NS record

What NS record means

An NS record delegates a zone. The parent publishes a set of NS records pointing at the name servers responsible for the child, and the child publishes the same set at its own apex. Both exist for a reason — resolvers follow the parent's delegation, while the child's apex NS set is the authoritative one — and when the two disagree, some resolvers get answers that others do not.

That matters for mail because every authentication decision a receiver makes begins as a DNS query. If one name server in the delegation is unreachable or serving a stale copy of the zone, an SPF evaluation can return temperror, a DKIM key can appear to be missing and a DMARC record can appear never to have been published. At the receiver, each of those is indistinguishable from a domain that published nothing.

Check that the delegation at the parent matches the apex NS set, that every listed server answers, and that they answer with the same zone serial. A domain with one working name server and three that time out looks healthy most of the time, which is the least useful kind of fault to have.