What Is an NS Record? Nameserver Records Explained

DNS NS records (Nameserver records) identify the authoritative nameservers for a domain. They are the backbone of DNS delegation — when a resolver wants to know anything about your domain, NS records tell it exactly which servers to ask. Without NS records, no other DNS records for your domain can be found.

What Is an NS Record?

An NS record delegates the authority over a DNS zone to one or more nameservers. When a recursive resolver is looking up a record for example.com, it starts at the root of the DNS hierarchy and follows a chain of NS records downward until it reaches the authoritative nameservers for your domain. Those nameservers then provide the definitive answer.

NS records are set at two places: your domain registrar (to tell the TLD nameservers which servers are authoritative for your domain) and inside your DNS zone itself (as the zone apex NS records). Both must agree for your domain to resolve correctly.

NS Record Syntax

text

; NS record syntax
; NAME         TTL    CLASS  TYPE  NAMESERVER HOSTNAME
example.com.   86400  IN     NS    ns1.example-dns.com.
example.com.   86400  IN     NS    ns2.example-dns.com.

; Delegation for a subdomain zone
sub.example.com.  86400  IN  NS  ns1.sub-provider.net.
sub.example.com.  86400  IN  NS  ns2.sub-provider.net.

Like MX records, NS records always point to hostnames — never directly to IP addresses. The nameserver hostnames must have their own A or AAAA records, which are called glue recordswhen the nameserver hostname falls within the same zone being delegated.

How NS Records Work in the DNS Hierarchy

DNS is a distributed, hierarchical database. Resolution of any domain name follows a predictable path through this hierarchy:

Root nameservers — there are 13 logical root server addresses (a.root-servers.net through m.root-servers.net). They know the NS records for all top-level domains (.com, .net, .org, etc.).
TLD nameservers — the nameservers for the TLD (e.g., Verisign operates the .com TLD). They know the NS records for every domain registered under that TLD.
Authoritative nameservers — the servers your NS records point to. They hold the actual DNS records for your domain (A, MX, TXT, CNAME, etc.).

text

; DNS resolution chain for example.com
; Step 1: Root nameserver refers to .com TLD
.                     518400  IN  NS  a.gtld-servers.net.

; Step 2: .com TLD nameserver refers to domain's nameservers
example.com.          172800  IN  NS  ns1.example-dns.com.
example.com.          172800  IN  NS  ns2.example-dns.com.

; Step 3: Authoritative nameserver answers with the actual record
example.com.          3600    IN  A   93.184.216.34

Glue Records

A potential circular dependency arises when your nameserver hostnames live within your own domain. For example, if example.com's nameservers are ns1.example.com andns2.example.com, a resolver cannot find those servers without first resolvingexample.com — which requires asking those nameservers. This is solved withglue records: A records for the nameserver hostnames stored at the parent TLD nameservers, breaking the circular dependency.

Glue records are managed at your registrarIf your nameservers are subdomains of your own domain (e.g., ns1.yourdomain.com), you must register glue records (the IP addresses of those nameservers) through your domain registrar's control panel. Your DNS provider will usually handle this automatically when you use their hosted nameservers.

TTL for NS Records

NS records typically carry a high TTL — 86400 seconds (24 hours) or more is common. This is because nameserver changes are infrequent, and a high TTL reduces query load on TLD nameservers. The TTL on NS records is also governed by the TTL set by the TLD registry, which is often 172800 seconds (48 hours).

Nameserver changes can take 24–48 hours to propagateWhen you update nameservers at your registrar, the change must propagate from the TLD nameservers to recursive resolvers around the world. This can take anywhere from a few minutes to 48 hours, depending on how long resolvers cached the old NS records. Keep both old and new nameservers active during this transition window to ensure continuous DNS resolution.

How Many NS Records Should You Have?

The DNS specification (RFC 1034) requires at least two NS records per zone for redundancy. Most managed DNS providers give you two to four nameservers. Having multiple nameservers in geographically dispersed locations ensures your domain remains resolvable even if one nameserver is unavailable due to a network outage or hardware failure.

How to Check NS Records

You can verify your domain's nameservers using the ShowDNS DNS Lookup tool. Select NS as the record type and enter your domain to see the current authoritative nameservers as published at the TLD level.

text

; Query NS records with dig
dig example.com NS

;; ANSWER SECTION:
example.com.  86400  IN  NS  ns1.example-dns.com.
example.com.  86400  IN  NS  ns2.example-dns.com.

; Query from a specific nameserver to check propagation
dig @8.8.8.8 example.com NS

When Do NS Changes Take Effect?

A nameserver change goes through several stages before it is universally visible:

You update the nameservers at your domain registrar.
The registrar notifies the TLD registry (e.g., Verisign for .com).
The registry updates its nameserver delegation records — typically within minutes to a few hours.
Recursive resolvers around the world expire their cached NS records (based on the old TTL) and fetch the new ones.

Full global propagation usually completes within 24–48 hours, though many resolvers pick up the change much sooner. During migration, pre-populate your new DNS zone with all existing records before switching nameservers to eliminate any downtime.

Frequently Asked Questions

What is the difference between NS records and glue records?

NS records specify which nameservers are authoritative for a domain. Glue records are A records for those nameservers, stored at the parent TLD zone when the nameserver hostnames fall within the domain being delegated. They exist to break the circular dependency that would arise if a resolver needed to query ns1.example.com to find out where to look up records for example.com.

Can I use different NS records for subdomains?

Yes. You can delegate a subdomain to entirely different nameservers by publishing NS records for that subdomain in your parent zone. This is called subdomain delegation and is how large organizations divide DNS management between teams. The subdomain's NS records in the parent zone tell resolvers to switch to the delegated nameservers for anything under that subdomain.

Why do I see different NS records at my registrar versus in my zone?

Your registrar's nameserver settings are what the TLD registry publishes. Your zone's own NS records are what your authoritative nameservers publish. These should match, but occasionally they fall out of sync during migrations. If they differ, resolvers may behave unpredictably. Always ensure that both sets are identical.

What happens if all my nameservers go down?

If all authoritative nameservers for a domain become unreachable, resolvers cannot obtain answers for any DNS queries for that domain. The domain effectively goes offline — websites become unreachable, email cannot be delivered, and any service relying on DNS fails. Using nameservers from a reputable managed DNS provider with high-availability guarantees is the best protection against this.

How do I change nameservers without causing downtime?

The safest approach is to: (1) set up the new nameservers with a complete copy of your DNS zone, (2) verify all records are correct on the new servers, (3) update the nameservers at your registrar, (4) keep the old nameservers active and responding for at least 48–72 hours after switching. Most resolvers will switch to the new servers quickly, but some may hold cached NS records until the old TTL expires.