A nameserver name is an alias rather than a host
What this check looks for
One of your nameservers is listed under a name that redirects to another name. The DNS forbids this, and some resolvers refuse to follow it, so those visitors cannot resolve your domain at all.
Why it matters
Resolver behaviour here is genuinely inconsistent: some follow the alias, some treat the delegation as broken. That produces the worst kind of fault — one that works from your desk and fails for a fraction of your users with no pattern you can reproduce.
When the check passes, your report says: “Every nameserver is a real host name, not an alias”.
What it costs your score
When this check fails it removes 12 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.delegation family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 12 points
- Family cap
- dns.health.delegation · 35
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Point the NS record at a name that has its own A/AAAA records.
Some resolvers refuse to follow an aliased nameserver and treat the delegation as broken.
Resolve the alias to find the real hostname behind it.
Use that hostname in the NS record set, at the registrar and in the zone.
Alternatively, replace the alias with A and AAAA records at the same name.
How to confirm it worked
dig +short CNAME ‹nameserver› — expect no answer
{{recordName}}. 3600 IN A {{ipv4}}A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
These NS targets are aliases: ‹server list›. RFC 2181 §10.3 states that the NS record's target must be the canonical name of a host with address records, never a CNAME. The same rule applies to MX targets and for the same reason: the resolver is following a delegation, not resolving a name for a user, and is not required to chase an alias.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone