Follow a delegation from the root to a TLD and authoritative nameserver, including glue and lame delegation failures.
What matters first
- The parent delegates a zone through NS records.
- The child zone serves its own authoritative records.
- Glue breaks circular resolution for in-bailiwick nameservers.
- Parent and child data should be inspected independently during incidents.
Parent and child responsibilities
The parent zone publishes NS records that point toward the child's authoritative servers. The child zone publishes its own apex NS set and actual records. Resolvers work best when these sets agree.
Use the nameserver lookup to list the NS names visible through the resolver and resolve each server address.
Why glue exists
If a nameserver name sits inside the zone it serves, resolving that name would otherwise depend on reaching the same zone first. The parent can publish address glue to break the circular dependency. Glue is routing help, not an authoritative replacement for the nameserver's own A or AAAA data.
Diagnosing a lame delegation
Query the parent for the delegation, resolve every nameserver address, then ask each server directly for the zone's SOA and compare serials and NS sets. Record timeouts separately from authoritative negative answers.
During a provider change, compare the parent DS and child key material with the DNSSEC check before applying the nameserver migration checklist.
For a step-by-step cutover and explicit rollback signals, follow the authoritative nameserver cutover checklist.
Evidence-to-decision table
| Evidence | What it means | Responsible next step |
|---|---|---|
| Parent NS | Where the parent directs resolvers | Query the parent authority |
| Glue A/AAAA | Addresses supplied by parent | Compare with authoritative address data |
| Child SOA | Server claims authority for zone | Ask every delegated server |
| Child NS | Zone's own NS set | Compare to parent for persistent mismatch |
Illustrative lame delegation diagnosis
This is an illustrative example, not a claimed real-world test.
Ask the parent zone for the domain's delegation and record all nameserver names and glue.
Resolve each server name, then query each address directly for the child's SOA over UDP and TCP.
Separate timeout, refusal and non-authoritative response; they require different fixes.
Defensible outcome: A lame server is identified by its direct behavior, not by a generic recursive failure. The evidence also shows whether registrar delegation or DNS-provider configuration must change.
Action checklist
- Query parent authority
- Record glue
- Resolve every NS address
- Test UDP and TCP
- Ask for SOA with recursion off
- Compare serials and NS sets
- Check DNSSEC chain
Edge cases that change the answer
Out-of-bailiwick server
The parent normally does not need to provide glue; resolution follows that server name's own delegation.
Hidden primary
The SOA primary field need not be a publicly delegated transfer source in a hidden-primary design.
Anycast authority
One server address can represent multiple sites, so test from multiple networks for regional faults.
Questions this guide should settle
Is glue authoritative?
It is parent-zone routing data. The nameserver name's own zone remains authoritative for its address records.
Must parent and child NS always match instantly?
Brief planned transitions can differ, but persistent mismatch increases ambiguity and should be corrected.
Does a high SOA serial mean newer data?
Only under the operator's serial scheme and serial arithmetic; formats are conventions, not universal timestamps.