12

Let's say I own the domain name example.com. It is registered at registrar R. In my account at R, I registered the following name servers for the .TLD registry:

  • ns1.example.com --> 192.0.2.1
  • ns2.example.com --> 192.0.2.2

Let's say there are no domains using these name servers for DNS yet. How can verify outside of my R account, that the name servers have been registered successfully at the .TLD registry?

For example, VeriSign Inc's WHOIS page allows you to look up a registered .COM name server:

Server Name: NS1.HOSTGATOR.COM
IP Address: 67.18.54.2
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com

Is there a standard approach for looking up this information for any TLD registry?


To clarify, I am not looking to verify the name servers a domain is set to use, e.g.:

Domain Name: HOSTGATOR.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com

Name Server: NS1.P13.DYNECT.NET
Name Server: NS2.P13.DYNECT.NET
Name Server: NS3.P13.DYNECT.NET
Name Server: NS4.P13.DYNECT.NET

Status: clientTransferProhibited
Updated Date: 05-jan-2013
Creation Date: 22-oct-2002
Expiration Date: 22-oct-2015

Instead, I am looking for a way to query a single registered name server (e.g. ns1.example.tld) against the registry, to find the IP address the registry has recorded for this name server (e.g. 123.456.789.001).


Update:

I have contacted VeriSign for input, and it turns out that VeriSign's WHOIS lookup for name servers is proprietary. Here is their response:

In regard to your question whether you would be able to obtain any information regarding a nameserver which is registered at the registry but not currently associated with any domain, you will unfortunately not be able to obtain this information via alternative routes e.g. by performing a DiG. Nameservers are only published to the zone if they are attached to a domain, hence you won't be able to obtain this information unless said nameserver is associated with a domain. Also, a DiG may provide you with a listing of nameservers associated with a domain and their respective IP's, etc.

-- Benjamin, VeriSign, Inc. Customer Service

The second part of @Iian's answer below is correct. The name server must be associated with a domain in order to lookup the IP address the registry has on record for that name server.

1
  • 2
    1. WHOIS doesn't technically relate to your name servers or DNS resolution for your domain. WHOIS information can be and often is incorrect. DNS servers don't query WHOIS to find your name servers, they query the gTLD servers that are authoritative for that gTLD. WHOIS is an information directory. 2. It's not a TLD, it's a gTLD. 3. If you want to know what name servers the gTLD servers "have on record" for a particular domain you can query one or more (or all) of the gTLD servers directly to find the name servers for any domain that the particular gTLD server(s) is authoritative for.
    – joeqwerty
    Jan 18, 2013 at 3:55

5 Answers 5

11

You can us dig and choose a public DNS server

dig 8.8.8.8 NS example.com

This will get you the names of the name servers then you can just look them up e.g.

dig +short ns1.example.tld 
123.456.789.001

or if you're using windows you can use nslookup

nslookup
> server 8.8.8.8
> set type=ns
> example.com 

Then similar to above

nslookup ns1.example.tld

will provide you with the ip address


If you want to query the tld directly then

dig ns tld

will provide a list of the TLDs name servers, you can then query them directly for the ns records for example.tld

dig @ns666.tld ns example.tld
6
  • 1
    Can you explain why I would be querying a third-party DNS server to lookup information at the registry level?
    – iglvzx
    Jan 17, 2013 at 6:57
  • 1
    @iglvzx: It demonstrates that the registry has the information and is publishing it correctly ?
    – user9517
    Jan 17, 2013 at 7:06
  • This returns the list of name servers a domain is set to use at the registry. I am looking for a way to query a single registered name server against the registry, to find the IP address the registry has on file. (See my update)
    – iglvzx
    Jan 17, 2013 at 18:06
  • @iglvzx: Once you know the name of the nameservers you just query the DNS for their IP address or am I missing something ?
    – user9517
    Jan 17, 2013 at 19:57
  • I am asking about the IP address that is "registered" at the registry through your registrar. The .COM registry provides a WHOIS lookup that returns this IP address when given just the name server. Even if the name server is not being used by any domains, this information is on file somewhere at the registry. I have emailed VeriSign for their input. If I get a response, I'll update my question. :)
    – iglvzx
    Jan 18, 2013 at 1:18
3

Normally you can use Whois to query nameservers:

$ whois -h whois.verisign-grs.com "nameserver =ns3.serverfault.com"

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

   Server Name: NS3.SERVERFAULT.COM
   IP Address: 69.59.196.217
   Registrar: NAME.COM LLC
   Whois Server: whois.name.com
   Referral URL: http://www.name.com

>>> Last update of whois database: Fri, 18 Jan 2013 08:57:23 UTC <<<

The implementation of this feature is up to the TLD. .GOV, for example, does not return nameserver queries:

$ whois -h whois.nic.gov "nameserver =a.gov-servers.net" 
% DOTGOV WHOIS Server ready
No match for nameserver "A.GOV-SERVERS.NET".

>>> Last update of whois database: 2013-01-18T08:59:27Z <<<

There is not really a reliable way (i.e. a method available on all TLDs) to check if a host has been registered at a registry via public DNS or Whois services. You can't query glue records directly, and you only see them if you query a domain using the nameservers you're looking for. Since you're interested in nameservers not associated with any domain, this is not an option.

The whois approach is your best bet, but cannot be relied upon. A registry might have a nameserver registered but not bother putting it in Whois if there are no associated domains. The only 100% reliable ways to verify a nameserver's existence in the registry are to query the registry via an EPP CHECK command. Since those are only available to registrars, it doesn't help you much.

Let's say there are no domains using these name servers for DNS yet. How can verify outside of my R account, that the name servers have been registered successfully at the .TLD registry?

Of course, if you have no domains associated with a nameserver, does it really matter? The only guaranteed way you can check is to register a domain in the TLD using your nameserver, query the domain, and check the glue you get back from `dig @tldnameservers yourdomain ns.

1
  • I'm pretty sure this is the only correct answer to this question. Thanks. May 18, 2014 at 10:11
2

Use nslookup or dig to query a gTLD server for your name servers. You could also use the following web site to trace the DNS delegation for your domain:

http://www.simpledns.com/lookup-dg.aspx

0

For all new gTLDs, ICANN mandates all registries to have their whois reply on nameserver queries to check if a given nameserver (either by name or IP) is registered at the registry. It is far from being super useful, but it does exist.

0

First, query the the root name servers:

dig ns .

Then, query one of the root name servers for the name servers of the TLD (for example .net):

dig @m.root-servers.net. ns net.

(Or you can skip the first step and just query dig ns net.

Now, query one of these name servers for a domain name with the name servers you want:

dig @m.gtld-servers.net. ns speedy.net.

If the TLD of the domain is the same as the TLD of the name servers (it doesn't have to be the same domain), and the name servers are registered at the TLD level, you will receive the IP addresses of the name servers:

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> @m.gtld-servers.net. ns speedy.net.
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39877
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 9
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;speedy.net.                    IN      NS

;; AUTHORITY SECTION:
speedy.net.             172800  IN      NS      ns1.speedy.net.
speedy.net.             172800  IN      NS      ns2.speedy.net.
speedy.net.             172800  IN      NS      ns3.speedy.net.
speedy.net.             172800  IN      NS      ns4.speedy.net.

;; ADDITIONAL SECTION:
ns1.speedy.net.         172800  IN      A       205.251.197.253
ns1.speedy.net.         172800  IN      AAAA    2600:9000:5305:fd00::1
ns2.speedy.net.         172800  IN      A       205.251.192.194
ns2.speedy.net.         172800  IN      AAAA    2600:9000:5300:c200::1
ns3.speedy.net.         172800  IN      A       205.251.199.10
ns3.speedy.net.         172800  IN      AAAA    2600:9000:5307:a00::1
ns4.speedy.net.         172800  IN      A       205.251.194.116
ns4.speedy.net.         172800  IN      AAAA    2600:9000:5302:7400::1

;; Query time: 2 msec
;; SERVER: 192.55.83.30#53(192.55.83.30)
;; WHEN: Thu Jun 18 04:42:20 UTC 2020
;; MSG SIZE  rcvd: 287

Otherwise, if the TLD is different or the name servers are not registered, you will receive the name servers names without the IP addresses:

dig @m.gtld-servers.net. ns speedymatch.com.

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> @m.gtld-servers.net. ns speedymatch.com.
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10930
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;speedymatch.com.               IN      NS

;; AUTHORITY SECTION:
speedymatch.com.        172800  IN      NS      ns1.speedy.net.
speedymatch.com.        172800  IN      NS      ns2.speedy.net.
speedymatch.com.        172800  IN      NS      ns3.speedy.net.
speedymatch.com.        172800  IN      NS      ns4.speedy.net.

;; Query time: 2 msec
;; SERVER: 192.55.83.30#53(192.55.83.30)
;; WHEN: Thu Jun 18 04:45:02 UTC 2020
;; MSG SIZE  rcvd: 126

Repeat these queries for any TLD you want to check name servers for. You don't have to query each of the TLD name servers, one is enough. But if you want you can query all of them.

For testing this you will need a domain in the same TLD as the domain of the name servers. If you don't have such a domain for testing, you can first add the new name servers as additional name servers in addition to the old name servers, then check if it works, and only then remove the old name servers of your domain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .