Point nameserver names at public IP addresses

Why it matters

A nameserver name resolves to an internal-only address such as 10.x.x.x or 192.168.x.x, which resolvers on the internet cannot reach. The scanner did not contact it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find the A or AAAA record of the nameserver name and look at its address. Private ranges are 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and the equivalents for IPv6 and loopback.
2. Replace it with the server's public address, and make sure the server really is reachable on it for UDP and TCP port 53.
3. If the record is glue at the registrar, update the host record there as well.
4. Confirm with the command below.

dig NS example.com +short
# replace ns1.example.net with a nameserver from the delegation
dig +short A ns1.example.net

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Nameservers and delegation check
• Delegate the domain to working nameservers
• Add a second nameserver
• Spread nameservers across more than one network
• Fix nameservers that do not answer for the domain
• Make unreachable nameservers answer, or remove them
• Give each nameserver name an IP address
• Point nameserver names at A or AAAA records, not CNAMEs
• Make the registrar's nameservers match the zone's NS records
• Make all nameservers publish the same NS records
• Add glue records for nameservers inside your own domain
• Update glue records to match the nameserver's real address
• Check that nameservers are in sync