.
| Provider | Nameserver pattern |
|---|---|
| Cloudflare | *.ns.cloudflare.com (assigned per domain) |
| AWS Route 53 | ns-*.awsdns-*.com / .net / .org / .co.uk |
| Google Cloud DNS | ns-cloud-*.googledomains.com |
| Azure DNS | ns*-*.azure-dns.com / .net / .org / .info |
| DigitalOcean | ns1-3.digitalocean.com |
| GoDaddy | ns*.domaincontrol.com |
| Namecheap | dns1-2.registrar-servers.com |
| NS1 | dns*.p*.nsone.net |
Frequently Asked Questions
Learn More About Nameservers & DNS
Guides on NS records, delegation risk, propagation, and DNS hijack detection.
DNS Record Types Explained
A, AAAA, MX, CNAME, TXT, NS, SOA, CAA — what every record type does and when you need it.
DNS Provider Concentration Risk
Why putting every nameserver at one provider is a single point of failure — and what secondary DNS fixes.
DNS Propagation Explained
Why nameserver changes take up to 48 hours, how TTL and caching work, and how to plan a migration.
Catching DNS Hijacks
Unexpected nameserver changes are the signature of a domain takeover. How to detect them without false alarms.
Last updated · Built and maintained by exit1.dev — uptime, SSL, and domain monitoring with instant alerts.
Know When Your Nameservers Change
A manual lookup tells you the state right now. exit1.dev monitors your domains around the clock and alerts you the moment something changes — so a hijack or a fumbled migration reaches you as a notification, not a support ticket.
Start Free Monitoring