Querying every nameserver directly — this takes a few seconds.
Querying every nameserver directly — this takes a few seconds.
ns.count
Two or more means one server can fail without taking the domain off the air.
Two nameservers is the long-standing minimum, and most registries enforce it at registration. With one, any maintenance window, reboot, network fault or address change is a total outage of everything the domain does — web, mail, and every API that resolves a name under it.
The count on its own is the weaker half of the question. Two nameservers in the same rack, on the same subnet, behind the same router, fail together — so the number satisfies the check while providing very little of what the check is for. Independence of network path matters more than the total.
Beyond about four there is little to gain. Resolvers pick among them by observed latency and rarely exhaust the list, so additional servers mostly add surface to keep synchronised.
Run at least two, and place them on different networks — ideally different providers, and different physical locations. Anycast from a managed provider gives most of this without operating anything.
A secondary from a different DNS provider is a good way to survive a provider-wide failure, which is the outage a single provider's redundancy cannot help with. It does require both to serve the same zone, so it is a commitment to keeping replication working.
Make sure every server you list is actually authoritative and answering. A delegation naming four servers of which two are lame is worse than one naming two that work — resolvers still try them, and every attempt is latency somebody is waiting through.
At least two nameservers is one of 49 checks in every report, alongside delegation, mail authentication, TLS and registration.