What Is a Nameserver? How DNS Authority Actually Works

A nameserver is a DNS server that holds the authoritative records for a domain. When you register a domain, you tell the registry which nameservers are responsible for it, and from that point on, every DNS query for your domain ultimately reaches those nameservers to get an answer. Understanding how this chain works saves you from confusion when DNS changes don't behave as expected.

The DNS Hierarchy

DNS is a distributed hierarchy. At the top are the root nameservers (13 logical clusters operated by organisations like ICANN, Verisign, and NASA). Below them are TLD nameservers for each top-level domain (.com, .co.uk, .org, etc.). Below those are your domain's authoritative nameservers, the ones you control.

When you set nameservers at your registrar, the registrar updates the TLD zone to point to your nameservers. This creates the delegation that allows the DNS resolution chain to find your records.

How a DNS Lookup Works Step by Step

When someone types your domain into a browser, the following chain of queries happens behind the scenes, typically in under 100 milliseconds:

1. Local cache check: the browser and operating system check their local DNS cache. If the answer is cached and hasn't expired, it's used immediately with no further lookups.
2. Recursive resolver: if not cached, the query goes to a recursive resolver, usually your ISP's, or a public one like Google's 8.8.8.8 or Cloudflare's 1.1.1.1. The resolver does the heavy lifting of the full lookup process.
3. Root nameservers: the resolver asks a root nameserver: "who handles .com?" It receives a referral to the .com TLD nameservers.
4. TLD nameservers: the resolver asks the .com TLD nameserver: "who handles yourdomain.com?" It receives the NS records pointing to your domain's authoritative nameservers.
5. Authoritative nameserver: the resolver asks your nameserver: "what's the A record for yourdomain.com?" Your nameserver replies with the IP address. The resolver caches this response for the record's TTL duration and returns it to the browser.

This entire process is heavily cached at every stage. Most lookups for popular domains never reach the authoritative nameserver because the answer is already cached somewhere in the chain.

NS Records vs Nameservers: What's the Difference?

These terms are related but not interchangeable. A nameserver is the actual DNS server, a machine (or cluster) that answers DNS queries and holds the zone file for your domain. NS records are DNS entries that point to those servers.

When you set nameservers at your registrar, the registrar writes NS records into the parent TLD zone. Your authoritative nameservers also publish their own NS records for your domain within your zone file. The two sets should match, and the definitive delegation lives in the parent zone, not in your own zone.

You can verify which nameservers the TLD zone thinks are authoritative for your domain with:

dig yourdomain.com NS +short

Primary and Secondary Nameservers

Every domain requires at least two nameservers: a primary (NS1) and secondary (NS2). Both hold identical copies of the zone data and answer queries independently. If one nameserver is unreachable, the resolver simply tries the other. This redundancy is a requirement of the DNS protocol, a domain with only one nameserver has a single point of failure that can make the entire domain unresolvable.

HostBible operates two geographically separated nameservers:

Where You Change Nameservers

You change nameservers at your domain registrar, not at your hosting provider. The registrar is who registered the domain, and only they have authority to update the delegation record in the parent TLD zone. Your host can tell you which nameservers to use, but cannot make the change on your behalf.

This is a common source of confusion: people contact their hosting provider asking them to update nameservers, but the hosting provider has no access to the registrar's system. You must log in to wherever you bought the domain and make the change there.

Glue Records

There's a circular dependency when a domain's nameservers are subdomains of itself. For example, if yourdomain.com uses nameservers ns1.yourdomain.com and ns2.yourdomain.com, the resolver needs to know the IP of ns1.yourdomain.com before it can look up yourdomain.com, but it can't look that up without already knowing the nameserver. This circular dependency is resolved with glue records: IP addresses for the nameservers published directly in the parent TLD zone alongside the NS delegation. You register glue records at your registrar when setting up custom nameservers under your own domain.

Custom (Vanity) Nameservers

Resellers and white-label hosting providers often configure custom nameservers under their own domain, for example, NS1.YOURAGENCY.COM. These are called vanity nameservers or branded nameservers. They work exactly like any other nameserver; the custom hostname is cosmetic. The DNS infrastructure behind them is provided by the underlying host.

Setting up vanity nameservers requires registering the nameserver hostnames as child nameservers at your registrar with glue records (the IPs of the actual DNS servers), then pointing clients' domains to your branded nameserver hostnames.

How Long After Changing Nameservers Until It Works?

After changing nameservers at your registrar, the TLD zone is typically updated within minutes. But resolvers around the world have cached the old NS delegation records and will continue using the old nameservers until those cached records expire, typically within 1 to 4 hours, occasionally up to 24 hours for resolvers with long caches.

To check what nameservers a specific resolver is currently using for your domain:

dig @8.8.8.8 yourdomain.com NS +short