Until today I was used to believe it couldn't. From this page
The name field can be any of:
- A Fully Qualified Domain Name (FQDN) e.g. example.com. (ends with a dot)
- An unqualfied name (does not end with a dot)
- An '@' (substitutes the current value of $ORIGIN)
- a 'space' or 'blank' (tab) - this is replaced with the previous value of the name field.
Now, look at the following query
$ dig top-immotunisie.com NS
; <<>> DiG 9.6.0-APPLE-P2 <<>> top-immotunisie.com NS
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44156
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;top-immotunisie.com. IN NS
;; ANSWER SECTION:
top-immotunisie.com. 36012 IN NS ns1.topnet.tn.
top-immotunisie.com. 36012 IN NS 196.203.251.8.
;; Query time: 353 msec
;; SERVER: 85.37.17.16#53(85.37.17.16)
;; WHEN: Thu Jan 7 02:29:15 2010
;; MSG SIZE rcvd: 91
How is it possible? Can a NS record point to an IP address?