All nameservers sit in one network block
Updated
What this check looks for
Your nameservers have different addresses but live in the same corner of the internet. A single routing problem or a single provider outage takes all of them out together.
Why it matters
Nameserver redundancy is about surviving the failure of a network, not just of a machine. Addresses inside one /24 are almost always announced as one route by one provider from one facility, so the thing that takes one down takes them all.
When the check passes, your report says: “Nameservers are spread across more than one network”.
What it costs your score
When this check fails it removes 5 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.redundancy family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 5 points
- Family cap
- dns.health.redundancy · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Host at least one nameserver on a different network, ideally a different provider.
One route withdrawal should not be able to remove every nameserver at once.
Add a secondary DNS provider — most managed hosts support acting as a secondary for a zone you keep elsewhere.
Publish its nameservers alongside your existing ones.
Confirm both sets serve the same zone with the same serial before relying on them.
How to confirm it worked
dig +short NS ‹domain› | xargs -n1 dig +short A — expect addresses in different networks
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The published nameservers resolve into ‹networks›, counting a /24 for IPv4 and a /48 for IPv6: ‹address list›. Those are the smallest units routinely announced as a single route, so addresses inside one share a fate. As with the single-address finding, an anycast provider is the exception and can be dismissed once confirmed.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.