All nameservers sit in one network block
What this check looks for
Your nameservers have different addresses but live in the same corner of the internet. A single routing problem or a single provider outage takes all of them out together.
Why it matters
Nameserver redundancy is about surviving the failure of a network, not just of a machine. Addresses inside one /24 are almost always announced as one route by one provider from one facility, so the thing that takes one down takes them all.
When the check passes, your report says: “Nameservers are spread across more than one network”.
What it costs your score
When this check fails it removes 5 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.redundancy family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 5 points
- Family cap
- dns.health.redundancy · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Host at least one nameserver on a different network, ideally a different provider.
One route withdrawal should not be able to remove every nameserver at once.
Add a secondary DNS provider — most managed hosts support acting as a secondary for a zone you keep elsewhere.
Publish its nameservers alongside your existing ones.
Confirm both sets serve the same zone with the same serial before relying on them.
How to confirm it worked
dig +short NS ‹domain› | xargs -n1 dig +short A — expect addresses in different networks
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The published nameservers resolve into ‹network count› network block(s), counting a /24 for IPv4 and a /48 for IPv6: ‹address list›. Those are the smallest units routinely announced as a single route, so addresses inside one share a fate. As with the single-address finding, an anycast provider is the exception and can be dismissed once confirmed.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone