A nameserver you delegate to does not answer for the zone
What this check looks for
One of the nameservers listed for your domain does not serve it. Resolvers pick a nameserver at random, so a share of your visitors wait for a timeout before anything happens.
Why it matters
This is the classic invisible fault. Your own lookups succeed because your resolver learned long ago to avoid the broken server; a first-time visitor's resolver has not, and pays two to five seconds of delay before retrying — on every uncached lookup, for the site, the mail and the API alike.
When the check passes, your report says: “Every nameserver you delegate to answers for the zone”.
What it costs your score
When this check fails it removes 20 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.delegation family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- dns.health.delegation · 35
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Either make the listed nameserver serve the zone, or remove it from the delegation.
Every resolver that picks the broken server pays a timeout before it tries another.
Confirm whether this nameserver is supposed to serve the zone at all — most often it is a leftover.
If it is not, remove it from the NS record set at your registrar and from the zone's own NS records.
If it is, check on the server itself that the zone is loaded and that UDP and TCP port 53 are reachable from the internet.
Wait for the parent's NS TTL to expire before re-testing; resolvers cache the delegation.
How to confirm it worked
dig +norecurse @‹nameserver› NS ‹domain› — expect an answer with the aa flag set
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
These delegated nameservers failed to answer authoritatively for the zone: ‹server list›. Each was asked for the zone's own NS record with recursion disabled; an answer without the AA bit, a REFUSED, a SERVFAIL or no reply at all makes the server lame (RFC 1912 §2.8). The usual causes are a nameserver removed from the provider without being removed at the registrar, a zone deleted on one server of a pair, or a firewall change on UDP/53.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone