NS lookup
See which nameservers a domain uses, and check that a change at your registrar has taken effect.
Results for cloudflare.com
NOERROR
5 records found
Everything came back normally. Open any type below to copy its values.
NS5 of 5
5 records in 1 type.
Cloudflare
Changes reach caches within this time
Turn on DNSSEC in More options to check
NS5
| Name | TTL | Value |
|---|---|---|
| cloudflare.com | 21 h | ns3.cloudflare.com. |
| cloudflare.com | 21 h | ns4.cloudflare.com. |
| cloudflare.com | 21 h | ns5.cloudflare.com. |
| cloudflare.com | 21 h | ns6.cloudflare.com. |
| cloudflare.com | 21 h | ns7.cloudflare.com. |
Structured result (JSON) · 1.4 KB
{
"name": "cloudflare.com",
"type": "NS",
"resolver": "cloudflare",
"resolverName": "Cloudflare",
"rcode": "NOERROR",
"ad": false,
"dnssec": false,
"ms": 15,
"records": [
{
"name": "cloudflare.com",
"type": "NS",
"ttl": 76386,
"data": "ns3.cloudflare.com.",
"fields": {
"nameserver": "ns3.cloudflare.com"
}
},
{
"name": "cloudflare.com",
"type": "NS",
"ttl": 76386,
"data": "ns4.cloudflare.com.",
"fields": {
"nameserver": "ns4.cloudflare.com"
}
},
{
"name": "cloudflare.com",
"type": "NS",
"ttl": 76386,
"data": "ns5.cloudflare.com.",
"fields": {
"nameserver": "ns5.cloudflare.com"
}
},
{
"name": "cloudflare.com",
"type": "NS",
"ttl": 76386,
"data": "ns6.cloudflare.com.",
"fields": {
"nameserver": "ns6.cloudflare.com"
}
},
{
"name": "cloudflare.com",
"type": "NS",
"ttl": 76386,
"data": "ns7.cloudflare.com.",
"fields": {
"nameserver": "ns7.cloudflare.com"
}
}
],
"authority": [],
"queries": [
{
"type": "NS",
"rcode": "NOERROR",
"records": 5,
"ms": 15,
"ad": false
}
],
"ede": [],
"notes": [],
"truncated": false,
"server": "1.1.1.1",
"minTtl": 76386
}What NS records do
NS records name the servers that hold a domain's real DNS records. Every lookup of example.com ends at one of them. If you use a DNS provider, such as your registrar's default DNS, a cloud DNS service or a CDN, the NS records are how the rest of the internet finds that provider.
NS data lives in two places, and the two must agree. The delegation is stored at the registry for the extension (for .com, that is Verisign) and is set through your registrar. The zone's own NS records are stored on the nameservers. An NS lookup that asks the authoritative servers shows you the second one. The registry's view is in the WHOIS record.
How to find and verify nameservers
- Look up the domainEnter the registered domain, such as
example.com. A public resolver shows what most visitors get, and the authoritative servers show what is truly published. Usually there are two or more names, such asns1.provider.example. - Compare with your registrarThe names listed here should match the nameservers set at your registrar. If you just changed them, both lookups should show the new names once the change has spread.
- Check that the old and new hosts hold the same recordsBefore you switch providers, copy every record to the new one. Then ask each provider's nameserver for your A, MX and TXT records, for example with
dig @ns1.newprovider.example example.com MX, and compare the answers.
What a healthy answer looks like
- At least two nameservers, ideally on different networks, so one outage does not take the domain offline (RFC 2182).
- The same set everywhere. The registry's delegation, the resolver's answer and each server's own list should match. A mismatch is called a delegation inconsistency.
- Hostnames, not IP addresses. NS values are hostnames, and each one needs an A or AAAA record.
- Glue. If a nameserver sits inside the domain it serves (like
ns1.example.comforexample.com), the registry must also store its IP address as glue. Without it, no resolver can find the server. - Every server answers for the zone. A listed server that does not know the zone is called a lame delegation, and it wastes queries.
Common problems
- New nameservers don't show. The registrar change may not have saved, or the registry has not processed it yet. Confirm it in the WHOIS record, then wait for caches.
- Old and new answers alternate. Resolvers cached different delegations. It settles when the old TTL ends.
- The website works but email does not, or the other way round. A record was missed when you copied the zone to the new provider.
- Only one nameserver. Add a second on a different network to avoid a single point of failure.
- An NS record that points to a CNAME. That is not allowed. NS targets must be real hostnames with address records.
- The registry and the zone list different servers. The registry points to one provider, and the zone lists another. Fix whichever is wrong. The registry's delegation decides who gets the queries.
- DNSSEC breaks after a move. If the old provider's DS record stays at the registry, validating resolvers reject the new zone. Remove or replace the DS first. See DS lookup.
How the lookup works
LookupOwl sends an NS query (type 2) to the resolver or the authoritative servers you choose. To find the authoritative servers, it follows the delegation from the root, through the extension's servers, to the domain's own. The records come back with their TTLs. NS records are defined in RFC 1035. RFC 2182 gives advice on how many to run and where, and RFC 9499 explains the terms parent, child and glue.
dig NS example.com +short
nslookup -type=NS example.com
dig +trace example.com NSQuestions people ask
What is a nameserver?
A nameserver is a DNS server that holds the records for a domain and answers questions about it. A domain lists its nameservers in NS records, and the registry publishes the same list as the delegation. When you change DNS provider, the nameservers are the setting you change at your registrar.
How do I find out who hosts a domain's DNS?
Look at its NS records. Names like ns1.dnsprovider.example usually point to the provider. The company that hosts the DNS can be different from the one that hosts the website or the email, so this tells you about DNS only. For the website, look up the A record and then the IP WHOIS of the address.
How long do nameserver changes take?
The registry usually updates within minutes to a few hours, but resolvers may keep the old delegation for up to two days. Most visitors see the change much sooner than that. Keep the old provider's records live until the old TTL has passed, so nobody lands on an empty zone.
How many nameservers should a domain have?
At least two, on separate networks. Most providers give you two to four. One server is a single point of failure, and adding many more brings little extra safety. What matters most is that the servers sit in different places and all hold the same, current copy of the zone.
What is glue?
Glue is an address record the registry stores for a nameserver that lives inside the domain it serves. Without it, a resolver would need the domain's nameserver to find the nameserver, and it would go in circles. You only need glue when the nameserver's hostname ends in the domain itself.
Why does my registrar show different nameservers than this lookup?
The registrar's page shows what it asked the registry to publish. This lookup shows what DNS actually answers now. They differ while caches still hold the old data, or if the change was never completed. Ask the authoritative servers for the truth, then compare with the WHOIS record.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dns_lookup. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/dns-lookup?q=cloudflare.com"claude mcp add --transport http lookupowl https://lookupowl.com/mcp