DNS glossary

What is DNS Delegation?

DNS delegation is a DNS mechanism that transfers responsibility for a subdomain from a parent zone to a different set of authoritative name servers. It works through NS records in the parent zone that point to the child zone's servers, so resolvers follow referrals down the namespace hierarchy.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

DNS delegation is a hierarchical mechanism that transfers authority for a subdomain to a separate set of authoritative name servers through NS records published in the parent zone, enabling the DNS namespace to scale by distributing management responsibility across organizations and teams. The process involves creating a child zone on target name servers, adding corresponding NS records in the parent zone, and optionally publishing glue records when a nameserver's hostname resides within the delegated subdomain. Poorly managed delegation is a common source of DNS failures—including lame delegations, mismatched NS record sets, missing glue, and broken DNSSEC chains—making regular audits and consistency monitoring essential to prevent intermittent outages and security risks.

  • NS records in the parent zone must match those in the child zone to prevent inconsistent resolution behavior across different resolvers and caching scenarios.
  • Glue records are required only when a delegated nameserver’s hostname resides inside the delegated subdomain, allowing resolvers to bootstrap connectivity without circular lookups.
  • Lame delegation occurs when parent NS records point to servers that no longer serve the zone, causing SERVFAIL errors or timeouts that appear intermittent depending on which listed server resolvers query.

DNS delegation at a glance

AttributeValue
CategoryDNS zone management mechanism
Defined inRFC 1034 and RFC 1035
Protocol and portDNS, port 53 over UDP and TCP
Primary useGiving a separate set of authoritative servers control of a subdomain
Related termsAuthoritative DNS server, NS record, DNS zone, Glue record, Recursive resolver, DNSSEC

How DNS delegation works

Delegation works by placing pointers in the parent zone that tell resolvers where the child zone's authoritative servers are. The child zone then answers for every name beneath the delegation point.

  1. Create the child zone: The delegated party sets up a zone for the subdomain, such as sales.example.com, on its own authoritative name servers and loads the records for that zone.
  2. Add NS records to the parent: The parent zone administrator adds NS records at the delegation point that name the child zone's authoritative servers.
  3. Add glue records if needed: If a name server's hostname sits inside the delegated subdomain, the parent also publishes address records for it, called glue, so resolvers can reach it without a circular lookup.
  4. Resolver follows the referral: When a resolver queries the parent's servers for a name in the subdomain, they return a referral containing the NS records instead of an answer.
  5. Child servers answer: The resolver queries one of the named servers, which responds authoritatively for the subdomain.

The parent does not hold the child's data beyond the NS and glue records, so the child can change its records freely. The NS records in the child zone should match those in the parent, or resolution can become inconsistent. If DNSSEC is used, the parent also publishes a DS record to link the chain of trust to the child.

Why DNS delegation matters in enterprise networks

Delegation is what lets the DNS scale. The namespace is a hierarchy, as described in RFC 1034, and no single server needs to hold every record. The root zone delegates to top-level domains, which delegate to organizations, and large enterprises often delegate further to business units, regions or cloud environments so each team can change records without waiting on a central group.

Poorly managed delegation causes some of the most common DNS failures. If NS records in the parent point to servers that no longer exist or do not serve the zone, the result is a lame delegation, and resolvers may time out or return SERVFAIL for every name below that point. Mismatched NS sets between parent and child, missing glue and expired registrations produce intermittent failures that are hard to trace.

Delegation also carries security risk. A delegation that points to a decommissioned server or a deprovisioned cloud resource can be claimed by an attacker, who then answers for the subdomain. Regular audits of NS records, clear ownership of each delegated zone and monitoring of delegation consistency reduce this exposure.

DNS delegation vs DNS glue record

Delegation is the transfer of authority for a subdomain through NS records in the parent zone, while a glue record is an address record the parent publishes so resolvers can reach a delegated name server whose hostname lies inside the delegated zone. What is DNS Glue Record?

AttributeDNS delegationDNS glue record
PurposeHands authority for a subdomain to other name serversLets resolvers find the address of an in-zone name server
Record types involvedNS records at the delegation pointA or AAAA records for the name server hostname
RequiredRequired for any child zone served separatelyRequired only when the name server name is inside the delegated zone
Where it is publishedParent zoneParent zone, alongside the delegation

DNS delegation vs DNS zone

A zone is an administrative portion of the namespace served from one set of records, while delegation is the act of splitting a subdomain off into its own zone under different authoritative servers. What is DNS zone?

Common DNS delegation issues

The parent lists NS records for servers that do not answer authoritatively for the child zone, often after a provider migration or a decommissioned server. Resolvers see SERVFAIL or timeouts on some queries, and failures look intermittent because they depend on which listed server is chosen.

The NS records in the parent differ from the NS records inside the child zone, usually because one side was updated and the other was not. Different resolvers cache different sets, so behavior varies and changes are slow to take effect.

A name server inside the delegated zone has no glue in the parent, or the glue holds an old IP address. Resolvers cannot reach the child servers, and the whole subdomain fails to resolve after a server renumbering.

Firewalls or ACLs block UDP or TCP port 53 to the delegated servers from some networks. Internal clients may resolve the subdomain while external users cannot, which is often mistaken for a propagation delay.

The parent still holds a DS record for a key the child no longer uses, such as after a key rollover or a move to another provider. Validating resolvers return SERVFAIL for the subdomain while non-validating resolvers answer normally.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DNS delegation FAQ

Related terms

Article

NS record

An NS record is a DNS record that provides a list of the authoritative name servers responsible for a domain.

Learn more
Article

DNS Glue Record

A DNS glue record is an address record stored in a parent DNS zone that helps resolvers locate the authoritative name servers for a delegated domain.

Learn more
Article

DNS zone

A DNS zone is a contiguous portion of the domain name space for which administrative responsibility and authority have been delegated to a single manager.

Learn more
Article

Authoritative DNS server / Authoritative name server

An authoritative DNS server provides original and definitive answers to DNS queries.

Learn more
Article

DNS namespace

A DNS namespace is the hierarchical structure of domains that form a complete domain name in the DNS system.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

DNSSEC (Domain Name Service Security Extension) is a mechanism that uses cryptography to authenticate DNS data and verify the integrity of DNS queries and responses.

Learn more
Article

Time to Live (TTL)

TTL (time to live) is a setting for each DNS record that specifies how long a resolver caches the DNS query before it expires.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Browse the full glossary