Fix Nameserver Mismatch Between Registrar and DNS Host

What's happening

DNS delegation works in two layers: the parent zone (e.g..com TLD) holds NS records pointing to your authoritative nameservers, and your DNS provider hosts the actual zone. Both sides must agree on the same set of nameservers — a delegation in the parent that does not match the provider's actual nameservers means queries either fail or land on a stale, unrelated zone.

A nameserver mismatch typically arises after a DNS migration where the registrar's NS delegation was not updated, or where a manual NS record was added to the zone that conflicts with the parent delegation. RFC 1034 and RFC 2181 define how delegations and zone-internal NS records should be consistent.

Receivers and resolvers may see different responses depending on which nameserver they happen to query, producing intermittent failures: SPF and DKIM TXT records resolve from one provider but not the other, MX records differ, and a small fraction of mail bounces with unexplained 5xx errors. dnsviz.net flags the mismatch as "NS records inconsistent".

Why it matters

Intermittent DNS resolution failures. Some users see the new zone (correct records); others see the old zone (stale records or NXDOMAIN). The split is geographic and resolver-dependent — your laptop might work, your customer's might not.

Mail authentication fails on a percentage of mail. SPF returns TempError when one nameserver answers and another times out. DMARC aggregate reports show elevated temperror rates that correlate with specific receiver-side resolvers.

Website availability suffers. Cloudflare resolver and Google Public DNS may answer from different glue. Some users see your real site; others see NXDOMAIN or an old A record. Bug reports are inconsistent and hard to reproduce.

Common causes

• DNS migration to a new provider — registrar NS not updated.
• DNS provider migration — old provider still answers but parent NS still points there.
• Manual NS record added inside the zone that conflicts with parent delegation.
• Glue records at the registrar pointing to old IPs after DNS provider IP changes.
• Vanity nameservers (ns1.example.com) where A records do not match the provider's actual servers.

Detect this on your site

Run a quick scan with the DNS Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Compare parent delegation to zone NS

   Run dig +trace example.com NS. The output walks from the root through the TLD to your zone. The TLD's NS list ("non-authoritative") and the zone's NS list ("authoritative") must match exactly. Any difference is the bug.

2. 2

   List the actual nameservers your DNS provider uses

   Open your DNS provider's dashboard. Cloudflare DNS: domain overview shows the assigned nameservers (e.g. amber.ns.cloudflare.com, jed.ns.cloudflare.com). Route 53: Hosted Zone shows the four-name NS set. Note the exact hostnames.

3. 3

   Update NS at the registrar

   Log into your registrar (Cloudflare Registrar, Namecheap, Google Domains, GoDaddy). Find the nameserver settings and update them to match the DNS provider's list exactly. Remove any old or extra nameservers. Save changes.

4. 4

   Wait for parent-zone propagation

   TLD NS updates typically propagate in 1-24 hours. Run dig +trace example.com NS periodically and confirm the TLD authority section now lists the correct nameservers. Use multiple resolvers (1.1.1.1, 8.8.8.8) to verify.

5. 5

   Remove conflicting in-zone NS records

   If your zone contains NS records at the apex pointing to old nameservers, edit the zone in your DNS provider and remove them. The provider typically auto-publishes the correct NS at the apex; you only need to clean up manual leftovers.

6. 6

   Verify with dnsviz

   Visit dnsviz.net/d/example.com and confirm no "NS inconsistency" errors. Run a Mail-Tester probe and confirm DNS-related warnings are gone. DMARC aggregate reports should show temperror rates dropping over the next week.

Example

# Walk delegation from root to authoritative
dig +trace example.com NS

# Compare TLD NS records to zone NS records
dig @a.gtld-servers.net example.com NS  # parent (TLD)
dig @ns1.example.com example.com NS     # zone authoritative
# Both must list identical nameservers

Trace and compare commands for diagnosing NS delegation mismatch.

Related fixes