Nameserver

A resolver with no cached answer starts at the root servers, which direct it to the servers for the top-level domain, which direct it to the nameservers listed for your domain. That last step is the delegation.

The delegation lives in the parent zone, maintained by the registry and updated through your registrar. It is not something your own nameservers can change.

Your zone also contains NS records naming the same servers. Those are authoritative once a resolver is already talking to you, and they should match the delegation exactly.

When the two lists differ, different resolvers reach different servers depending on what they had cached, and the domain behaves inconsistently in ways that are very hard to reproduce.

Registries require at least two nameservers for a delegation, on the assumption that one will eventually be unavailable.

A resolver that fails to reach one tries another, so a single server outage is invisible as long as the others answer with the same data.

Servers on the same network, in the same data centre, or with the same provider share failure modes. Two names do not guarantee two independent systems, and checking that they resolve to genuinely different networks is worth doing once.

Many managed DNS providers use anycast, where one address is announced from many locations. That provides both redundancy and proximity without additional names.

All authoritative servers for a zone are supposed to serve identical data. Zone transfers or a provider's internal replication keep them synchronised.

When one lags — a transfer that failed, a manual edit on one server — clients receive different answers depending on which server they happened to reach, intermittently.

This is among the hardest DNS faults to diagnose, because the symptom is that something works for most people and fails for some, with no pattern the reporter can describe.

Querying each nameserver individually and comparing the answers is the direct test, and it takes a minute.

`dig example.com NS +short` returns the nameservers the zone itself declares.

`dig example.com NS @a.gtld-servers.net` — or the appropriate parent server — returns the delegation as the registry holds it. The two lists should be identical.

Query each server directly, `dig @ns1.example.net example.com A`, and compare. Differences mean replication has failed somewhere.

After changing nameservers at a registrar, expect the parent zone's own TTL to govern the transition; it is typically measured in hours and is not something you control.