Changing nameservers is one of the highest-risk DNS operations because — unlike changing an A record or MX record — it transfers authority for your entire domain to a different DNS provider, and getting the timing wrong can make your domain unreachable worldwide for hours
The previous articles on this site covered NS lookup basics, DNS propagation, DNS provider comparison, glue records and delegation, and single-provider redundancy risks. This article addresses NS record security — specifically how nameserver hijacking works, what authoritative delegation means legally and technically, and why unauthorized NS record changes are among the most damaging domain attacks.
What authoritative delegation means
When a domain's NS records are changed, the new nameservers become the authoritative source of truth for all records under that domain. The registrar (the company where the domain is registered, like GoDaddy or Namecheap) delegates authority by pointing to specific nameservers — and from that moment, whoever controls those nameservers controls:
- Where the domain's website points (A/CNAME records)
- Where email routes (MX records)
- What SPF/DKIM/DMARC says (TXT records)
- All subdomains under the domain
This is why NS record changes are categorically more dangerous than A record changes. An unauthorized A record change redirects the website. An unauthorized NS change can redirect everything — website, email, subdomains — simultaneously, and can defeat email authentication entirely.
Nameserver hijacking: how unauthorized NS changes happen
NS record changes originate at the registrar — the registrar's control panel is where you change which nameservers your domain uses. An attacker who gains access to the registrar account can change NS records.
Common attack vectors:
Registrar account compromise: the registrar account password is phished or obtained through credential stuffing. If the account doesn't have multi-factor authentication, this leads directly to the ability to change NS records.
Registrar social engineering: attackers contact registrar support pretending to be the domain owner, claiming to have lost access to the account. Some registrars' identity verification processes have been weak enough to allow unauthorized account recovery. High-profile domain hijackings (Twitter's domain, multiple major cryptocurrency exchanges) have used this method.
DNS provider panel compromise: if NS records already point to a DNS hosting provider (Cloudflare, Route 53) and the provider account is compromised, the attacker can modify records within that provider — but cannot change the NS records themselves without registrar access. DNS provider compromise is a record-level attack; registrar compromise is an authority-level attack.
Registry locks: the defense against unauthorized NS changes
Domain registry locks add an extra layer of protection against unauthorized NS changes:
Registrar lock (clientTransferProhibited status): prevents the domain from being transferred to a different registrar. Standard practice; most actively-managed domains should have this. It doesn't prevent NS changes within the same registrar.
Registry lock (serverTransferProhibited / serverUpdateProhibited): a stronger lock applied at the registry level (not just the registrar). Changes require an out-of-band verification process — typically a phone call to a pre-registered contact, a hardware token, or a formal written request. Not available for all TLDs or through all registrars.
For high-value domains (company's primary domain, financial institution domains, major brand domains), registry locks are worth the slight operational inconvenience they add to making legitimate NS changes.
Glue records and the circular dependency
Glue records (covered in detail in the previous glue records article) are relevant to NS security because they create a different attack surface:
If your domain uses nameservers that are within your own domain (e.g., ns1.example.com and ns2.example.com for the domain example.com), glue records are required — these are A records stored at the parent registry (.com registry) that allow resolvers to find the nameservers' IP addresses without creating a circular resolution problem.
The glue record security concern: if an attacker changes the glue records at the parent registry (not the NS records, but the IP addresses the NS hostnames resolve to), they can redirect DNS resolution even without changing the NS record text itself. Glue record changes require registrar-level access — same access required for NS changes — but may be overlooked in security audits that focus only on NS record monitoring.
Detecting unauthorized NS changes
NS record monitoring is essential for high-value domains:
- Baseline the expected NS records: document what nameservers your domain should point to, and what the expected response looks like when queried
- Monitor for changes: DNS monitoring services (many available commercially) alert you when any DNS record for your domain changes — including NS records
- Registrar notifications: enable email/SMS notifications from your registrar for any account changes, especially NS updates
- DNSSEC: if your domain has DNSSEC enabled, unauthorized NS changes that aren't accompanied by the correct DS record at the parent registry will cause DNSSEC validation failures — creating alerts through DNSSEC-validating resolvers
How to use the NS Lookup on sadiqbd.com
- Verify your domain's expected nameservers: confirm the NS records shown match your DNS provider — any unexpected nameservers warrant immediate investigation at your registrar
- Check nameserver IP resolution: the NS lookup shows the nameserver hostnames; separately confirm they resolve to the expected IPs for your DNS provider (not IPs belonging to an unknown party)
- Compare parent registry vs authoritative answers: query both the root zone and your own nameservers — if they disagree on NS records, you may be in a propagation window or there may be a delegation inconsistency
Frequently Asked Questions
How quickly would I know if my nameservers were changed without authorization? It depends entirely on your monitoring. Without active monitoring, you might not know until customers report your website or email is down — which could be hours after the change, depending on cached TTLs. With registrar notifications enabled, you'd get an email at the time of the change. With active DNS monitoring services, you'd be alerted within minutes. For business-critical domains, passive discovery (waiting for users to report problems) is unacceptable — proactive NS record monitoring is the minimum security practice.
Is the NS Lookup free? Yes — completely free, no sign-up required.
Try the NS Lookup free at sadiqbd.com — find the authoritative nameservers for any domain instantly.
