Engineering

NS Record Lookup API: Query Nameserver Delegation in JSON

Query nameserver records programmatically, compare live DNS delegation with WHOIS nameservers, and detect unexpected DNS provider changes before they become incidents.

September 2, 202611 min readEngineering · DNS · Nameservers · Delegation

Introduction

Nameserver records define who controls a domain’s DNS zone. When NS delegation changes — during a migration, after a registrar update, or through an unauthorized hijack — every downstream record (A, MX, TXT, CNAME) can change with it.

An NS record lookup API turns delegation into structured JSON you can baseline, compare and alert on. WhoisJSON exposes NS records through the DNS Lookup API /nslookup endpoint. The NS array lists the authoritative nameservers currently published in DNS — distinct from the nameserver field in a WHOIS response, which reflects registrar-side registration data.

This article focuses on NS lookup and WHOIS/DNS reconciliation. For continuous change alerts, see nameserver monitoring. For hijack response playbooks, see domain hijacking detection.

What Is an NS Record Lookup API?

An NS record lookup API accepts a domain name, queries its DNS delegation, and returns the authoritative nameserver hostnames as JSON. Your application can identify the DNS provider, verify a migration completed, or flag domains whose live NS set no longer matches registrar records.

Endpoint used in this guide: GET /api/v1/nslookup?domain=example.com. Read the NS array from the response. The same call also returns A, MX, TXT, SOA and other record types when present.

For the full record-type reference, see the DNS Lookup API guide. This is the NS-focused workflow — the last major record type in the DNS lookup series alongside A, MX and SOA guides.

How NS Records Define DNS Delegation

NS records at the parent zone (for example the .com registry) point resolvers to the nameservers that hold the domain’s zone file. Those nameservers then answer queries for A, MX, TXT and other records.

Example delegationDNS
example.com. 86400 IN NS ns1.example-dns.com.
example.com. 86400 IN NS ns2.example-dns.com.

A healthy domain usually publishes at least two NS records for redundancy. A single NS record is a configuration risk — if that host fails, the entire zone can become unresolvable.

SourceFieldWhat it reflects
Live DNS (/nslookup)NSNameservers currently published and reachable via DNS recursion
WHOIS/RDAP (/whois)nameserverNameservers registered at the registrar — should match live NS after propagation
Live DNS (/nslookup)SOA.nsnamePrimary nameserver named in the zone’s SOA record — often one of the NS hosts

NS Lookup vs Nameserver Monitoring

These workflows complement each other but answer different questions.

WorkflowQuestionWhen to use
NS record lookup (this guide)What nameservers are published right now?Migrations, audits, one-off reconciliation, CI gates
Nameserver monitoringDid delegation change since yesterday?Production portfolios, hijack detection, drift alerts
Propagation delays are normal. After updating NS at the registrar, live DNS and WHOIS nameservers can disagree for hours. Compare timestamps and retry before treating a mismatch as an incident.

Query NS Records in JSON

Pass the apex domain in the domain parameter and authenticate with Authorization: TOKEN=YOUR_API_KEY.

RequestcURL
curl "https://whoisjson.com/api/v1/nslookup?domain=example.com" \
  -H "Authorization: TOKEN=YOUR_API_KEY"

The documented NS response is an array of hostnames. Normalize trailing dots and case before comparing sets.

Response shapeJSON
{
  "NS": [
    "ns1.example-dns.com",
    "ns2.example-dns.com"
  ],
  "SOA": {
    "nsname": "ns1.example-dns.com",
    "hostmaster": "hostmaster.example-dns.com",
    "serial": 2026090201,
    "refresh": 10000,
    "retry": 2400,
    "expire": 604800,
    "minttl": 3600
  }
}

Reconcile Live NS with WHOIS Nameservers

Registrar-side hijacks and incomplete migrations often appear as a mismatch between WHOIS nameservers and live NS records. Query both endpoints and compare normalized sets.

Reconciliation conceptLogic
live_ns    = normalize(nslookup.NS)
whois_ns   = normalize(whois.nameserver)
if live_ns != whois_ns:
    flag delegation_mismatch

Pair this check with EPP status and registrar fields from registrar lookup and redacted WHOIS workflows — contacts may be hidden, but nameserver lists usually remain visible.

How to Interpret NS Lookup Results

Expected provider NS

Hostnames match your approved DNS vendor (Cloudflare, Route 53, Azure DNS, etc.). Baseline and monitor for drift.

WHOIS vs live mismatch

Propagation in progress, stale registrar data, or unauthorized delegation change. Retry after TTL; escalate if persistent.

Single NS only

Resilience risk. Most production domains should publish at least two authoritative nameservers.

Unknown / parking NS

May indicate expired, parked or freshly registered domains. Combine with WHOIS age and expiry context.

SOA serial increments on zone changes — useful when NS looks stable but zone content may have changed. See the SOA record guide for serial interpretation.

Python Example: Compare NS and WHOIS

Normalize nameserver hostnames, compare live DNS with WHOIS registration data, and return a compact audit object.

ns_lookup.pyPython
import requests

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://whoisjson.com/api/v1"
HEADERS = {"Authorization": f"TOKEN={API_KEY}"}


def norm_ns(values):
    return sorted({
        str(v).rstrip(".").lower()
        for v in (values or [])
        if v
    })


def audit_ns(domain: str, approved_ns: list[str] | None = None) -> dict:
    dns = requests.get(
        f"{BASE_URL}/nslookup",
        headers=HEADERS,
        params={"domain": domain},
        timeout=15,
    )
    dns.raise_for_status()
    whois = requests.get(
        f"{BASE_URL}/whois",
        headers=HEADERS,
        params={"domain": domain},
        timeout=15,
    )
    whois.raise_for_status()

    dns_data = dns.json()
    whois_data = whois.json()
    live_ns = norm_ns(dns_data.get("NS"))
    reg_ns = norm_ns(whois_data.get("nameserver"))
    approved = norm_ns(approved_ns) if approved_ns else None

    findings = []
    if not live_ns:
        findings.append("no_live_ns_records")
    if live_ns and reg_ns and live_ns != reg_ns:
        findings.append("whois_live_ns_mismatch")
    if approved and live_ns and live_ns != approved:
        findings.append("live_ns_not_approved")
    if len(live_ns) == 1:
        findings.append("single_ns_only")

    return {
        "domain": domain,
        "liveNs": live_ns,
        "whoisNs": reg_ns,
        "soaPrimary": (dns_data.get("SOA") or {}).get("nsname"),
        "findings": findings,
        "ok": not findings,
    }


print(audit_ns("example.com", ["ns1.example-dns.com", "ns2.example-dns.com"]))

Node.js Example: Verify DNS Provider

ns-lookup.jsNode.js
const API_KEY = "YOUR_API_KEY";
const BASE_URL = "https://whoisjson.com/api/v1";
const headers = { Authorization: `TOKEN=${API_KEY}` };

const normNs = (values = []) =>
  [...new Set(values.filter(Boolean).map((v) => String(v).replace(/\.$/, "").toLowerCase()))].sort();

async function getJson(path, domain) {
  const url = new URL(`${BASE_URL}/${path}`);
  url.searchParams.set("domain", domain);
  const res = await fetch(url, { headers });
  if (!res.ok) throw new Error(`${path} failed: ${res.status}`);
  return res.json();
}

async function auditNs(domain, approvedNs = []) {
  const [dns, whois] = await Promise.all([
    getJson("nslookup", domain),
    getJson("whois", domain),
  ]);

  const liveNs = normNs(dns.NS);
  const whoisNs = normNs(whois.nameserver);
  const approved = normNs(approvedNs);
  const findings = [];

  if (!liveNs.length) findings.push("no_live_ns_records");
  if (liveNs.length && whoisNs.length && JSON.stringify(liveNs) !== JSON.stringify(whoisNs)) {
    findings.push("whois_live_ns_mismatch");
  }
  if (approved.length && JSON.stringify(liveNs) !== JSON.stringify(approved)) {
    findings.push("live_ns_not_approved");
  }
  if (liveNs.length === 1) findings.push("single_ns_only");

  return {
    domain,
    liveNs,
    whoisNs,
    soaPrimary: dns.SOA?.nsname ?? null,
    findings,
    ok: findings.length === 0,
  };
}

auditNs("example.com", ["ns1.example-dns.com", "ns2.example-dns.com"])
  .then(console.log)
  .catch(console.error);

Common NS Lookup API Use Cases

  • DNS provider migration: confirm live NS matches the new vendor before closing the change ticket.
  • M&A and vendor diligence: record who controls DNS delegation for critical domains.
  • Hijack triage: detect registrar-side NS changes that have not yet propagated — or live NS swaps without matching WHOIS updates.
  • Portfolio baselines: store approved NS sets per brand domain and flag drift during weekly audits.
  • CI/CD gates: fail deploys when production apex NS no longer matches the expected provider — extend domain health checks with NS validation.

What an NS Lookup Cannot Prove

It does not query each nameserver directly. The API returns delegation as seen through normal DNS resolution, not per-NS health probes.
It does not prove zone file integrity. NS can be correct while individual A or MX records inside the zone are wrong.
Mismatch is not always malicious. Registrar updates, TTL caching and partial migrations create temporary WHOIS/live differences.
Subdomain NS is a different query. Query the apex for delegation; query delegated subdomains separately when they use separate NS sets.

FAQ

What is an NS record lookup API?

It queries the authoritative nameserver records for a domain and returns the delegation hostnames as structured JSON.

Which WhoisJSON endpoint returns NS records?

Use GET /api/v1/nslookup with the domain query parameter. Read the NS array from the JSON response.

What is the difference between NS records and WHOIS nameservers?

NS records are live DNS delegation. WHOIS nameservers are registrar-side registration data. They should match after propagation; differences can indicate migration or unauthorized changes.

How many NS records should a domain have?

Most production domains publish at least two NS records for redundancy. A single nameserver is a resilience risk.

Can I check NS and SOA in one request?

Yes. The /nslookup response includes both the NS array and the SOA object in the same JSON payload.

Conclusion

NS record lookup is delegation intelligence: who controls the zone, whether live DNS matches registrar records, and whether the published set matches your approved baseline. Query /nslookup for live NS, compare with /whois nameservers, and layer continuous monitoring for changes between audits.

Query NS records with WhoisJSON

Retrieve nameserver delegation, SOA context, and full DNS records in one JSON response.

Explore DNS APIView Documentation
NS Record Lookup

Query Nameserver Delegation in One API Call

Compare live NS records with WHOIS nameservers, detect provider drift, and audit delegation across your domain portfolio.

Live NS arrayWHOIS reconciliationPython and Node.js1,000 free requests/month