Skip to content
Webmaster Tools
DNS & domainsDNS LookupNS record

NS record

NS records say which name servers are authoritative for a domain. How delegation works, Cloudflare setups, glue records, how to check them and what goes wrong.

What it is

An NS record (name server) names a server that holds the authoritative answers for a zone. NS records are how DNS is delegated: the .com servers don't know your A or MX records, but they know which name servers do, and send resolvers there. Defined in RFC 1035.

example.com.  86400  IN  NS  ns1.dnsprovider.net.
example.com.  86400  IN  NS  ns2.dnsprovider.net.

The same NS set exists in two places: in the parent zone (.com), set through your registrar, and at the top of your own zone at the DNS provider. Resolvers follow the parent's copy to find you, so that's the one that decides which provider is live.

The fields

Field Example Meaning
Name example.com. The zone being delegated (or a subdomain delegated to other servers)
TTL 86400 Seconds resolvers may cache it; the parent sets its own, often 1-2 days
Type NS Name server
Data ns1.dnsprovider.net. Hostname of an authoritative server

The data must be a hostname, never an IP address, and it must not be a CNAME (RFC 2181). When the name server lives inside the zone it serves (ns1.example.com for example.com), the parent also stores its IP as a glue record, or nobody could reach it.

Common setups

  • Registrar DNS: the default; the registrar's own name servers are listed and you edit records in its panel.
  • Cloudflare: you're assigned two name servers like ada.ns.cloudflare.com and bob.ns.cloudflare.com, and you replace the registrar's NS with them. The pair differs between accounts, so copy yours exactly.
  • Delegating a subdomain: dev.example.com. NS ns1.otherprovider.net. hands just that subdomain to another provider, for example a cloud DNS zone managed by Terraform.
  • Two or more servers, on separate networks, is the norm; most registries require at least two.

How to check it

Use our DNS Lookup, and the WHOIS Lookup to see the name servers the registrar has on file. The DNS Propagation Checker shows whether resolvers have picked up a provider change. From a terminal:

dig example.com NS +short
dig +trace example.com           # follows delegation from the root down
dig @a.gtld-servers.net example.com NS   # what .com hands out
nslookup -type=NS example.com

Common mistakes

  • Changing NS at the DNS provider instead of the registrar. Only the registrar can update the parent zone.
  • Moving providers without copying records first. The moment the new NS is live, every record missing there stops resolving: MX included.
  • Lame delegation: an NS listed in the parent that doesn't answer authoritatively for the zone. Lookups slow down or fail intermittently.
  • Expecting a fast switch. Resolvers cache the parent's NS for its TTL, often 48 hours, so old and new providers both get queries for a while; keep both serving the same data.
  • DNSSEC left on with a DS record for the old provider's keys: the domain fails validation everywhere. Remove the DS before moving, or migrate keys.