Cybersecurity glossary
What is an NS Record?
Learn what an NS record is, how it delegates DNS authority to name servers, and why NS consistency and glue hygiene matter for reliable resolution.
Definition
An NS record is a DNS resource record that identifies which authoritative name servers are responsible for a zone or delegated portion of the namespace.
Why NS records are foundational
Every useful DNS answer depends on a chain of authority. Resolvers need to know not only the record they want, but also which servers are allowed to answer for the relevant zone. NS records provide that authority map.
They matter because DNS is distributed by design. No single server holds the whole namespace. Delegation lets different operators control different zones, and NS records are the signposts that keep resolvers moving toward the right source of truth.
What NS records communicate
An NS record does not contain web content, mail routes, or security policy by itself. Its job is simpler and more important: it names the servers that should be asked next.
Delegated authority
The record identifies which hostnames are authoritative for a zone such as example.com.
Zone-apex presence
A zone normally lists its own authoritative name servers at the apex in addition to any parent-side referral.
Redundancy by design
Most domains publish several NS records so resolution survives server or network failures.
Dependency on reachability
NS names still need usable addresses, which is where A, AAAA, and sometimes glue enter the picture.
How delegation works in practice
A resolver starts high in the hierarchy
It consults root and top-level domain infrastructure to discover who is authoritative for the target domain.
The parent provides NS referrals
For a delegated domain, the parent zone returns the hostnames of the child zone's authoritative servers.
Glue may accompany the referral
If the name servers are in-bailiwick, the parent may include address data so the resolver can reach them.
The resolver contacts an authoritative server
It chooses one of the listed servers and asks for the actual record type it needs.
The authoritative zone responds
The server returns the requested data if it is authoritative and healthy.
Caches remember the delegation
Recursive resolvers retain the NS and related information for later queries until TTLs expire.
Where NS records appear and what each place means
| Location | Purpose | Why operators care |
|---|---|---|
| Parent zone | Publishes delegation referrals for the child domain. | If these records are wrong, resolvers may never reach the intended authoritative infrastructure. |
| Child zone apex | States the zone's own authoritative name servers. | Consistency with the parent matters for clean, predictable resolution. |
| Registrar configuration | Often drives which parent-side NS records are published. | This is a control-plane surface with strong security implications. |
| Monitoring and incident response | Shows where traffic and trust are delegated. | Unexpected NS changes can indicate misconfiguration or account compromise. |
Good operational habits for NS management
- Keep at least two authoritative name servers available on resilient, independently reachable infrastructure.
- Verify parent-side delegation after registrar updates instead of assuming the intended change propagated correctly.
- Keep child-zone NS records aligned with the delegation information published by the parent.
- Review glue alongside NS changes so name-server hostnames remain reachable.
- Protect registrar and DNS-provider accounts with strong MFA because NS edits can redirect an entire domain.
- Monitor externally for unexpected NS changes, not just record-content changes inside the zone.
- Test failover by querying each authoritative server directly when possible.
- Treat nameserver migrations as high-risk changes with rollback steps and validation windows.
Why NS drift causes confusing outages
Many DNS incidents happen even when the target A, MX, or TXT records are perfectly correct. The failure sits one layer earlier: resolvers are asking the wrong authoritative servers, or some servers still have old zone data because delegation and hosting were updated out of sequence.
That is why NS records are not just administrative metadata. They define where trust in the zone begins.
The practical takeaway
An NS record tells resolvers which name servers are authoritative for a zone, making it the backbone of DNS delegation.
If you manage a domain, protect NS changes as carefully as you protect the zone contents. Wrong delegation sends every downstream query in the wrong direction.
Related security terms
Authoritative DNS Server
NS records name the authoritative servers that answer for the zone.
Glue Record
Glue may be needed so resolvers can actually reach the delegated name servers listed in NS records.
DNS Zone
NS records define which servers hold authority over a given zone.
Top-Level Domain (TLD)
TLD parent zones publish delegation NS records for second-level domains beneath them.
Domain Name System (DNS)
The global naming system relies on NS delegations to distribute authority.
Frequently asked questions
What is an NS record in simple terms?
It tells the Internet which name servers are authoritative for a domain or delegated zone.
Are NS records the same as A records?
No. NS records name the authoritative servers, while A records provide the IPv4 addresses for hostnames.
Where do NS records appear?
They appear at the zone apex inside the child zone and, for delegated domains, in the parent zone's referral data.
Why do domains usually list more than one NS record?
Multiple authoritative servers improve redundancy and availability if one server or network path fails.
Can wrong NS records break a domain?
Yes. Incorrect or inconsistent NS data can make a domain partially or fully unreachable, even when the zone contents themselves are correct.
What is the relationship between NS records and glue?
If the delegated name servers are inside the child zone, glue address records may be required at the parent so resolvers can reach them.
Do NS records affect security?
Absolutely. Anyone who can change NS delegation can redirect trust toward different authoritative infrastructure.
References
Explore authoritative guidance and frameworks related to ns record.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.