DNS NS Record (Name Server Record)
Detailed technical specification, security configuration analysis, threat modeling, and defensive whitelists.
Asset Risk Analysis Context
DNS records govern critical mapping parameters. Stale or misconfigured records are swept continuously by external threat monitors and passive asset enumerators.
Scan Your DNS Zone NowWhat is a DNS NS Record?
The Name Server (NS) record delegates a DNS zone to use a specific authoritative name server. NS records determine which servers host the master DNS records for a domain. If a resolver queries a domain, the NS records dictate where the query is routed next.
How Delegation of Authority Operates
When you register a domain, the top-level domain (TLD) registry points your NS records to your DNS provider. The provider's servers then act as the source of truth for your A, MX, CNAME, and other resource records.
Security Threats to NS Authority
NS records represent the keys to your domain's routing control:
- DNS Registrar Hijacking: If an attacker compromises your registrar account, they can replace your NS records with their own. This immediately redirects all traffic and mail to the attacker's infrastructure.
- Lame Delegations: If a domain points its NS records to name servers that are no longer active, resolving queries will fail or, worse, attackers can register the inactive name server IP and hijack DNS resolution.
- AXFR Zone Transfer Exposure: Misconfigured name servers allow anonymous zone transfers (AXFR), permitting anyone to download your entire DNS directory.
Defenses for NS Records
- Implement Registrar Lock: Enable two-factor authentication and registrar lock controls (serverTransferProhibited) to prevent unauthorized NS modifications.
- Audit Name Server Health: Check for lame delegations and ensure all listed name servers are active and responsive.
- Disable Unencrypted AXFR Queries: Configure your authoritative servers to block unauthorized DNS zone transfer requests.
Frequently Asked Questions
What is an NS record?
A DNS record that delegates a DNS zone to use a designated authoritative name server.
How many NS records should a domain have?
A domain should have at least two NS records pointing to separate physical servers for redundancy.
What is a lame delegation?
A configuration error where a domain's NS records point to a server that does not host the domain's DNS zone files.
Can I use different DNS providers simultaneously?
Yes, by adding NS records from both providers, but keeping them synchronized is complex and prone to errors.
How do NS records impact site availability?
If all listed name servers go offline or are misdirected, your entire website, API, and email delivery will fail immediately.