Spread nameservers across more than one network

Why it matters

All of your nameservers sit in the same small address range, so one network or provider failure would take them all down. Placing them on different networks keeps the domain reachable.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. If you use a managed DNS provider with anycast, this is not a real weakness. Its servers share address ranges by design, and you can ignore this finding.
2. If you run your own nameservers, move or add at least one on a different network, ideally a different hosting provider and location.
3. Alternatively add a secondary DNS provider that fetches your zone by zone transfer.
4. Add the new nameserver at the registrar next to the existing ones and keep them until the new one answers correctly.

dig NS example.com +short
# replace ns1.example.net with a nameserver from the delegation
dig +short A ns1.example.net
dig +short A ns2.example.net

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Nameservers and delegation check
• Delegate the domain to working nameservers
• Add a second nameserver
• Fix nameservers that do not answer for the domain
• Make unreachable nameservers answer, or remove them
• Give each nameserver name an IP address
• Point nameserver names at public IP addresses
• Point nameserver names at A or AAAA records, not CNAMEs
• Make the registrar's nameservers match the zone's NS records
• Make all nameservers publish the same NS records
• Add glue records for nameservers inside your own domain
• Update glue records to match the nameserver's real address
• Check that nameservers are in sync