Introduction
Nameserver records define who controls a domain’s DNS zone. When NS delegation changes — during a migration, after a registrar update, or through an unauthorized hijack — every downstream record (A, MX, TXT, CNAME) can change with it.
An NS record lookup API turns delegation into structured JSON you can baseline, compare and alert on. WhoisJSON exposes NS records through the DNS Lookup API /nslookup endpoint. The NS array lists the authoritative nameservers currently published in DNS — distinct from the nameserver field in a WHOIS response, which reflects registrar-side registration data.
This article focuses on NS lookup and WHOIS/DNS reconciliation. For continuous change alerts, see nameserver monitoring. For hijack response playbooks, see domain hijacking detection.
What Is an NS Record Lookup API?
An NS record lookup API accepts a domain name, queries its DNS delegation, and returns the authoritative nameserver hostnames as JSON. Your application can identify the DNS provider, verify a migration completed, or flag domains whose live NS set no longer matches registrar records.
GET /api/v1/nslookup?domain=example.com. Read the NS array from the response. The same call also returns A, MX, TXT, SOA and other record types when present.For the full record-type reference, see the DNS Lookup API guide. This is the NS-focused workflow — the last major record type in the DNS lookup series alongside A, MX and SOA guides.
How NS Records Define DNS Delegation
NS records at the parent zone (for example the .com registry) point resolvers to the nameservers that hold the domain’s zone file. Those nameservers then answer queries for A, MX, TXT and other records.
example.com. 86400 IN NS ns1.example-dns.com.
example.com. 86400 IN NS ns2.example-dns.com.A healthy domain usually publishes at least two NS records for redundancy. A single NS record is a configuration risk — if that host fails, the entire zone can become unresolvable.
| Source | Field | What it reflects |
|---|---|---|
Live DNS (/nslookup) | NS | Nameservers currently published and reachable via DNS recursion |
WHOIS/RDAP (/whois) | nameserver | Nameservers registered at the registrar — should match live NS after propagation |
Live DNS (/nslookup) | SOA.nsname | Primary nameserver named in the zone’s SOA record — often one of the NS hosts |
NS Lookup vs Nameserver Monitoring
These workflows complement each other but answer different questions.
| Workflow | Question | When to use |
|---|---|---|
| NS record lookup (this guide) | What nameservers are published right now? | Migrations, audits, one-off reconciliation, CI gates |
| Nameserver monitoring | Did delegation change since yesterday? | Production portfolios, hijack detection, drift alerts |
Query NS Records in JSON
Pass the apex domain in the domain parameter and authenticate with Authorization: TOKEN=YOUR_API_KEY.
curl "https://whoisjson.com/api/v1/nslookup?domain=example.com" \
-H "Authorization: TOKEN=YOUR_API_KEY"The documented NS response is an array of hostnames. Normalize trailing dots and case before comparing sets.
{
"NS": [
"ns1.example-dns.com",
"ns2.example-dns.com"
],
"SOA": {
"nsname": "ns1.example-dns.com",
"hostmaster": "hostmaster.example-dns.com",
"serial": 2026090201,
"refresh": 10000,
"retry": 2400,
"expire": 604800,
"minttl": 3600
}
}
Reconcile Live NS with WHOIS Nameservers
Registrar-side hijacks and incomplete migrations often appear as a mismatch between WHOIS nameservers and live NS records. Query both endpoints and compare normalized sets.
live_ns = normalize(nslookup.NS)
whois_ns = normalize(whois.nameserver)
if live_ns != whois_ns:
flag delegation_mismatchPair this check with EPP status and registrar fields from registrar lookup and redacted WHOIS workflows — contacts may be hidden, but nameserver lists usually remain visible.
How to Interpret NS Lookup Results
Expected provider NS
Hostnames match your approved DNS vendor (Cloudflare, Route 53, Azure DNS, etc.). Baseline and monitor for drift.
WHOIS vs live mismatch
Propagation in progress, stale registrar data, or unauthorized delegation change. Retry after TTL; escalate if persistent.
Single NS only
Resilience risk. Most production domains should publish at least two authoritative nameservers.
Unknown / parking NS
May indicate expired, parked or freshly registered domains. Combine with WHOIS age and expiry context.
SOA serial increments on zone changes — useful when NS looks stable but zone content may have changed. See the SOA record guide for serial interpretation.
Python Example: Compare NS and WHOIS
Normalize nameserver hostnames, compare live DNS with WHOIS registration data, and return a compact audit object.
import requests
API_KEY = "YOUR_API_KEY"
BASE_URL = "https://whoisjson.com/api/v1"
HEADERS = {"Authorization": f"TOKEN={API_KEY}"}
def norm_ns(values):
return sorted({
str(v).rstrip(".").lower()
for v in (values or [])
if v
})
def audit_ns(domain: str, approved_ns: list[str] | None = None) -> dict:
dns = requests.get(
f"{BASE_URL}/nslookup",
headers=HEADERS,
params={"domain": domain},
timeout=15,
)
dns.raise_for_status()
whois = requests.get(
f"{BASE_URL}/whois",
headers=HEADERS,
params={"domain": domain},
timeout=15,
)
whois.raise_for_status()
dns_data = dns.json()
whois_data = whois.json()
live_ns = norm_ns(dns_data.get("NS"))
reg_ns = norm_ns(whois_data.get("nameserver"))
approved = norm_ns(approved_ns) if approved_ns else None
findings = []
if not live_ns:
findings.append("no_live_ns_records")
if live_ns and reg_ns and live_ns != reg_ns:
findings.append("whois_live_ns_mismatch")
if approved and live_ns and live_ns != approved:
findings.append("live_ns_not_approved")
if len(live_ns) == 1:
findings.append("single_ns_only")
return {
"domain": domain,
"liveNs": live_ns,
"whoisNs": reg_ns,
"soaPrimary": (dns_data.get("SOA") or {}).get("nsname"),
"findings": findings,
"ok": not findings,
}
print(audit_ns("example.com", ["ns1.example-dns.com", "ns2.example-dns.com"]))
Node.js Example: Verify DNS Provider
const API_KEY = "YOUR_API_KEY";
const BASE_URL = "https://whoisjson.com/api/v1";
const headers = { Authorization: `TOKEN=${API_KEY}` };
const normNs = (values = []) =>
[...new Set(values.filter(Boolean).map((v) => String(v).replace(/\.$/, "").toLowerCase()))].sort();
async function getJson(path, domain) {
const url = new URL(`${BASE_URL}/${path}`);
url.searchParams.set("domain", domain);
const res = await fetch(url, { headers });
if (!res.ok) throw new Error(`${path} failed: ${res.status}`);
return res.json();
}
async function auditNs(domain, approvedNs = []) {
const [dns, whois] = await Promise.all([
getJson("nslookup", domain),
getJson("whois", domain),
]);
const liveNs = normNs(dns.NS);
const whoisNs = normNs(whois.nameserver);
const approved = normNs(approvedNs);
const findings = [];
if (!liveNs.length) findings.push("no_live_ns_records");
if (liveNs.length && whoisNs.length && JSON.stringify(liveNs) !== JSON.stringify(whoisNs)) {
findings.push("whois_live_ns_mismatch");
}
if (approved.length && JSON.stringify(liveNs) !== JSON.stringify(approved)) {
findings.push("live_ns_not_approved");
}
if (liveNs.length === 1) findings.push("single_ns_only");
return {
domain,
liveNs,
whoisNs,
soaPrimary: dns.SOA?.nsname ?? null,
findings,
ok: findings.length === 0,
};
}
auditNs("example.com", ["ns1.example-dns.com", "ns2.example-dns.com"])
.then(console.log)
.catch(console.error);
Common NS Lookup API Use Cases
- DNS provider migration: confirm live NS matches the new vendor before closing the change ticket.
- M&A and vendor diligence: record who controls DNS delegation for critical domains.
- Hijack triage: detect registrar-side NS changes that have not yet propagated — or live NS swaps without matching WHOIS updates.
- Portfolio baselines: store approved NS sets per brand domain and flag drift during weekly audits.
- CI/CD gates: fail deploys when production apex NS no longer matches the expected provider — extend domain health checks with NS validation.
What an NS Lookup Cannot Prove
FAQ
What is an NS record lookup API?
It queries the authoritative nameserver records for a domain and returns the delegation hostnames as structured JSON.
Which WhoisJSON endpoint returns NS records?
Use GET /api/v1/nslookup with the domain query parameter. Read the NS array from the JSON response.
What is the difference between NS records and WHOIS nameservers?
NS records are live DNS delegation. WHOIS nameservers are registrar-side registration data. They should match after propagation; differences can indicate migration or unauthorized changes.
How many NS records should a domain have?
Most production domains publish at least two NS records for redundancy. A single nameserver is a resilience risk.
Can I check NS and SOA in one request?
Yes. The /nslookup response includes both the NS array and the SOA object in the same JSON payload.
Conclusion
NS record lookup is delegation intelligence: who controls the zone, whether live DNS matches registrar records, and whether the published set matches your approved baseline. Query /nslookup for live NS, compare with /whois nameservers, and layer continuous monitoring for changes between audits.
Query NS records with WhoisJSON
Retrieve nameserver delegation, SOA context, and full DNS records in one JSON response.
Explore DNS APIView Documentation