Nameservers
At least two nameservers
ns.count
Two or more means one server can fail without taking the domain off the air.
What this check measures
Two nameservers is the long-standing minimum, and most registries enforce it at registration. With one, any maintenance window, reboot, network fault or address change is a total outage of everything the domain does — web, mail, and every API that resolves a name under it.
The count on its own is the weaker half of the question. Two nameservers in the same rack, on the same subnet, behind the same router, fail together — so the number satisfies the check while providing very little of what the check is for. Independence of network path matters more than the total.
Beyond about four there is little to gain. Resolvers pick among them by observed latency and rarely exhaust the list, so additional servers mostly add surface to keep synchronised.
How to fix it
Run at least two, and place them on different networks — ideally different providers, and different physical locations. Anycast from a managed provider gives most of this without operating anything.
A secondary from a different DNS provider is a good way to survive a provider-wide failure, which is the outage a single provider's redundancy cannot help with. It does require both to serve the same zone, so it is a commitment to keeping replication working.
Make sure every server you list is actually authoritative and answering. A delegation naming four servers of which two are lame is worse than one naming two that work — resolvers still try them, and every attempt is latency somebody is waiting through.
References
Run this check on a domain
At least two nameservers is one of 56 checks in every report, alongside delegation, mail authentication, TLS and registration.
Also in Nameservers
- Every nameserver is authoritative
- Nameservers are independent of each other
- Nameserver hostnames are valid
- IPv6 reachability
- Nameservers are not open resolvers
- Nameservers agree on the SOA serial
- Nameservers agree on the NS set
- Nameservers respond over TCP
- Nameservers respond over UDP
- Zone transfers are not open to the world