From Domain to Nameserver, and Back
Every domain is delegated to a set of nameservers through NS records. Asking “which nameservers does example.com use?” is easy: the answer is public and one dig NS example.com away, as shown in how to check the nameservers of a domain.
The reverse question, “which domains use ns1.example-dns.net?”, cannot be answered by DNS itself. There is no record that lists a nameserver’s customers. A reverse NS lookup answers it from a database that has collected NS records for many domains and indexed them by nameserver hostname.
Where the Data Comes From
Every reverse NS service is only as good as the list of domains it has seen. Common sources are:
- Zone files that some registries publish for their top-level domains (for example through ICANN’s Centralized Zone Data Service for many generic TLDs).
- Passive DNS: answers observed by resolvers and sensors over time.
- Crawling and user queries: domains that were looked up through the service itself.
Our Reverse NS Lookup uses the last kind: its pool is built from the DNS queries made on this site and grows over time. That keeps it free and private, but it also means a result such as “12 domains” is what we have seen, not a full count. Many country-code registries do not publish zone files at all, so no public tool can give a complete list for them.
How to Run a Lookup
- Find the nameservers of a domain you already know, with the DNS Record Lookup or
dig NS example.com +short. - Paste one nameserver hostname (for example
ns1.example-dns.net) into the reverse NS tool. - Read the list of domains that point to it. Repeat with the second nameserver; most domains use a pair, but not always the same pair.
Reading the Results
What a shared nameserver means depends on who runs it:
| Nameserver type | Example pattern | What a match tells you |
|---|---|---|
| Big DNS or hosting provider | ns1.bigdns-provider.com | Very little. Thousands of unrelated customers share these servers. |
| Per-account names at a large provider | Two random first names, e.g. anna.ns.provider.com | Domains with the same pair may sit in the same account, but pairs are reused across customers too. |
| Small hosting company or reseller | ns1.smallhost.net | Domains likely share the same host or agency. A useful lead, not proof. |
| Vanity nameservers | ns1.brandname.com | Strong sign of a common owner or operator, such as one company’s portfolio. |
Treat every match as a lead to check, not a conclusion. Combine it with WHOIS data, shared IP addresses from a reverse IP lookup and shared mail servers from a reverse MX lookup. When two or three of these line up, the connection is far more likely to be real.
What People Use It For
- Portfolio audits. Companies with many domains use it to find forgotten domains still pointing at an old DNS host before that account is closed.
- Migrations. Before shutting down a nameserver, an admin checks which domains still delegate to it so nothing breaks.
- Security research. Phishing and scam domains are often registered in batches and parked on the same small nameserver; one known bad domain can lead to the rest.
- Market research. Seeing which sites use a hosting company’s nameservers gives a rough idea of its customers.
Since GDPR, WHOIS records hide most owner details, so infrastructure links such as nameservers have become one of the few public ways to connect domains; we covered that shift in reverse WHOIS after GDPR.
Limits Worth Knowing
- Coverage. No service sees every domain. An empty result means “not in this database”, not “no domains”.
- Freshness. Domains move between DNS hosts. Recheck a domain’s live NS records before acting on an old observation.
- Glue and in-bailiwick names. A nameserver can have several hostnames for the same IP address; a domain may use one name while others use another.
Common Questions
Is a reverse NS lookup legal?
Yes. It only uses public DNS data: NS records are published so that resolvers can find a domain’s nameservers.
Why does a big provider’s nameserver show only a few domains?
Because the result reflects the service’s own data pool. Large providers host millions of domains; any public tool will show only the ones it has observed.
Can I hide my domains from reverse NS lookups?
Not completely. Using a large DNS provider makes the link meaningless because you share nameservers with everyone else; vanity nameservers do the opposite and make your domains easy to group.