Nameserver Checker

The tool looks up the NS records of the registrable domain and then resolves the A and AAAA records of each nameserver hostname. It also fetches the zone's SOA record. From those answers it evaluates:

• Count: at least two nameservers are expected. One nameserver is a single point of failure, and none means the domain does not resolve.
• Resolvability: every nameserver name must resolve to an address. A nameserver that resolves to nothing cannot answer queries.
• Public addresses: a nameserver that points to a private or reserved address such as 10.0.0.1 cannot be reached from the internet.
• Network diversity: whether the IPv4 addresses sit in more than one /24 network. Servers in the same range tend to share an outage.
• IPv6: whether any nameserver has an IPv6 address.
• SOA: whether the zone publishes a start-of-authority record, and its serial number.

FAIL findings deserve immediate attention: a single nameserver, a nameserver that does not resolve or one that points to a private address. A WARNING for network diversity means all IPv4 addresses share one /24 range, which is common with small hosting setups and worth improving if uptime matters. The IPv6 finding is a PASS when at least one nameserver has an IPv6 address and INFO otherwise, since IPv4-only DNS still works for almost everyone.

The table lists each nameserver with its addresses and whether it sits inside the domain it serves (an in-zone or "in-bailiwick" nameserver such as ns1.example.com for example.com). In-zone nameservers need glue records at the registry, which your registrar manages.

Nameservers are set at your registrar, not in your DNS zone. If the list here is wrong, update it in the registrar's control panel, then give caches time to expire. If a nameserver does not resolve, check for a typo in its hostname or ask your DNS provider for the correct names. To add redundancy, many DNS providers offer secondary DNS, or you can combine two providers that both serve the same zone data. Understanding nameservers covers delegation and glue in more depth.

All queries go through public recursive resolvers over DNS-over-HTTPS. The tool does not contact each nameserver directly, so it cannot detect a "lame" server that resolves correctly but refuses to answer for your zone, or servers that hold different versions of the zone. If you suspect either, compare the SOA serial reported by your DNS provider for each server. The registry's own view of the delegation is available in the RDAP / WHOIS Lookup.