NS Record Lookup shows which nameservers are authoritative for a domain, meaning which servers hold the real answers for it. This is the record that decides where all the other records are read from, so it is the first thing to check when DNS changes appear to have no effect: if the nameservers still point at an old provider, edits made at a new provider are simply never consulted. Domains normally publish at least two nameservers for redundancy, and registrars usually require it. There are two places this information lives, and they can disagree. The delegation is stored at the parent zone by your registrar, while the NS records inside the zone are published by the nameservers themselves. When those two sets differ, resolution becomes inconsistent in ways that are hard to debug, because different resolvers may follow different paths. Changing nameservers is also the slowest DNS change to take effect, since the delegation at the registry commonly carries a TTL of a day or more.
DNS resolution happens in multiple stages. When you type a domain name, your browser first checks its own cache, then the OS resolver cache, then queries your configured DNS resolver (usually your ISP or a public resolver like 8.8.8.8 or 1.1.1.1). If none have the record cached, the resolver performs a recursive query: it asks the root name servers for the TLD servers (.com, .net, etc.), then asks the TLD servers for the authoritative name servers of the specific domain, and finally asks the authoritative servers for the actual record. This entire process typically completes in under 100ms. DNS-over-HTTPS (DoH) encrypts DNS queries in HTTPS traffic, preventing ISPs and network observers from seeing which domains you query. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers. Google and Cloudflare both operate free public DoH endpoints (dns.google and cloudflare-dns.com). TXT records have become a critical security mechanism: SPF (Sender Policy Framework) records specify which servers are allowed to send email for a domain, DKIM (DomainKeys Identified Mail) records provide public keys for verifying email signatures, and DMARC records tell receiving mail servers what to do when SPF or DKIM checks fail. Checking these records is the first step in diagnosing email deliverability problems.