NS Lookup with DIG
dig ns lookup · nameserver check · dns ns record · authoritative dns
How to check NS records with DIG, delegation glue, mismatched registrar NS, and fixing DNS after hosting moves.
By DN01 Network Team
NS records identify authoritative nameservers for a zone. If NS at the registrar does not match the NS inside the zone, resolution fails unpredictably. NS lookup is step one when «DNS looks fine in the panel but the world sees nothing».
Run DIG type NS, then cross-check with WHOIS nameserver fields and a full DNS Checker pass for sibling records (A, MX, TXT).
NS debugging separates registrar delegation problems from empty or typoed zones at the DNS host — both look like «site down» until you compare all three views.
Delegation and glue
In-bailiwick NS (`ns1.example.com` for `example.com`) need glue A/AAAA records at the parent. Out-of-bailiwick NS (`ns1.hosting.com`) rely on the parent of the NS hostname.
Minimum two NS hosts on different networks is best practice for redundancy.
Glue missing at the registry causes lame delegation — DIG NS may list nameservers that do not resolve, and all other record types become unreachable.
Debugging wrong NS after a move
Compare registrar NS, zone NS, and cached recursive answers. Update registrar first when switching DNS providers, wait for propagation, then populate records at the new host.
SOA serial increments when the zone changes — note it in change tickets.
If WHOIS NS already points to the new provider but DIG still returns old NS from 8.8.8.8, you are waiting on TTL — document expected wait from prior NS TTL before escalating.
Authoritative vs recursive NS answers
Recursive resolvers cache NS like any record — during NS migration, stale NS misleads you into editing records at the wrong DNS panel.
Query each authoritative nameserver directly with DIG when siblings disagree — one secondary NS behind on zone transfer serves outdated NS or missing records.
After NS cutover, run DIG type NS from two public resolvers and compare with WHOIS — all three should list the same set within the propagation window.
NS lookup checklist
Step 1 — DIG type NS on the domain. Step 2 — WHOIS nameserver fields at registry. Step 3 — DNS Checker for A/MX/TXT at the same domain. Step 4 — If mismatch, fix registrar delegation before adding records at the new host.
Child delegations (subdomain NS to another DNS operator) require NS records on the parent zone — NS lookup on the subdomain confirms whether delegation published.
Keep a screenshot of correct NS from all three sources in migration runbooks — future you will need proof of baseline during rollback debates.
Frequently asked questions
- Can NS change without other records changing?
Yes — nameserver migrations swap NS while copying A/MX/TXT. Verify all records after NS cutover.
- Why two NS names resolve to one IP?
Misconfiguration — providers expect diverse anycast or separate hosts. Fix for resilience.
- Does NS affect email?
Indirectly — if NS points to wrong host, MX published there is what the world uses.
- How many NS records should a zone have?
At least two; many registries require two to four authoritative nameservers for stability.
- What if DIG NS is empty?
Domain may be expired, unregistered, or blocked — check WHOIS status and registry hold codes before editing DNS panels.