A nameserver name has no address
What this check looks for
One of the nameservers listed for your domain is a name that does not resolve to anything. Nothing can ask it a question, so it contributes nothing but delay.
Why it matters
A resolver that picks this nameserver has to resolve its name first, fail, and start again. It is a lame delegation with an extra round trip attached, and it counts towards a redundancy total that is not actually there.
When the check passes, your report says: “Every nameserver name resolves to an address”.
What it costs your score
When this check fails it removes 15 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.delegation family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 15 points
- Family cap
- dns.health.delegation · 35
- Category
- DNS
- Module
- Dns health
- Fix owned by
- registrar
- In the ruleset since
- 2026.09
How to fix it
Correct the nameserver name, publish its address, or remove it from the delegation.
A nameserver nothing can find is a delay in the path of every uncached lookup.
Check the name for a typo against what your DNS provider gives you.
If the nameserver is inside this domain, make sure the registrar holds a glue record with its address.
If the nameserver no longer exists, remove it from the NS set at the registrar and in the zone.
How to confirm it worked
dig +short A ‹nameserver› — expect an address for every published nameserver
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹server list›. RFC 1912 §2.8 requires every NS target to be a hostname with an address record. The commonest causes are a nameserver name whose own zone was deleted, a typo in the delegation at the registrar, or a nameserver inside the delegated zone that has no glue record at the parent — in which case the name cannot be resolved at all without already knowing the answer.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone