NS Lookup

Changing nameservers transfers authority for your entire domain — website, email, subdomains, authentication records — to whoever controls the new nameservers. Here's how nameserver hijacking works (registrar account compromise, social engineering of registrar support), what registry locks actually protect against, the glue record attack surface that bypasses NS monitoring, and why proactive NS record monitoring is the minimum security practice for business-critical domains.

A domain can have multiple nameservers, all responding correctly, all passing every lookup test — and still go fully offline the moment one provider has a bad day, if all those "multiple" nameservers belong to the same provider's infrastructure. Here's the single-provider redundancy illusion, how genuine multi-provider DNS requires keeping zone data synchronized, and how Anycast architecture explains why most single-provider setups are, in practice, quite resilient anyway.

A nameserver named ns1.example.com creates a circular dependency — to find its IP, you'd normally ask example.com's nameservers, which it is one of. Glue records solve this by storing nameserver IPs directly in the parent zone. Here's how delegation chains work, when glue is required vs unnecessary, and why stale glue at the registrar causes confusing migration failures.

Registrar DNS is almost always the weakest option — slow global performance, poor TTL flexibility, and limited routing features. Here's how Cloudflare, Route 53, and Google Cloud DNS compare on performance, pricing, and features, and how to move DNS without moving your domain registration.

DNS propagation isn't magic — it's cache expiry. Understanding how TTL, authoritative nameservers, and recursive resolvers interact makes domain migrations predictable and the 48-hour wait mostly avoidable.