concept Domains & DNS
DNS NS records and delegation
An NS delegation tells a resolver which authoritative servers are responsible for a child DNS zone.
What it means
DNS NS records identify name servers for a zone or delegation boundary. Parent-side delegation data are distinct from the child zone’s own authoritative NS RRset, and additional address “glue” may be required to reach in-bailiwick servers. Changing one list does not automatically synchronize the other. DNS record structure Glue requirements
Try it
Simulation — follow a resolver referral. Keep an in-domain ns1.example.com with matching address glue, then remove the glue. The model shows the missing address bootstrap instead of inventing an answer. Select an out-of-domain nameserver with a separately resolved address, or make the parent and child NS disagree. Step through referral, address discovery and optional child contact. Reset returns all choices and the trace.
Follow an NS referral
Change parent delegation and glue, then walk one cold resolver referral.
Matching in-domain glue gives an address for the selected NS. It is not proof of the final answer.
| Observation | Model value |
|---|---|
| Parent NS | A |
| Child apex NS | A |
| NS address | Available |
| Could request child answer? | Yes, in this fixture |
Local, bounded educational fixture. No DNS, mail, certificate, network, socket or external request is performed.
About this model
Parent delegation controls the referral; a child apex NS edit does not automatically edit the parent. In-domain glue is address bootstrap, not the site A record.
See the article’s protocol sources and model limits. The scene does not alter a real system.
How the mechanism works
A resolver looking for www.example.com can receive a referral from the parent zone containing NS names for example.com. If one such name is ns1.example.com, obtaining its address from example.com itself might require first contacting that same server. Glue consists of parent-supplied address records for that in-domain nameserver, breaking the dependency. The glue is not the website's www A or AAAA record and is not itself a new authoritative answer for the requested host. RFC 9471 clarifies handling of available glue in referral responses, including truncation when a response cannot fit.
For ns1.example.net, address discovery belongs to another DNS resolution path; lack of glue at the example.com parent does not establish failure. Parent referral and child apex NS are separately administered surfaces. A stale parent delegation can still send a cold resolver toward the former server after a child-zone NS edit. DNSSEC DS data at the parent adds a separate coordinated change risk.
A nameserver move with a stale parent referral
Suppose the registrar-side parent referral still lists ns1.old.example.net, but the new zone provider publishes child apex NS entries for ns1.example.com. A cold resolver follows the parent referral first; publishing the new child NS does not modify that parent record.
- With an in-domain nameserver (
ns1.example.com), usable parent glue may be needed to learn its address before contacting the child. - With an out-of-domain nameserver (
ns1.example.net), resolution of that nameserver's address follows another DNS lookup path; missing child glue alone does not prove failure. - If the selected server answers, verify the served child-zone data separately. A reachable nameserver could still serve stale or incorrect records.
Before a real cutover, compare parent delegation, required addresses, DNSSEC DS state and the new server's zone content independently.
A warm resolver can hide missing glue
Imagine the parent delegates example.test to ns1.example.test but the referral omits that name server's address. A cold iterative resolver that lacks the needed address may be unable to reach the delegated server. A warm resolver with a previously cached address might still resolve the name successfully. A successful query from one resolver therefore does not prove the parent is returning a complete usable referral for a fresh resolver.
For in-domain name servers, RFC 9471 requires referral responses to include all available glue records or set the truncation flag when they cannot fit; it does not guarantee that the zone operator actually supplied every needed address to the parent. Compare the parent referral and address data directly before attributing an outage to the child zone or declaring the migration successful. This lab does not model warm-cache recovery or transport retry. Glue response requirements
In practice
Before changing NS or glue, record the current parent delegation, child authoritative data and actual host addresses. Validate reachable authoritative service and any DNSSEC dependencies before a controlled registrar change. Stop if the new server cannot serve the intended zone correctly. Verify parent delegation and child answers from independent read-only observations; preserve a reversal plan, recognizing cached delegation data.
Limits and common mistakes
This is a deterministic two-zone cold-resolution fixture, not a resolver, DNS trace or availability test. Actual resolvers may have cached addresses, multiple NS targets, fallback transports and additional DNSSEC conditions. Missing bootstrap evidence in this toy case is not a universal outage diagnosis.
Key takeaways
Treat parent NS, child NS and glue as related but separate DNS evidence. A successful edit in the child zone alone does not prove that recursive resolvers will use the intended new authorities.
Frequently asked questions
Editorial questions, answered from the sources listed for this article.
Can editing child NS records change the registrar delegation?
No. Parent-zone delegation is a distinct administrative setting. Check the actual parent referral instead of assuming child apex NS edits propagate upward.
Do external nameservers require glue at the delegated child’s parent?
When a nameserver name is outside the delegated child zone, its address can normally be resolved through its own DNS resolution path. The child parent does not supply child in-domain glue for that unrelated name.
Is glue itself the final authoritative answer for a host?
No. Glue is address assistance for reaching delegated servers. Authoritative A/AAAA data still have their own role and consistency requirements.
Can a nameserver change affect more than a web record?
Yes. Delegation influences access to the zone’s DNS data, potentially including mail and other services. Treat it as a higher-risk operation.
Sources & model boundaries
Primary references used for this explanation. The interactive example is an educational model, not a live check.
- Domain names — implementation and specification
Resource-record RDATA formats (TXT §3.3.14, NS §3.3.11 and SOA §3.3.13). DNS wire/text RDATA, TXT/NS/SOA. Read applicable sections with later updates.
Checked .
- DNS Glue Requirements in Referral Responses
In-domain and sibling glue (§2), referral inclusion requirements (§3). In-domain glue and referrals, not every delegation as an identical path.
Checked .