Glossary
DE / EN

DNS & domain

What is Nameservers? Authoritative DNS servers of a domain explained

Nameservers answer all DNS queries about a domain. If they fail or are misconfigured, website and email become unreachable.

How Nameservers works

Which nameservers are responsible for a domain is recorded in two places: in the delegation at the registry (e.g. DENIC for .de) and in the NS records of the zone itself. Both should match.

There should be at least two nameservers, ideally in different networks, so that one failure does not take down the whole domain. All must answer authoritatively and serve the same version of the zone, recognisable by the same SOA serial number.

The SOA record also contains timers for synchronisation and caching (refresh, retry, expire, minimum). Implausible values lead to stale data or needlessly many queries.

Example

example.com.  NS   ns1.example-dns.net.
example.com.  NS   ns2.example-dns.org.
example.com.  SOA  ns1.example-dns.net. hostmaster.example.com. 2026102701 3600 900 1209600 3600

Two nameservers in different networks; the SOA serial is increased with every change.

Common mistakes

  • The delegation at the registry points to old nameservers (lame delegation) – for example after switching providers.
  • Nameservers serve different versions of the zone because synchronisation is stuck.
  • Only one nameserver, or both in the same network.

How the Domain Trust Check rates Nameservers

Criterion “DNS configuration” (weight 5 of 5): At least two authoritative nameservers, SOA serial in sync, registry delegation matching the zone, spread across networks, IPv6 and plausible SOA values.

Standard: RFC 1034, RFC 1035, RFC 2308

Related terms