NS Lookup

NS Lookup retrieves the Name Server (NS) records for a domain - the authoritative DNS servers responsible for answering queries about that domain. Every domain must have at least two NS records for redundancy.

Common reasons include: verifying DNS propagation after migrating to a new DNS provider, confirming which DNS host controls a domain, troubleshooting DNS resolution failures, and conducting security analysis (unauthorized NS changes are a key indicator of domain hijacking).

WHOIS shows the nameservers registered with the domain registrar - what the registry thinks the nameservers are. NS records come from DNS itself - what the internet actually resolves. These should match; a discrepancy may indicate a misconfiguration or hijack attempt.

Most domains have 2–4 nameservers. Using multiple nameservers provides redundancy - if one fails, others continue to answer queries. Enterprise and high-traffic domains often use 4+ nameservers across geographically distributed locations.

Yes. Unexpected changes to NS records are one of the primary indicators of domain hijacking. Regularly monitoring NS records for your owned domains and alerting on changes is a recommended security practice.

TTL (Time-To-Live) determines how long DNS resolvers cache the NS record before re-querying. A lower TTL means faster propagation of changes but higher query load; a higher TTL is more stable but slows down migrations. Typical NS TTLs range from 3,600 to 86,400 seconds.

A glue record is an A or AAAA record stored at the registry that gives the IP address of a nameserver whose hostname sits inside the domain it serves. If example.com uses ns1.example.com, resolvers cannot look up that nameserver without already knowing where it is. The glue record breaks that loop. Domains using third-party nameservers do not need glue records.

Run a nameserver lookup and read the nameserver hostnames. The domain in those hostnames identifies the provider: ns1.cloudflare.com means Cloudflare, ns-1234.awsdns-56.org means AWS Route 53, ns1.digitalocean.com means DigitalOcean. If the hostnames sit on the domain itself, the owner runs their own nameservers.

A reverse NS lookup starts from a nameserver hostname and returns every domain delegated to it, which is the opposite direction of this tool. Public DNS resolvers cannot answer this because it requires an indexed DNS database rather than a live query. Use the WhoisFreaks Reverse DNS Lookup, which supports NS as one of seven reverse search types.