Looks to me that they simply did not update their domain on the TLD servers when their authoritative servers changed. They are using Route 53 I presume? Edit:

Looks to me that they simply did not update their domain on the TLD servers when their authoritative servers changed. They are using Route 53 I presume? Edit: I overlooked that in second query was for second level domain. This is normal if the first level domain has different name servers than the second. There's still an not optimal part though, on the second lookup it returns authoritative name servers but without glue record (i.e. it does not list IPs of those servers) so the client has to resolve them themselves, which could add few more extra lookups.