Glossary

Authoritative Nameserver

The definitive source of DNS records for a domain

An authoritative nameserver is a DNS server that holds the official, definitive DNS records for a specific domain or zone, responding to queries with authoritative answers rather than cached data from other servers.

What is an Authoritative Nameserver?

An authoritative nameserver is the final source of truth for DNS records within a specific zone. When a recursive resolver needs to resolve a domain name, it ultimately queries the authoritative nameserver for that domain. Unlike recursive resolvers, which cache data from other servers, authoritative nameservers respond with definitive answers based on their locally stored zone file.

Every domain on the internet must have at least two authoritative nameservers for redundancy. These are specified in the domain's NS records, which are published both in the domain's own zone and in the parent TLD zone as a delegation. The parent zone's delegation is what allows the global DNS hierarchy to find the right authoritative server when resolving a domain.

Authoritative nameservers are operated by DNS hosting providers, registrars, cloud platforms, and organisations that manage their own DNS infrastructure. When you update a DNS record — adding an A record, changing an MX record, or creating a TXT record for SPF — you are making that change on the authoritative nameserver for your domain.

Primary vs Secondary Authoritative Nameservers

A DNS zone typically has one primary (master) nameserver and one or more secondary (slave) nameservers. The primary nameserver is where zone data is authored and changed. Secondary nameservers obtain their zone data by performing zone transfers (AXFR or IXFR) from the primary and serve as read-only replicas. Both primary and secondary nameservers respond to DNS queries with authoritative answers.

From a querying resolver's perspective, primary and secondary nameservers are functionally equivalent — both respond with the "AA" (Authoritative Answer) bit set in the DNS response. Having multiple geographically distributed nameservers improves redundancy and reduces resolution latency for users in different regions.

Many modern DNS hosting providers use a more complex architecture involving anycast routing, where the same IP address is announced from multiple points of presence worldwide, eliminating the traditional primary/secondary distinction.

How to Look Up Nameservers

You can find the authoritative nameservers for any domain using the NS Lookup tool at nslookup.net/tools/ns-lookup. Enter a domain name and the tool will query the NS records from the TLD zone and from the domain's own authoritative servers, showing the full delegation chain.

Checking nameservers is a useful first step when troubleshooting DNS issues, verifying a domain transfer, or confirming that new nameservers have been delegated correctly after a provider change.

Related Tool

NS Lookup

Try the Tool →

Frequently Asked Questions

How do I find out who hosts a domain's DNS?

The authoritative nameservers for a domain are published in its NS records. Querying the NS records for a domain reveals the nameserver hostnames, which often indicate the DNS hosting provider — for example, ns1.cloudflare.com suggests Cloudflare DNS, while ns-1234.awsdns-12.com suggests Amazon Route 53. You can look up NS records using the NS Lookup tool at nslookup.net.

What is a zone transfer?

A zone transfer is the mechanism by which a secondary nameserver requests and receives a copy of an entire DNS zone from the primary nameserver. Full zone transfers use the AXFR query type; incremental transfers that send only changes since the last transfer use IXFR. Zone transfers should be restricted to authorised secondary servers only, as they expose all DNS records for a domain.

How long does it take to change nameservers?

After updating nameservers at your domain registrar, the change is submitted to the TLD registry, which updates the delegation in the parent zone. This typically takes anywhere from minutes to several hours. Once the new NS records are in the TLD zone, the old nameserver's TTL (commonly 24 to 48 hours) must expire before all resolvers worldwide switch to querying the new nameservers.

Can I use more than two authoritative nameservers?

Yes. While two nameservers are the minimum for redundancy, domains can have more. Using three or four nameservers distributed across different providers or geographic regions provides greater fault tolerance. Major DNS providers typically operate large networks of nameservers under a small number of NS hostnames using anycast routing.