Nameservers are independent of each other

Two nameservers only give you redundancy if they can fail separately. This check takes every nameserver address that answered and compares them three ways: at the address level, where two nameservers on one IP is a failure; at the subnet level, by IPv4 /24; and at the network level, by the autonomous system originating the route.

Two or more nameservers answering on the same address is the case that fails, because it is zero redundancy: one machine counted twice. When that address stops answering, every route into the zone stops at once, and the delegation has advertised N servers while providing one.

A shared /24 means one subnet, one router, one rack, often one power feed. A shared AS means one network operator: a routing fault, a BGP mistake or a provider-wide outage takes every one of them at once. Neither is exotic — both are the normal shape of a single managed DNS provider, which is why they are reported as information rather than scored. The score measures redundancy that actually exists; concentration at the network level is a trade-off, not a fault.

The trade-off is genuine and worth stating plainly. One good provider gives you anycast, competent operations and a single place to make changes, and most domains are correctly served by exactly that. What it cannot give you is survival of that provider's own bad day, and the large managed providers have each had multi-hour ones. During an outage there is nothing you can change quickly enough, because the control plane you would change it through is behind the outage.

Nameserver hostnames sharing a TLD is a third kind of correlation, and it is deliberately not warned on. Registry-level outages are far rarer than network ones, and nearly every domain has all its nameservers under a single TLD, so warning on it would drown the two signals that matter.

If two nameservers resolve to the same address, fix that first — the delegation is counting one server twice. Give each nameserver its own address, ideally on a different network.

If one provider is the accepted answer, make sure it is one that anycasts from multiple sites and says so. Two names in a single provider's domain usually resolve to genuinely separate anycast clouds; this check still sees one AS, and that is the AS of a network engineered not to fail as a unit.

If you want real independence, run two providers, both listed in the delegation. Resolvers use whichever answers, so an outage at one costs nothing. The usual objection is keeping the zones identical, and that is a solved problem: octoDNS keeps the records in version control and pushes them to every provider you configure, and Terraform with a provider block per service works the same way. Classic primary/secondary transfer over AXFR is the lower-effort version where both providers support it.

Know one consequence before committing. DNSSEC across two independent providers is harder than DNSSEC on one: either a single provider signs and the other serves the signed zone as a secondary, or you run the multi-signer model in RFC 8901. Neither is exotic, neither is a checkbox, and afterwards is a bad time to find out.