How to find authoritative nameservers with dig

DNS delegation lets a parent zone direct resolvers to the servers responsible for a child zone. A dig trace follows that delegation from the root to the zone, so the nameserver list does not depend only on one recursive resolver's cached view.

Query the zone apex, such as iana.org, because delegation applies to the zone rather than an individual host beneath it. The parent referral identifies the delegated NS set, while the trace's final response comes from one of those servers.

The aa header flag marks an authoritative answer. Matching NOERROR responses and the same apex NS set from another delegated server show that both selected endpoints serve the expected zone data; TTLs and row order may differ without changing the set.

1. Trace the zone's NS delegation from the DNS root.

   $ dig +trace +nodnssec iana.org NS
   ##### snipped #####
   iana.org.		3600	IN	NS	a.iana-servers.net.
   iana.org.		3600	IN	NS	c.iana-servers.net.
   iana.org.		3600	IN	NS	b.iana-servers.net.
   iana.org.		3600	IN	NS	ns.icann.org.
   ##### snipped #####
   iana.org.		86400	IN	NS	a.iana-servers.net.
   iana.org.		86400	IN	NS	b.iana-servers.net.
   iana.org.		86400	IN	NS	c.iana-servers.net.
   iana.org.		86400	IN	NS	ns.icann.org.

   The first iana.org block is the parent-zone delegation. The final block is the apex NS answer returned after dig reaches a delegated server.

2. Confirm that one delegated server answers authoritatively for the zone apex.

   $ dig +norecurse +noall +comments +answer @a.iana-servers.net iana.org NS
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24223
   ;; flags: qr aa; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
   
   ;; OPT PSEUDOSECTION:
   ; EDNS: version: 0, flags:; udp: 4096
   ;; ANSWER SECTION:
   iana.org.		86400	IN	NS	a.iana-servers.net.
   iana.org.		86400	IN	NS	b.iana-servers.net.
   iana.org.		86400	IN	NS	c.iana-servers.net.
   iana.org.		86400	IN	NS	ns.icann.org.

   +norecurse clears the recursion-desired bit. NOERROR and aa show that a.iana-servers.net answered from authoritative zone data. A missing aa flag means the response does not prove authority for this zone.
   Related: How to query a specific DNS server with dig

3. Compare a second delegated server's authoritative apex NS answer.

   $ dig +norecurse +noall +comments +answer @b.iana-servers.net iana.org NS
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58242
   ;; flags: qr aa; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
   
   ;; OPT PSEUDOSECTION:
   ; EDNS: version: 0, flags:; udp: 4096
   ;; ANSWER SECTION:
   iana.org.		86400	IN	NS	a.iana-servers.net.
   iana.org.		86400	IN	NS	b.iana-servers.net.
   iana.org.		86400	IN	NS	c.iana-servers.net.
   iana.org.		86400	IN	NS	ns.icann.org.

   The second server returns NOERROR, aa, and the same four NS records, completing an independent check of the delegated set.
   Related: How to check SOA serial numbers with dig