How to Check Whether a Domain's DNS Is a Single Point of Failure

To check a domain's name server diversity, read its NS records, resolve each server, and count how many providers and networks they sit on. The bulk nameserver diversity checker does this for up to 100 domains a run, 500 after a free Google sign-in. Each row shows the servers, the provider domains, the number of separate IPv4 /24 networks and whether any server has IPv6. Nothing is sent to the name servers.

Why diversity matters

If a domain's DNS stops answering, its website, its email and everything else that depends on its records stop with it. Spreading name servers over separate networks, and ideally separate providers, means one outage does not reach all of them. RFC 2182 advises placing secondary servers on different networks and in different places for this reason. For email the stakes are specific: if senders cannot look up your MX, SPF or DKIM records, mail bounces or fails authentication.

Doing it by hand

dig +short NS example.com
dig +short A ns1.example.net
dig +short AAAA ns1.example.net

List the name servers, then resolve each. Look at the first three numbers of each IPv4 address: servers sharing them are in the same /24. Look at the domain part of each server name to see the provider. Repeat per domain.

Step 1: paste the domains

Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in.

Step 2: run the check

Each domain's NS records are read, then the A and AAAA records of every name server, 10 domains a request.

Step 3: read each row

Result	What it means
Several providers	Servers sit under more than one provider domain
One provider	Two or more servers under one provider's domain. Common, and not an error
Single point of failure	Fewer than two servers, fewer than two that resolve, or all IPv4 in one /24 with no IPv6
No NS records	Nothing at the name. Check you pasted the zone's apex domain
Lookup failed	DNS did not answer properly

Reading the result sensibly

The provider is inferred from the name server's own domain, so a provider that uses several domains looks more varied than it is, and one that uses a single domain behind a global anycast network looks less varied than it is. Large managed DNS providers run many sites per name, and that resilience is not visible from addresses. Treat the result as a prompt to look, not a score.

To see who hosts each domain's DNS in the first place, use the bulk nameserver lookup and read finding the DNS host for a list of domains. To check the servers agree with each other, use the bulk NS consistency checker. For wider monitoring, see monitoring sending domains for SPF, DKIM and DMARC.

What this check cannot do

• It reads DNS records only. It does not test whether any server answers.
• The provider is inferred from the name server's domain.
• Anycast resilience behind one address is not visible.
• The limit is 100 domains a run without an account and 500 signed in.

Check the addresses you send to

Correct DNS gets mail to the door; the address still has to exist. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Check your domains now

Paste them into the bulk nameserver diversity checker.