Check a domain
How it works
Query NS records
These name the servers that hold the authoritative answers for the domain.
Identify the provider
The hostname pattern names the provider — Cloudflare, GoDaddy, Route 53 and so on.
Check redundancy
Two nameservers minimum. One is a single point of failure for both web and mail.
Look for splits
Nameservers from two different providers usually means a migration that was never finished.
The failure this catches
Nameservers are the layer below everything else. Your SPF record, your DKIM key and your DMARC policy only exist if the authoritative nameservers serve them. Edit those records in a control panel that is no longer authoritative and they will look perfect in the dashboard and be completely invisible to the internet.
This is a genuinely common failure during migrations. A domain is moved to Cloudflare, but the registrar's own DNS panel still works and still accepts edits. Someone adds a DKIM record there months later. It saves without error. Nothing ever resolves it. From the inside everything appears configured; from the outside DKIM simply does not exist.
Why it matters on a sending fleet
When you run a large sending fleet, DNS consistency is what makes them manageable. All domains on one provider means one API, one bulk-edit path, one place to audit. Once a fleet is split across three registrars' default DNS, every change becomes a manual job and every audit has gaps.
Consolidating nameservers is one of the highest-leverage cleanups available on a large fleet. It converts DNS from something you edit domain by domain into something you can script, which is the difference between a fleet you can maintain and one you can only react to.
Once nameservers are confirmed, the next thing to verify is what the mail side looks like — the MX and ESP checker covers that.
What a healthy nameserver setup looks like
| Finding | Reading | Action |
|---|---|---|
| Two or more NS, one provider | Normal and correct. | Nothing. |
| A single nameserver | No redundancy. If it is unreachable, the domain disappears — mail included. | Add at least a second. Every major provider issues two or more. |
| NS across two providers | Split DNS. Records edited in one place may never resolve. | Consolidate onto one, then re-verify every record. |
| Registrar default NS on a migrated domain | The migration never completed. | Point NS at the intended provider. |
| NS mismatched across a fleet | Manual DNS work forever, and audits with gaps. | Consolidate. This is the highest-leverage fleet cleanup there is. |
Why split DNS is so hard to spot
The reason this failure survives so long is that nothing errors. The registrar's DNS panel keeps accepting edits after the domain has been moved elsewhere. Records save cleanly, appear in the dashboard, and are never served to anyone, because that panel stopped being authoritative months ago.
Everything looks configured from the inside. The only way to catch it is to query from the outside — which is what this tool does, and why a DKIM record that "definitely exists" sometimes cannot be found by any checker.
Consolidating a fleet
On a large sending fleet, DNS consistency is the difference between infrastructure you can script and infrastructure you can only react to. One provider means one API, one bulk-edit path, one audit surface — you can push a DMARC change across 400 domains in a single run.
Once nameservers are consistent, verify what actually resolves: the domain checker shows NS, MX, SPF, DKIM and DMARC for a whole list side by side, which is the fastest way to confirm a migration is genuinely finished.
Frequently asked questions
How many nameservers should a domain have?
At least two, and they should be at the same provider unless you are deliberately running multi-provider DNS. Two gives you redundancy if one goes down. Most providers hand you two or four automatically.
My NS records show two different providers. Is that a problem?
Usually yes. Deliberate multi-provider DNS exists but is rare and requires keeping both zones in perfect sync. Far more often it is an unfinished migration, which means half your queries are answered by a zone that may be missing records. It is one of the harder faults to diagnose because the domain resolves fine most of the time.
Do nameservers affect email deliverability?
Not directly — no receiver judges you on your DNS host. Indirectly they matter enormously, because every authentication record depends on the correct nameservers serving it. A DNS problem presents as an authentication problem.
Should all my cold email domains use the same DNS provider?
It makes fleet management dramatically easier. One provider means one API for bulk record changes, one place to audit, and one script that can fix all of them. I run several hundred domains on Cloudflare for exactly this reason — the alternative is editing DNS by hand, domain by domain, forever.
How do I check which DNS provider a domain uses?
Paste the domain above, or query directly with dig +short NS example.com on macOS and Linux or nslookup -type=NS example.com on Windows. The nameserver hostnames identify the provider — ns1.cloudflare.com, ns-cloud-*.googledomains.com and so on. This tool names the provider for you.
How many nameservers should a domain have?
At least two, and every serious provider issues two or more by default. A single nameserver is a single point of failure — if it becomes unreachable the domain effectively disappears, taking mail delivery with it, since receivers can no longer resolve MX or authentication records.
My NS records show two different providers. Is that a problem?
Almost always, yes. Split DNS means only one set is genuinely authoritative, so records added in the other panel save without error and never resolve. It is a common leftover from an unfinished migration and one of the main reasons a DKIM record that visibly exists cannot be found by any external checker.
Do nameservers affect email deliverability?
Indirectly but completely. SPF, DKIM and DMARC only exist if the authoritative nameservers serve them, so pointing at the wrong provider makes every authentication record invisible regardless of how carefully it was written. Nameservers are the layer everything else depends on.
Should all my cold email domains use the same DNS provider?
Yes, if you run more than a handful. Consolidation turns DNS from per-domain manual work into something scriptable — one API, one bulk-edit path, one place to audit. On a fleet of hundreds it is the difference between pushing a DMARC change in one run and doing it by hand for a week.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.