How to see who really controls your domain’s DNS

Three records, three dependencies

Every working domain has answers to three questions. Who answers DNS queries for it (the NS records)? Where does its email go (the MX records)? Where does its website live (the A/AAAA records)? Each answer is a company you depend on — and they’re not necessarily the company you bought the domain from.

Look them up yourself

With dig (or an online DNS lookup), against your domain:

• dig NS yourdomain.com +short — the nameserver hostnames usually reveal the DNS provider (ns.cloudflare.com, awsdns, domaincontrol.com = GoDaddy, registrar-servers.com = Namecheap…).
• dig MX yourdomain.com +short — aspmx.l.google.com means Google Workspace, protection.outlook.com means Microsoft 365, mx.cloudflare.net means Cloudflare Email Routing.
• dig A yourdomain.com +short — the IPs; published ranges identify Cloudflare’s proxy, GitHub Pages, and a few others.
• The registrar comes from RDAP (WHOIS’s successor): look the domain up at rdap.org or your registry’s RDAP endpoint.

Why concentration is the thing to check

If one company is your registrar, your DNS host, and your email provider, then one outage, one billing dispute, or one compromised account takes down your site, your email, and — the vicious part — the password-reset emails you’d need to recover anything. Spreading DNS or email to a second provider turns a catastrophe into an inconvenience.

Our free DNS resilience checker runs all four lookups at once and flags exactly this concentration. It reads public records only and stores nothing.