Nameserver history

Nameserver hostnames

The patterns in the next section identify familiar public hostnames. Vanity nameservers and other regional or product-specific variants may not match. Nameservers do not identify the web host: a domain can use Cloudflare DNS while its website and mail are hosted elsewhere.

Providers this site recognises

A provider is named only when the whole hostname matches one of these patterns; *. stands for zero or more host labels. A hostname such as google.com.example.net does not match. Case and a final dot do not change a match. Other hostnames stay unclassified. The dates shown with a provider are when the source first recorded each value, not when a service started or stopped.

Parking services hold a domain that is not in use or is for sale. A registrar moves a domain to the verification hold nameservers while its owner has not confirmed their contact details. Hostinger’s dns-parking.com nameservers are its standard DNS hosting, not parking, and so are Above.com’s dns1.abovedomains.com and dns2.abovedomains.com.

Possible reasons for a nameserver change

A new nameserver provider may indicate a DNS-hosting move. Some domains use two providers at once through multi-provider DNS. Several nameservers from one provider usually provide redundancy.

The first-recorded dates do not show when an old delegation disappeared. An unfamiliar nameserver alone is not evidence of a hijack; compare current DNS, registrar audit logs and the operator’s incident report.

Amazon Route 53: new nameservers within the same provider

Amazon Route 53 assigns four nameservers to a public hosted zone. Its documentation says that recreating a deleted zone gives it another set of four; typically none of the new names match the previous set.

If a history shows different awsdns hostnames, check whether both sets belong to Route 53 before describing a provider change. A recreated zone can explain different names while DNS hosting stays with AWS. Those names alone cannot establish whether the zone was recreated or the domain changed owner.

Compare the historical names with the current parent delegation and the names assigned to the active hosted zone. Querying one former nameserver only tests that server; it does not establish which servers the parent delegates to today.

See AWS instructions for replacing a hosted zone. The guide to recorded dates explains why the first observation of a new set is not a confirmed switch date.

Examples of DNS hijacking

In May 2025 the delegation of curve.fi was changed at its registrar; the team noticed about 25 minutes later and pointed the domain to neutral nameservers while regaining control (Curve's report). A hijack that lasts minutes or a few hours can be missing from the history entirely, if no observations were collected during that time.

A takeover can also leave the nameservers unchanged. With a lame delegation, the domain still points to a DNS provider that no longer hosts its zone. If that provider lets any customer create a zone for any name, an attacker can claim it and publish their own A records. In November 2024 Infoblox reported about 800,000 vulnerable domains found over three months, some 70,000 of which had been hijacked (Sitting Ducks). In such a case, the nameserver history may show no change. New addresses may appear in the domain’s IP history on ip-history.net, although ordinary hosting changes can produce the same pattern.

Checking the current delegation

Compare dig @1.1.1.1 example.com NS with the nameservers configured at the registrar. Parent delegation and NS records in the child zone can disagree. TTLs vary, so there is no universal propagation deadline. If you administer the domain, also check the DS record before changing a DNSSEC-enabled delegation.