Registrar nameservers do not match the hosted zone

; Cloudflare style, two nameservers
example.com.  NS  bob.ns.cloudflare.com.
example.com.  NS  kate.ns.cloudflare.com.

; Route 53 style, four nameservers
example.com.  NS  ns-123.awsdns-45.com.
example.com.  NS  ns-678.awsdns-90.net.
example.com.  NS  ns-1111.awsdns-22.org.
example.com.  NS  ns-2222.awsdns-67.co.uk.

# 1. What the registry publishes for the domain (the registrar's delegation)
curl -s https://rdap.org/domain/example.com | jq '.nameservers[].ldhName'

# Alternative, classic whois
whois example.com | grep -i "Name Server"

# 2. What the zone itself actually answers with
dig NS example.com +short @8.8.8.8

# 3. Ask one of the new nameservers directly, it should answer authoritatively
dig @ns-123.awsdns-45.com example.com NS +norecurse

# 4. Trace the full delegation path from the root down
dig +trace example.com

"""Detect a mismatch between the registrar's delegated nameservers and the
nameservers the zone actually answers with. Diagnostic only: the registrar
side cannot be fixed through the Cloudflare DNS API, so this script never
writes anything, it only reports what it finds.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("check_ns_mismatch")

DNS_DOMAIN = os.environ.get("DNS_DOMAIN", "example.com")
CLOUDFLARE_API_TOKEN = os.environ.get("CLOUDFLARE_API_TOKEN", "")
CLOUDFLARE_ZONE_ID = os.environ.get("CLOUDFLARE_ZONE_ID", "")
DRY_RUN = os.environ.get("DRY_RUN", "true").lower() == "true"


def normalize_ns(hostname):
    return hostname.strip().lower().rstrip(".")


def ns_sets_match(registrar_ns, zone_ns):
    """Pure function, no I/O. Normalize each hostname (lowercase, strip the
    trailing dot) and compare the two lists as sets."""
    return {normalize_ns(h) for h in registrar_ns} == {normalize_ns(h) for h in zone_ns}


def get_registrar_ns(domain):
    """RDAP is the registry-facing view: what the registrar has delegated."""
    import requests

    r = requests.get(f"https://rdap.org/domain/{domain}", timeout=15)
    r.raise_for_status()
    data = r.json()
    return [ns["ldhName"] for ns in data.get("nameservers", []) if ns.get("ldhName")]


def get_zone_ns(domain):
    """dnspython gives the live, authoritative-side view of the zone's NS set."""
    import dns.resolver

    answer = dns.resolver.resolve(domain, "NS")
    return [str(rdata.target) for rdata in answer]


def run():
    log.info("Checking nameserver delegation for %s (DRY_RUN=%s)", DNS_DOMAIN, DRY_RUN)

    registrar_ns = get_registrar_ns(DNS_DOMAIN)
    zone_ns = get_zone_ns(DNS_DOMAIN)

    log.info("Registrar (RDAP) nameservers: %s", sorted(registrar_ns))
    log.info("Zone (live NS query) nameservers: %s", sorted(zone_ns))

    if ns_sets_match(registrar_ns, zone_ns):
        log.info("OK: registrar delegation matches the live zone. Nothing to do.")
        return

    log.warning(
        "MISMATCH: the registrar delegates to %s but the zone answers with %s. "
        "This is a registrar-side fix, not something the Cloudflare DNS API can change. "
        "Update the nameserver list at the registrar to match the zone's NS set.",
        sorted(registrar_ns), sorted(zone_ns),
    )

    # Note for future readers: CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID are
    # accepted for consistency with the other fixes in this repo, and would be
    # used to manage records inside a zone already delegated to Cloudflare via
    # https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records, but
    # that endpoint has no way to touch the registrar's delegation itself, so
    # this script never calls it.
    if not DRY_RUN:
        log.info("DRY_RUN is false, but this check never writes. Fix the registrar by hand.")


if __name__ == "__main__":
    run()

/**
 * Detect a mismatch between the registrar's delegated nameservers and the
 * nameservers the zone actually answers with. Diagnostic only: the registrar
 * side cannot be fixed through the Cloudflare DNS API, so this script never
 * writes anything, it only reports what it finds.
 */
import { pathToFileURL } from "node:url";

const DNS_DOMAIN = process.env.DNS_DOMAIN || "example.com";
const CLOUDFLARE_API_TOKEN = process.env.CLOUDFLARE_API_TOKEN || "";
const CLOUDFLARE_ZONE_ID = process.env.CLOUDFLARE_ZONE_ID || "";
const DRY_RUN = (process.env.DRY_RUN || "true").toLowerCase() === "true";

export function normalizeNs(hostname) {
  return hostname.trim().toLowerCase().replace(/\.$/, "");
}

export function nsSetsMatch(registrarNs, zoneNs) {
  // Pure function, no I/O. Normalize each hostname and compare as sets.
  const a = new Set(registrarNs.map(normalizeNs));
  const b = new Set(zoneNs.map(normalizeNs));
  if (a.size !== b.size) return false;
  for (const host of a) if (!b.has(host)) return false;
  return true;
}

async function getRegistrarNs(domain) {
  // RDAP is the registry-facing view: what the registrar has delegated.
  const res = await fetch(`https://rdap.org/domain/${domain}`);
  if (!res.ok) throw new Error(`RDAP lookup failed: ${res.status}`);
  const data = await res.json();
  return (data.nameservers || []).map((ns) => ns.ldhName).filter(Boolean);
}

async function getZoneNs(domain) {
  // The built-in dns module gives the live, authoritative-side view.
  const dns = await import("node:dns/promises");
  return dns.resolveNs(domain);
}

export async function run() {
  console.log(`Checking nameserver delegation for ${DNS_DOMAIN} (DRY_RUN=${DRY_RUN})`);

  const registrarNs = await getRegistrarNs(DNS_DOMAIN);
  const zoneNs = await getZoneNs(DNS_DOMAIN);

  console.log("Registrar (RDAP) nameservers:", [...registrarNs].sort());
  console.log("Zone (live NS query) nameservers:", [...zoneNs].sort());

  if (nsSetsMatch(registrarNs, zoneNs)) {
    console.log("OK: registrar delegation matches the live zone. Nothing to do.");
    return;
  }

  console.warn(
    `MISMATCH: the registrar delegates to ${JSON.stringify([...registrarNs].sort())} ` +
    `but the zone answers with ${JSON.stringify([...zoneNs].sort())}. ` +
    "This is a registrar-side fix, not something the Cloudflare DNS API can change. " +
    "Update the nameserver list at the registrar to match the zone's NS set."
  );

  // Note for future readers: CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID are
  // accepted for consistency with the other fixes in this repo, and would be
  // used to manage records inside a zone already delegated to Cloudflare via
  // https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records, but that
  // endpoint has no way to touch the registrar's delegation itself, so this
  // script never calls it.
  if (!DRY_RUN) {
    console.log("DRY_RUN is false, but this check never writes. Fix the registrar by hand.");
  }
}

if (import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((e) => { console.error(e); process.exit(1); });
}

from check_ns_mismatch import ns_sets_match


def test_matches_when_identical():
    assert ns_sets_match(["ns1.example.com"], ["ns1.example.com"]) is True


def test_matches_ignoring_case():
    assert ns_sets_match(["NS1.EXAMPLE.COM"], ["ns1.example.com"]) is True


def test_matches_ignoring_trailing_dot():
    assert ns_sets_match(["ns1.example.com."], ["ns1.example.com"]) is True


def test_matches_ignoring_order():
    a = ["bob.ns.cloudflare.com", "kate.ns.cloudflare.com"]
    b = ["kate.ns.cloudflare.com", "bob.ns.cloudflare.com"]
    assert ns_sets_match(a, b) is True


def test_mismatch_on_old_vs_new_host():
    old = ["ns1.oldhost.com", "ns2.oldhost.com"]
    new = ["bob.ns.cloudflare.com", "kate.ns.cloudflare.com"]
    assert ns_sets_match(old, new) is False


def test_mismatch_when_one_list_has_an_extra_server():
    a = ["ns1.example.com", "ns2.example.com"]
    b = ["ns1.example.com", "ns2.example.com", "ns3.example.com"]
    assert ns_sets_match(a, b) is False


def test_mismatch_when_one_list_is_missing_a_server():
    a = ["ns1.example.com", "ns2.example.com"]
    b = ["ns1.example.com"]
    assert ns_sets_match(a, b) is False


def test_both_empty_counts_as_matching():
    assert ns_sets_match([], []) is True


def test_one_empty_one_not_is_a_mismatch():
    assert ns_sets_match([], ["ns1.example.com"]) is False

import { test } from "node:test";
import assert from "node:assert/strict";
import { nsSetsMatch } from "./check-ns-mismatch.js";

test("matches when identical", () => {
  assert.equal(nsSetsMatch(["ns1.example.com"], ["ns1.example.com"]), true);
});

test("matches ignoring case", () => {
  assert.equal(nsSetsMatch(["NS1.EXAMPLE.COM"], ["ns1.example.com"]), true);
});

test("matches ignoring trailing dot", () => {
  assert.equal(nsSetsMatch(["ns1.example.com."], ["ns1.example.com"]), true);
});

test("matches ignoring order", () => {
  const a = ["bob.ns.cloudflare.com", "kate.ns.cloudflare.com"];
  const b = ["kate.ns.cloudflare.com", "bob.ns.cloudflare.com"];
  assert.equal(nsSetsMatch(a, b), true);
});

test("mismatch on old vs new host", () => {
  const oldNs = ["ns1.oldhost.com", "ns2.oldhost.com"];
  const newNs = ["bob.ns.cloudflare.com", "kate.ns.cloudflare.com"];
  assert.equal(nsSetsMatch(oldNs, newNs), false);
});

test("mismatch when one list has an extra server", () => {
  const a = ["ns1.example.com", "ns2.example.com"];
  const b = ["ns1.example.com", "ns2.example.com", "ns3.example.com"];
  assert.equal(nsSetsMatch(a, b), false);
});

test("mismatch when one list is missing a server", () => {
  const a = ["ns1.example.com", "ns2.example.com"];
  const b = ["ns1.example.com"];
  assert.equal(nsSetsMatch(a, b), false);
});

test("both empty counts as matching", () => {
  assert.equal(nsSetsMatch([], []), true);
});

test("one empty one not is a mismatch", () => {
  assert.equal(nsSetsMatch([], ["ns1.example.com"]), false);
});