Registry and zone agree on the nameservers

There are two answers to "which nameservers serve this domain", and they come from different places. The parent zone holds the delegation, set through your registrar; the zone itself holds an NS record set, served by the nameservers. They are supposed to be identical, and nothing enforces it.

When they differ, resolvers disagree. Some use the delegation from the parent; others, having once queried the zone, use the set the zone gave them. Neither is wrong. The result is that a change appears to work for some people and not others, and the difference tracks which resolver they use rather than anything about their configuration — which makes it one of the harder faults to diagnose from the outside.

The common cause is a migration completed on one side only: nameservers changed at the registrar, the old provider still serving a zone with the old NS records, or the reverse.

A related fault is the lame delegation — a server named in the delegation that does not consider itself authoritative for the zone. Every query routed to it is a query that fails or is retried elsewhere, so the domain works but is slower and more fragile than it appears.

Decide which set is correct, then make the other match. Both edits are needed and they are in different systems: the delegation at the registrar, the NS record set in the zone at your DNS provider.

Change the zone first and the delegation second when adding servers, and the reverse when removing them, so that at no point is a server being used that is not ready to answer.

After a migration, leave the old nameservers serving the correct zone until the delegation TTL has expired everywhere — often 48 hours. Switching them off at the registrar and decommissioning them the same afternoon is what turns a clean migration into an outage.