DNS glossary

What is a DNS glue record?

A DNS glue record is an address record (A or AAAA) published in a parent zone that supplies the IP address of a name server whose name lies inside the delegated child zone. It breaks the circular dependency in which resolving the server name would require querying that same server.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A DNS glue record is an A or AAAA record published in a parent zone that provides the IP address of a name server whose hostname resides within the delegated child zone, resolving the circular dependency that would otherwise occur during DNS resolution. Glue records are essential for zones where name servers are named inside the zone they serve (such as ns1.example.com serving example.com), and they are managed through registrars or registry interfaces rather than from the child zone's own files. Stale, missing, or mismatched glue records cause real outages and inconsistent query results, making regular audits and updates critical to maintain zone reachability and prevent resolver failures.

  • Glue records sit in the additional section of DNS referrals from the parent zone and are not covered by DNSSEC signatures, requiring teams to audit them regularly and keep them synchronized with child zone NS and address records.
  • Missing or outdated glue for in-zone name servers causes resolvers to fail with SERVFAIL errors or timeouts, rendering the zone unreachable even when the zone file itself is healthy.
  • Glue is needed only when a delegated zone’s name server has a name inside that zone; name servers in external domains do not require glue because their addresses can be resolved through other zones.

DNS glue record at a glance

AttributeValue
CategoryDNS record data in a delegation
Protocol and portDNS, port 53 over UDP and TCP
OSI layerApplication layer (layer 7)
Primary useBreaking circular dependencies when a name server is named inside the zone it serves
Related termsNS record, delegation, authoritative name server, recursive resolver, A record, AAAA record, parent zone

How DNS glue record works

Glue is needed only when a delegated zone's name server has a name inside that same zone. The parent zone publishes the name server's address alongside the delegation so a resolver can continue without a circular lookup.

  1. Delegation is published: The parent zone holds NS records naming the servers for the child zone, such as ns1.example.com for example.com.
  2. Glue is added: Because ns1.example.com sits inside example.com, the parent also stores an A or AAAA record with that server's address.
  3. Resolver asks the parent: A resolver querying the parent server for a name in the child zone receives a referral containing the NS records.
  4. Glue arrives in the response: The parent includes the glue addresses in the additional section of the referral.
  5. Resolver queries the child: The resolver sends its query directly to the glue address and receives an authoritative answer.

Without glue, the resolver would have to look up ns1.example.com, which requires reaching example.com's servers, which requires that very address. Name servers outside the delegated zone do not need glue, because their addresses can be resolved through other zones. Glue is held at the parent, typically through the registrar, and is not controlled from the child zone's own files.

Why DNS glue record matters in enterprise networks

Glue records sit at a point where two administrative domains meet. The child zone owner edits the zone file, but the glue lives in the parent zone, usually updated through a registrar or registry interface. This split makes it easy for the two sets of data to drift apart, for example when a name server is renumbered and only the child zone is updated.

Stale or missing glue causes real outages. If the parent holds an old address, resolvers are sent to a server that no longer answers, and part or all of the zone becomes unreachable even though the zone itself is healthy. Missing glue for in-zone name servers can make the delegation unresolvable. Because resolvers cache referrals, a wrong glue record can keep causing failures until the cached time to live expires.

Glue is also a security consideration. Resolvers treat glue as less trustworthy than authoritative data and, under the DNS specifications in RFC 1034 and RFC 1035, glue is carried in the additional section of a response. Unauthenticated glue is not covered by DNSSEC signatures in the parent zone, so teams should audit glue regularly, keep it consistent with child zone NS and address records, and update it before changing server addresses.

DNS glue record vs DNS delegation

Delegation is the NS record set in a parent zone that hands authority for a child zone to other name servers, while glue is the address data that lets a resolver reach those servers when their names sit inside the delegated zone. What is DNS Delegation?

AttributeDNS glue recordDNS delegation
Record typesA or AAAA records for in-zone name serversNS records naming the child zone servers
PurposeBreaks the circular lookup dependencyTransfers authority for the child zone
Always requiredNo, only for in-zone server namesYes, for any delegated zone
Where it is publishedParent zone, as address data alongside the delegationParent zone, at the delegation point

DNS glue record vs A record

An ordinary A record maps a name to an IPv4 address in the zone that owns the name, while a glue record is an A or AAAA record held in the parent zone for a name that belongs to the child zone. What is A record?

AttributeDNS glue recordA record
Zone where it is heldParent zoneThe zone that owns the name
RoleSupports a delegationGeneral name-to-address mapping
Typical subjectName server hostnamesAny host name
Where it is returnedAdditional section of a referralAnswer section of a response

Common DNS glue record issues

A name server is given a new IP address and the child zone is updated, but the glue at the registrar is not. Resolvers following the referral go to the old address, so some queries time out while others succeed, depending on caching and which servers answer.

A delegation names ns1.example.com for example.com but no glue was supplied. Resolvers cannot find the server address without querying that server, so lookups fail with SERVFAIL or time out, and the zone appears unreachable.

The address in the parent glue differs from the A record in the child zone. Resolvers that trust the parent glue and those that later cache the child answer see different addresses, which produces inconsistent results that are hard to reproduce.

Glue is entered for name servers hosted in a different zone, such as a provider domain. The extra records go out of date when the provider changes addresses, and the parent may ignore or reject them.

Only an A record is registered for an in-zone name server that also answers over IPv6. IPv6-only resolvers cannot follow the referral to that server, so reachability varies by client network.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DNS glue record FAQ

Related terms

Article

DNS Delegation

DNS delegation is the process of assigning responsibility for managing a domain or subdomain to separate authoritative DNS servers.

Learn more
Article

NS record

An NS record is a DNS record that provides a list of the authoritative name servers responsible for a domain.

Learn more
Article

Nameserver

A nameserver is an application that responds to directory service queries, translating human-readable text identifiers into system-internal numeric identifiers; DNS is an example.

Learn more
Article

DNS zone

A DNS zone is a contiguous portion of the domain name space for which administrative responsibility and authority have been delegated to a single manager.

Learn more
Article

Authoritative DNS server / Authoritative name server

An authoritative DNS server provides original and definitive answers to DNS queries.

Learn more
Article

A record

An A record is a DNS record that maps domain names to IPv4 addresses.

Learn more
Article

AAAA record

An AAAA record is a DNS record that maps domain names to IPv6 addresses.

Learn more
Article

Time to Live (TTL)

TTL (time to live) is a setting for each DNS record that specifies how long a resolver caches the DNS query before it expires.

Learn more
Browse the full glossary