An NS record indicates which servers are authoritative for a DNS zone. It lists the names of servers that hold the zone. Resolvers query these servers to obtain other records.
An NS record contains a name, a type, an NS target, and a TTL. The TTL indicates how long the response remains cached in the local resolver.
| Name | Type | NS Server | TTL in seconds |
|---|
| @ | NS | ns1.example.net. | 3600 |
In this example, the name @ targets the zone's apex. The target is a hostname. This name must publish A or AAAA records and be reachable.
A zone must publish multiple NS records. This provides redundancy and better availability.
| Name | Type | NS Server | TTL in seconds |
|---|
| @ | NS | ns1.example.net. | 3600 |
| @ | NS | ns2.example.net. | 3600 |
Plan for two or more servers. They must respond consistently.
To delegate sub.example.com, add NS records on this name in the parent zone. Each target must resolve to A or AAAA. If the server name is inside the subdomain, the parent zone can publish helper addresses called glue. The objective remains simple. Allow resolvers to quickly reach the subdomain's servers.
A short TTL makes a server change more visible. Useful during a switchover phase.
A medium or long TTL reduces queries to authoritative servers. Suitable for a stable zone.
Reduce the TTL a few hours before a change, then increase it after validation.
Good to know
NS and SOA are published at a zone's apex. A CNAME must not appear on a name that carries NS records. An NS target is always a name, not an address.
At the zone's apex to designate the authoritative servers for this zone.
On a subdomain when delegating this subdomain to dedicated servers.
Child zones have their own SOA and their own NS records.
To avoid
Pointing an NS record to a direct address.
Publishing only one NS on a zone.
Leaving an NS target without A or AAAA.
Having different NS sets between parent zone and child zone without reason.
An online DNS lookup allows entering a domain name. The result displays the list of NS servers and the TTL visible from the Internet. It's a useful first check. Then perform a local test from your machine.
Windows provides nslookup. It can be used in interactive mode.
nslookup
set q=ns
example.com
nslookup
set q=ns
server 1.1.1.1
example.com
The first part queries according to the machine's network configuration. The second forces the use of a third-party resolver, here Cloudflare's.
On these systems, the dig command is practical and easy to use.
dig NS example.com
dig NS example.com @1.1.1.1
Multiple NS lines indicate multiple servers. Look for varied names and different networks for better resilience.
A high remaining TTL may explain a lag after a change.
A discrepancy between NS records seen from the parent zone and those seen in the zone itself reveals a lack of synchronization.
- Prepare the new servers and their A or AAAA records.
- Reduce the NS TTL to 300 or even 60 seconds a few hours before the switchover.
- Update the zone with the new NS list.
- Update the delegation at the registry if necessary.
- Verify from multiple networks then increase the TTL when everything is stable.
Practical tip
Keep a record with the list of NS records published on the zone side and registry side. Note the date, TTL, and reason for change. This trace prevents discrepancies during updates.
Publish the new NS records in the zone. Update the delegation at the registrar. Verify consistency.
Add NS records on the subdomain in the parent zone. The team then manages its child zone with its own SOA.
Add one more NS. Verify it resolves to A or AAAA and serves the updated zone.
- If the zone sometimes responds with old records, verify the consistency of published NS records.
- If an NS server doesn't respond, temporarily remove its entry while repairing it.
- If delegation doesn't work, verify the presence of glue addresses when they are necessary.
- If the response remains old despite the update, wait for TTL expiration and purge the local resolver cache if possible.
In summary, an NS record designates the authoritative servers of a zone. It must point to reachable and consistent names. A zone publishes multiple NS records for availability. A well-adjusted TTL facilitates transitions. Verification goes through an online tool then through nslookup and dig.
With these markers, management remains clear. Changes proceed without stress. Resolvers find the zone without incident.