What it detects01
What does 'Newly Self-Managed NS' mean?
The domain has recently configured its own nameservers within a short time window.
Newly Self-Managed NS Server
The domain has recently configured its own nameservers within a short time window.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is self-managed NS suspicious for new domains?
Threat actors set up private nameservers for bulletproof DNS resolution and fast-flux techniques.
Often paired with:alert_only
Evidence shape
What Newly Self-Managed NS Server looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "new_self_managed_ns",
"name": "Newly Self-Managed NS Server",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "malicious",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}Siblings
Peers in DNS Records (MX/NS)
12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Newly Self-Managed MX Server
The domain has recently set up its own mail exchange server within a short time window.
Malicious
Self-Managed Name Server Detected
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS p…
Safe
Self-Managed Mail Infrastructure Detected
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
SafeCore
NS Unchanged Since Domain Creation
The domain's nameserver records have never been changed since registration.
Malicious
In the wild
See Newly Self-Managed NS Server fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.