NS Lookup
Find out who runs a domain's DNS. See its name servers and their addresses, the SOA settings, whether DNSSEC is on, and whether a name-server change has reached Cloudflare and Google yet.
NS Lookup
How this lookup works. When you press Find name servers, your browser sends the question over encrypted DNS-over-HTTPS to Cloudflare's public resolver (1.1.1.1), or to Google Public DNS (8.8.8.8) if you choose it below. The request goes straight from your device to them. It doesn't pass through ToolFeather: we have no server in the path, so we never see or store the names you look up. Requests are sent without cookies or a referrer. Each resolver has its own privacy policy: Cloudflare · Google.
Results appear here.
Queries your browser sent (0)
These are the exact requests, each one a link. Open one to see the raw JSON answer from the resolver.
Live lookup: your browser asks Cloudflare or Google DNS directly. Nothing passes through ToolFeather.
Scratchpad auto-saved
How it works — in four simple steps
No signup and nothing to install — it all runs in your browser.
Enter a domain
Use the registered domain, e.g. example.com.
Look it up
NS, SOA and DS records are fetched together.
Check the servers
Each server's IPs and provider.
Review the checks
Redundancy, consistency, SOA timers and DNSSEC.
Turning on DNSSEC? Sign the zone at your DNS host first, then add the DS record at the registrar, never the other way round.
Features
DNS host detection
Names the provider behind the name servers: Cloudflare, Route 53, Azure, Google Cloud, GoDaddy and more.
Redundancy checks
At least two servers, every one resolving, spread across networks.
Delegation consistency
Compares Cloudflare's and Google's view to catch a name-server change in progress.
SOA explained
Every SOA field in plain English, with date-style serials decoded and timer sanity checks.
DNSSEC status
Shows whether the parent publishes a DS record and whether the resolver validated the zone.
About the NS Lookup
The NS records of a domain list its authoritative name servers, the machines that hold the master copy of its DNS. The registry for the top-level domain (.com, .org, .uk…) publishes them so resolvers know where to ask. The provider is usually obvious from the names: *.ns.cloudflare.com is Cloudflare, *.awsdns-* is Amazon Route 53, *.domaincontrol.com is GoDaddy. The tool recognises about 40 providers.
RFC 1034 and RFC 2182 require at least two name servers, ideally on separate networks, so one outage can't take the domain offline. The tool resolves each server, checks they're spread over different /24 networks, and asks the second resolver for the NS set too. If they differ, a delegation change is probably still going through. The parent zone's NS TTL is often one or two days.
The SOA record holds the zone's housekeeping: the primary server, the admin email (the first dot stands for @), the serial number that secondary servers watch for changes, and the refresh, retry and expire timers. Its last field is the negative-caching TTL, which sets how long resolvers remember that a name doesn't exist (RFC 2308). DNSSEC is on when the parent publishes a DS record that links to the zone's signing keys.