DNS Detection

Bulk DNS detection

Identify the DNS provider behind a domain — Cloudflare, Route 53, Azure DNS, Google Cloud DNS, NS1 and dozens more — by analysing the authoritative NS hostnames. Submit up to 100 domains at once; the comparison table shows the detected provider, the full NS list and whether the NS supports IPv6.

What is DNS detection?

DNS detection identifies who is running the DNS for a domain, not what records the zone returns. The signal comes from the authoritative name servers: every managed DNS provider issues NS names from its own domain (ns*.cloudflare.com, ns-*.awsdns-*.org, ns-cloud-*.googledomains.com, and so on). Match the NS hostnames against a curated list of provider patterns and the answer falls out without any vendor API.

What this tool returns

Domain

The hostname you submitted, with http(s)://, www. and trailing paths stripped.

Provider

The detected DNS provider (or providers — multi-provider setups show both). Unidentified means no NS hostname matched our pattern list, which usually points to self-hosted or vanity NS.

Confidence

High when at least one NS hostname matches a known provider pattern, Low otherwise. There's no fuzzy middle — we only assert a provider when the hostname is unambiguous.

Nameservers

Authoritative name servers as returned by the resolver, deduplicated and sorted.

NS count

Number of distinct authoritative name servers. Most operators publish 2–4; a single NS is a single point of failure.

IPv6 NS

Yes if any NS hostname has an AAAA record (the zone can be reached over IPv6), No otherwise.

Why detect the DNS provider?

Migration planning

Before moving DNS providers, you need a clean inventory of what you (and every brand you operate) are using today. Run the full list through this tool and the answer drops into one table.

Troubleshooting

When a domain misbehaves, knowing whether it lives on Cloudflare, Route 53 or a registrar's bundled DNS tells you whose dashboard to log into and whose status page to check.

Vendor & portfolio audits

Map the provider mix across a portfolio — useful for consolidation projects, M&A due diligence, or just confirming a security baseline (e.g. "every customer-facing domain is on Cloudflare").

Competitive intelligence

Curious which DNS provider a competitor or a target market favours? Bulk-detect across a list and the distribution becomes obvious.

Providers we currently recognise

The detection map is hand-curated and refreshed as new providers appear. Today it covers:

• Hyperscalers / CDNs — Cloudflare, AWS Route 53, Google Cloud DNS, Microsoft Azure DNS, Akamai, Fastly, Oracle Cloud.
• Managed DNS specialists — NS1, DNS Made Easy, Dyn (Oracle), UltraDNS, Constellix, ClouDNS, easyDNS.
• Registrars with bundled DNS — GoDaddy, Namecheap (FreeDNS & Hosting), Gandi, DNSimple, Hover, Enom, IONOS, Rackspace, Liquid Web, SiteGround.
• Platform / hosting DNS — Netlify, Vercel, DigitalOcean, Linode, Hetzner, OVH, Bunny.net, Gcore, CDN77, WordPress.com, Shopify, Wix, Squarespace, Zoho.
• CN / APAC — DNSPod (Tencent), Alibaba Cloud DNS.
• CZ / regional — CZ.NIC, Subreg, Forpsi, WEDOS, Active 24.

Anything else lands as Unidentified. If you run into a provider that ought to be recognised, tell us and we'll add it.

Detection methodology

1. Input cleanup. http(s)://, www. and trailing paths are stripped so paste-from-URL still works.
2. NS query. One NS lookup against the system resolver returns the authoritative name-server set.
3. Pattern match. Each NS hostname is checked against our substring map of provider domains (the part of the hostname that is unique to a single provider).
4. IPv6 check. A single AAAA lookup is performed on the NS hostnames; the result is "Yes" the moment any one returns a record, "No" otherwise.
5. Aggregation. Distinct provider labels are joined together — a multi-provider setup shows both (or all) labels.

Common DNS configurations

• Single provider. All NS records point at one provider. Simple to operate, but a provider-wide outage takes the zone down.
• Multi-provider (primary + secondary). A second provider replicates the zone. Higher resilience, more change-management cost. Both providers show up in the result.
• Registrar-bundled DNS. Free with the domain, basic feature set — common for landing pages and small sites. The provider label maps to the registrar's NS domain.
• Self-hosted. Vanity NS like ns1.yourcompany.com. Falls into the Unidentified bucket — the tool can't tell what runs behind a vanity name.

Limitations

• White-labelled DNS (vanity NS hiding a managed provider) cannot be detected from the NS name alone — that needs network-level fingerprinting we don't do here.
• We don't show NS IPs, geographic location, anycast vs. unicast topology or DNSSEC status — keep this tool focused on the provider question.
• Heavy-tailed: hundreds of providers exist; we recognise the major ones. A miss is reported honestly as Unidentified, never guessed.
• Lookups happen from our resolver, not from your network. Split-horizon or registrar-managed-only NS may not match what you see internally.

Picking a DNS provider

If this tool surfaced something you want to change, the usual selection axes are: performance (global anycast footprint, query response times), reliability (uptime guarantees, redundancy, DDoS protection), features (DNSSEC, geo-routing, health checks, API, IPv6), security (DDoS mitigation, audit logs, compliance), and cost (pricing model, included query volume).

Related tools

Pair this with DNS records lookup to see what each NS is actually serving, WHOIS & RDAP lookup to verify the registrar-side NS matches what's resolving, domain & IP lookup for GeoIP and ASN on the NS hosts, and blacklist check against the resulting IPs.

Get started

Paste one or more domains in the form above — one per line, with or without www. — and click Lookup. The result table is exportable to CSV, JSON, YAML or XML.