The domain has fewer than two nameservers
What this check looks for
Everything about this domain depends on a single machine. If it stops answering, the website, the email and every service on the domain disappear at once.
Why it matters
With one nameserver there is no failover, no maintenance window and no way to survive a network problem at one provider. It is also the one outage nobody can work around: the records still exist, but nothing can find them.
When the check passes, your report says: “Two or more nameservers serve the domain”.
What it costs your score
When this check fails it removes 12 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.redundancy family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 12 points
- Family cap
- dns.health.redundancy · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- registrar
- In the ruleset since
- 2026.09
How to fix it
Add at least one more nameserver, ideally on a different network and provider.
One nameserver means one failure takes the whole domain off the internet.
Most managed DNS hosts assign several nameservers automatically — check whether you have simply not listed them all at your registrar.
If you run your own, add a secondary that transfers the zone from the primary.
Publish the full set both at the registrar (the delegation) and in the zone's own NS records.
Confirm the parent and the zone agree once the change has propagated.
How to confirm it worked
dig +short NS ‹domain› — expect two or more nameservers
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹nameserver count› nameserver(s) are published for ‹domain›: ‹server list›. RFC 1034 §4.1 and RFC 1912 §2.8 both call for at least two, and every registry checks for it before accepting a delegation. Two names on the same machine or in the same rack is not redundancy either — see the address and network diversity findings alongside this one.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone