Concept
Delegation is a chain of pointers, not a single authority: the root points to the TLD, the TLD points to your registrar's declared nameservers, and your nameservers finally hold the actual zone. "Glue records" solve a bootstrapping problem — if your nameserver's own hostname lives inside the domain it's serving (e.g. ns1.yourdomain.com serving yourdomain.com), the parent zone must hand back that nameserver's IP address directly (the glue) alongside the delegation, or resolution would require looking up the nameserver's address inside the very zone you're trying to reach — a circular dependency. Redundancy (multiple nameservers, ideally on different networks/ASNs) exists so that one provider's outage doesn't take your domain offline entirely.
Common Misconception
"If my nameservers are listed correctly at my DNS provider, delegation is fine." Not necessarily — what matters is what the PARENT zone (the TLD) has on record for your nameservers, which can silently drift from what your provider currently serves, especially after a provider migration where an old NS record was never removed at the registrar. This mismatch — "lame delegation" — is invisible from your provider's own dashboard, since the dashboard only shows you its own side of the relationship, not the parent's.
Hands-On Exercise
No lab environment needed — check delegation health directly:
- marinadns.io/dig — query your domain's NS records directly and compare against what's shown in your registrar's dashboard.
- noda.marinadns.io — run a full NODA Check; the CAT-INFRA category (Parent NS Records, Nameservers Authoritative, DNS Parent Sent Glue, Same Glue, NS Consistency checks) is built exactly to catch delegation and glue mismatches automatically, without you having to manually compare parent vs. provider records.
For the manual delegation-trace exercise and the lame-delegation detection loop (querying every listed nameserver individually), see Lesson 2 in the DNS Admin Course Lab Environment page.
Commands to Run
# Walk the delegation chain manually, root -> TLD -> your NS
dig +trace yourdomain.com
# Confirm what the PARENT zone says your nameservers are
dig yourdomain.com NS @a.root-servers.net # (or the relevant TLD server from +trace output)
# Confirm what YOUR nameservers say about themselves (should match)
dig yourdomain.com NS @ns1.yourdnsprovider.com
# Check glue: does the parent hand back A/AAAA for your NS without a second lookup?
dig yourdomain.com NS +additional
# Detect lame delegation: query each listed NS directly, all must answer authoritatively
for ns in $(dig +short yourdomain.com NS); do echo "== $ns =="; dig @$ns yourdomain.com SOA +norecurse; done
A mismatch between parent-side NS and your-side NS, or any nameserver that doesn't answer authoritatively, is the lame-delegation signature to watch for.
Mastery Checkpoint
You should be able to explain, without looking anything up:
- Why glue records exist and specifically what circular problem they solve.
- What "lame delegation" means and why it can exist even when your DNS provider's own dashboard shows everything correct.
- Why redundant nameservers on different ASNs/networks provide real resilience, while redundant nameservers all behind the same provider's infrastructure provide much less.
If you can answer all three without re-reading this lesson, move to Lesson 3.
← DNS Admin Course Lab Environment
