Glue Records and DNS Delegation Explained

Advanced⏱ 4 min readUpdated October 13, 2026

Your domain does not start in your DNS zone. It starts one level up, in the zone of .com or .pl, where the registry keeps a few records saying which nameservers answer for you. That hand-over is called delegation. When those nameservers are named inside the very domain they serve — ns1.example.com for example.com — the registry must also hold their addresses. Those addresses are glue, and when they are wrong, the whole domain goes dark.

How delegation works

When you set nameservers at the registrar, the registry publishes NS records for your domain in the parent zone. If the nameserver names are inside your domain, it adds their addresses as well:

; in the .com zone (run by the registry), not in yours
example.com.        172800 IN NS  ns1.example.com.
example.com.        172800 IN NS  ns2.example.com.
; glue: addresses of nameservers named inside the delegated zone
ns1.example.com.    172800 IN A   192.0.2.53
ns2.example.com.    172800 IN A   198.51.100.53

Without those A records a resolver would be stuck: to find example.com it must ask ns1.example.com, and to find ns1.example.com it must ask the nameservers of example.com. Glue arrives in the same referral and breaks the loop.

To reach example.com you need ns1.example.com, which lives in example.com. The .com server hands over its address (glue) with the referral, so the resolver can ask it directly.

When glue is needed

Domain	Nameserver	Glue	Why
`example.com`	`ns1.example.com`	Required	The nameserver is inside the zone it serves — the loop above.
`example.com`	`ns1.dnshost.example`	Not used	The resolver looks up `dnshost.example` separately, through its own delegation.
`example.com`	`ns1.example.org`	Optional	"Sibling" glue: some registries publish it, but resolvers must be able to manage without it (RFC 9471).

Running your own nameservers (child nameservers)

Hosted DNS (Cloudflare, your registrar, your hosting company) gives you nameservers under its own domain, so there is no glue for you to manage. You only need it for nameservers named under your own domain — branded nameservers or self-hosted DNS. Registrars call this "child nameservers", "host records", "register nameservers" or simply "glue records".

Create the host names (ns1.example.com, ns2.example.com) with their IPv4 and, if they have one, IPv6 addresses in the registrar's panel.
Add the same A/AAAA records and NS records inside your zone, so the parent and your servers say the same thing.
Only then switch the domain's nameservers to those names.
Check the result from the parent with dig +norec (below) and from the outside with a DNS trace.

Watch out: Changing a nameserver's IP address means changing it in two places: in your zone and in the glue at the registrar. Resolvers use the glue first, so a zone that is correct with stale glue still breaks — and with a parent TTL of up to two days, the outage lasts.

Common delegation problems

Lame delegation: a nameserver listed in the parent does not answer for the zone (wrong server, zone deleted, firewall). Resolvers retry elsewhere, so it shows up as slowness and occasional SERVFAIL.
Parent and child disagree: the registry lists ns1/ns2, your zone lists ns3/ns4. Which set a resolver uses depends on its cache, so behaviour differs between networks.
Stale glue: the server moved, the glue did not. Typical after a VPS migration.
Missing glue: in-zone nameservers without addresses at the registry — the domain does not resolve anywhere.
All eggs in one basket: two nameservers on one IP, or on one network. RFC 2182 asks for servers that do not fail together.

How to check delegation and glue

Ask a server of the parent zone directly, with recursion off, to see exactly what the registry publishes — glue appears in the ADDITIONAL section. Then compare it with what your own servers say:

# ask a .com server directly, without recursion: glue is in the ADDITIONAL section
dig @a.gtld-servers.net example.com NS +norec
# follow the whole chain from the root
dig example.com A +trace
# compare with what your own nameservers say
dig @ns1.example.com example.com NS +short

Tip: The PixDNS DNS trace follows the chain from the root and shows each referral, so a missing or stale glue record is visible at the step where it happens. The NS lookup compares the nameservers that answer.

Trace a domain's delegation →Next: what nameservers are →

Frequently asked questions

Do I need glue records with Cloudflare or my registrar's DNS?

No. Their nameservers live under their own domains, and they manage the addresses. Glue matters only for nameservers named inside your domain.

Where do I edit glue records?

At the registrar, in a section called child nameservers, host records or similar. Your DNS zone cannot change them, because they live in the parent zone.

How long does a glue change take?

The registry usually publishes it within minutes, but resolvers may keep the old address until the parent's TTL runs out — up to 48 hours for .com.

What is a lame delegation?

A nameserver listed for a domain that does not actually answer for it. It slows lookups down and can cause intermittent failures.

Try it on your domain

See the theory in practice — run a DNS Trace for your own domain.

Updated October 13, 2026

Sources