When you buy a domain, three roles are involved. The registrar sells and renews it. The registry (Verisign for .com, for example) runs the TLD. The DNS host answers queries about your records. Nameservers connect them: they’re the servers the world asks for your domain’s records. Changing nameservers moves your entire DNS to another provider, which is powerful and easy to get wrong.

What nameservers do

Your domain’s NS records at the registry say “ask these servers about example.com”:

dig +short example.com NS
# ns1.dns-provider.com.
# ns2.dns-provider.com.

Those authoritative nameservers hold your zone: A, AAAA, MX, TXT, CNAME and the rest. Resolvers worldwide follow the delegation from the root, to the .com servers, to your nameservers.

dig example.com +trace       # shows each step of the delegation

Registrar vs DNS host

They can be the same company or different ones:

Setup Example
Registrar’s own DNS Domain at a registrar, records edited in its panel
External DNS provider Domain at a registrar, nameservers set to Cloudflare, and records edited at Cloudflare
Self-hosted DNS Nameservers point to your own servers running BIND or PowerDNS

Where you edit records is wherever the nameservers point. A common confusion is editing records at the registrar while the nameservers point to Cloudflare. Those edits do nothing.

Changing nameservers safely

Moving DNS to a new provider, such as Cloudflare:

  1. Copy every record to the new provider first: A, AAAA, CNAME, MX, TXT (SPF, DKIM, DMARC, verifications), SRV, CAA. Many providers can scan or import existing records, but verify the import, since DKIM records and less common types are often missed. Export the old zone if possible.
  2. Compare the answers of the old and new nameservers for important names:
for n in example.com www.example.com; do
  echo "$n old: $(dig +short $n A @ns1.old-provider.com)  new: $(dig +short $n A @ns1.new-provider.com)"
done
dig +short example.com MX @ns1.new-provider.com
dig +short example.com TXT @ns1.new-provider.com
  1. Change the nameservers at the registrar.
  2. Wait. NS changes are cached at the TLD level, typically for up to 24–48 hours. During that time, some resolvers use the old provider and some the new one, which is why both must serve identical records. See DNS propagation.
  3. Keep the old zone active for a few days before deleting it.

DNSSEC: if the domain uses DNSSEC, disable it, or transfer the keys properly, before changing nameservers. A DS record at the registry that doesn’t match the new provider’s signatures makes the domain fail to resolve for validating resolvers. Then re-enable DNSSEC with the new provider’s DS record.

Custom (“vanity”) nameservers and glue records

Want ns1.example.com as a nameserver name? If the nameserver’s hostname is inside the domain it serves, resolvers face a chicken-and-egg problem. Glue records at the registry solve it by publishing the nameserver IPs alongside the delegation. You register them at your registrar (“child nameservers” / “host records”):

ns1.example.com → 203.0.113.53
ns2.example.com → 198.51.100.53

Running your own authoritative DNS means operating at least two servers on different networks, ideally different locations, since DNS outages take everything down. See DNS server configuration on Linux and PowerDNS.

For most sites, a managed DNS provider is more reliable than self-hosting authoritative DNS.

Choosing a DNS provider

Look for:

  • Anycast nameservers worldwide (fast answers everywhere). See anycast explained.
  • An API, for automation, ACME DNS challenges and dynamic updates.
  • DNSSEC support.
  • Good uptime history, plus MFA and access controls on the account.

Troubleshooting

Symptom Check
Changes in the panel don’t apply Do the nameservers point to this provider? dig +short example.com NS
Site works for some, not others During an NS change, both providers need identical records
Email stopped after the move MX/SPF/DKIM records missing at the new provider
SERVFAIL everywhere DNSSEC mismatch (DS record), or nameservers not answering for the zone
Registrar says “invalid nameserver” Glue needed for in-domain nameservers, or a typo 
dig example.com NS +trace
dig @ns1.new-provider.com example.com SOA

Quick reference

Task Command
Current nameservers dig +short example.com NS
Delegation path dig example.com +trace
Ask a specific nameserver dig @ns1.provider.com example.com A
Before switching Copy all records, compare answers, handle DNSSEC

Related: DNS records explained and A record vs CNAME.

  • DNS
  • Domains
  • Networking