Until today I was used to believe it couldn't. From this page
The name field can be any of:
- A Fully Qualified Domain Name (FQDN) e.g. example.com. (ends with a dot)
- An unqualfied name (does not end with a dot)
- An '@' (substitutes the current value of $ORIGIN)
- a 'space' or 'blank' (tab) - this is replaced with the previous value of the name field.
Now, look at the following query
$ dig top-immotunisie.com NS ; <<>> DiG 9.6.0-APPLE-P2 <<>> top-immotunisie.com NS ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44156 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;top-immotunisie.com. IN NS ;; ANSWER SECTION: top-immotunisie.com. 36012 IN NS ns1.topnet.tn. top-immotunisie.com. 36012 IN NS 18.104.22.168. ;; Query time: 353 msec ;; SERVER: 22.214.171.124#53(126.96.36.199) ;; WHEN: Thu Jan 7 02:29:15 2010 ;; MSG SIZE rcvd: 91
How is it possible? Can a NS record point to an IP address?