Nameserver Mismatch: Registrar vs Zone NS Records

A delegated domain's nameservers are listed in two places: in the parent zone (what you set at your registrar) and in the NS records of your own zone (what your DNS provider publishes). When the two lists differ, or when listed servers misbehave, problems range from invisible to a full outage. This guide covers how to read the symptoms and fix them.

Why there are two lists

A resolver finds your zone through the parent: the .com servers, for example, refer it to the nameservers your registrar submitted. Once the resolver reaches one of those servers, it receives your zone's own NS records too, and many resolvers prefer that list for later queries because it is authoritative. If you're new to this, how DNS delegation works walks through the process.

Ideally both lists name exactly the same servers.

The common mismatch patterns

Old provider's servers still at the parent

You moved DNS to a new provider and created the zone there, but didn't update the nameservers at your registrar. Resolvers still go to the old provider. Your changes at the new provider have no effect—a very common cause of "I updated the record but nothing changed".

Fix: update the nameservers at your registrar to the new provider's servers.

Old provider's NS records copied into the new zone

You imported the zone file into the new provider, including the old NS records. The parent points to the new servers, but the zone claims the old ones are authoritative. Resolvers that follow the zone's own list may wander back to the old provider.

Fix: replace the apex NS records in the zone with the new provider's servers. Most providers manage these for you, so remove any imported extras.

One extra or missing server

The lists overlap but differ by one server—often a decommissioned secondary, or a new one only added in one place. A server listed only at the parent still gets queries; a server listed only in the zone may be used by some resolvers and not others.

Fix: decide which servers should be authoritative and make both lists match.

Lame servers

A listed nameserver that responds but doesn't serve the zone is lame. Typical responses are REFUSED, SERVFAIL, or an answer without the authoritative flag. Each resolver that picks it wastes time before trying another server, so users see slow or intermittent failures.

A server that doesn't respond at all is different: it may be down, overloaded or filtered. A single timeout during a check isn't conclusive, so check again before acting.

A nameserver hostname that doesn't exist (its own lookup returns NXDOMAIN) is more dangerous. If that hostname's domain is expired, someone else could register it and start answering for your domain. Remove such entries promptly.

Glue problems

If your nameservers are named inside your own domain (ns1.example.com for example.com), the parent must publish their IP addresses as glue. Two things go wrong:

• Missing glue: resolvers cannot reach the server at all.
• Stale glue: the server moved to a new IP, the zone was updated, but the glue at the registrar still holds the old address.

Glue is managed at your registrar, usually under "host records" or "child nameservers".

SOA serial differences

The SOA serial increases whenever the zone changes. If your nameservers report different serials, some are serving an older version. That's normal for a minute or two after an edit while secondaries catch up. If it persists, zone transfers between your primary and secondaries are failing. (Some providers that don't use zone transfers keep independent serials per server, and differences there are expected.)

A step-by-step check

1. Read the parent delegation. Ask a parent server directly: dig @a.gtld-servers.net example.com NS +norecurse (use your TLD's servers).
2. Query each listed server directly for your SOA and NS records with +norecurse. Check for the aa flag and matching serials.
3. Compare the zone's NS records with the parent list.
4. Check glue if your nameservers are inside your domain.
5. Check the registry status if the parent returns NXDOMAIN: a hold or expiry removes the delegation entirely.

The Registrar & Nameserver Check runs every one of these steps, shows each server's response side by side, and lists the exact queries so you can repeat them.