All nameservers resolve to one address
What this check looks for
You have several nameserver names, but they all point at the same machine. It looks like redundancy in your control panel and provides none.
Why it matters
The reason to have two nameservers is that one can fail. Two names for one address fail together, for the same reason, at the same moment — and because the configuration looks correct, nobody discovers it until the day it matters.
When the check passes, your report says: “Nameservers are spread across more than one address”.
What it costs your score
When this check fails it removes 8 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.redundancy family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 8 points
- Family cap
- dns.health.redundancy · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Put at least one nameserver on a genuinely separate machine, or confirm the address is anycast.
Two names for one address is one point of failure with two labels.
Ask your DNS provider whether the address is anycast. If it is, no change is needed.
If it is not, add a secondary nameserver hosted elsewhere and give it its own address.
Update the NS set at the registrar and in the zone.
How to confirm it worked
dig +short NS ‹domain› | xargs -n1 dig +short A — expect more than one distinct address
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The ‹address count› distinct address(es) behind the published nameservers are: ‹address list›. Anycast is the legitimate exception: a single anycast address is served by many machines in many locations, and a managed DNS provider using one is genuinely redundant. Check with your provider before treating this as a fault — if the address is anycast, this finding can be dismissed.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone