Some of the most consequential DNS records are ones most people never touch and few think to monitor. Glue records and the delegation they support sit at the boundary between your domain and the wider DNS, in the parent zone rather than your own. When they are correct, everything just works. When they break or drift, the failure is often total, the domain becomes unreachable, and confusing, because the problem is not in the zone you administer. This is exactly the kind of overlooked surface where continuous attention pays off.
This guide explains what glue records and delegation actually are, shows what they look like, walks through how to inspect them, and covers what is worth monitoring and why.
Delegation: How the Parent Points at You
DNS is a hierarchy. When someone looks up your domain, a resolver starts at the root, gets referred to the top-level domain (such as .com), and the TLD refers it to your authoritative nameservers. That final referral, the TLD telling the world which nameservers are authoritative for your domain, is delegation, and it is expressed as NS records in the parent zone.
A crucial detail: the NS records that matter for finding you live in the parent zone, published there through your registrar, not in your own zone. You also have NS records at your zone apex, and the two should match. When they drift apart, resolution can still work but audit tools flag it, and the mismatch can mask a real delegation problem:
; In the parent (.com) zone, published via your registrar:
example.com. 172800 IN NS ns1.example.com.
example.com. 172800 IN NS ns2.example.com.
; At your own zone apex, these should match:
example.com. 3600 IN NS ns1.example.com.
example.com. 3600 IN NS ns2.example.com.Glue: Solving the Chicken-and-Egg Problem
Look closely at the delegation above and a circular dependency appears. The nameservers for example.com are ns1.example.com and ns2.example.com, names inside the very domain they are supposed to serve. To find ns1.example.com, a resolver would need to ask the nameservers for example.com, but to reach those, it first needs the address of ns1.example.com. It cannot get there from here.
Glue records break the deadlock. A glue record is an A or AAAA record for your nameserver, published in the parent zone alongside the delegation, so the resolver receives the nameserver's IP address in the same response that tells it the nameserver's name. In a query to a TLD nameserver, glue appears in the ADDITIONAL section:
;; AUTHORITY SECTION:
example.com. 172800 IN NS ns1.example.com.
example.com. 172800 IN NS ns2.example.com.
;; ADDITIONAL SECTION:
ns1.example.com. 172800 IN A 203.0.113.1 <- glue
ns2.example.com. 172800 IN A 203.0.113.2 <- glueThose A records in the Additional section are the glue: bootstrap addresses that let a resolver contact your nameserver without needing to resolve its name first.
When Glue Is Required, and When It Must Not Exist
This is the part that trips people up, and it comes down to a concept called bailiwick.
In-bailiwick nameservers need glue. When your nameserver's hostname is inside the domain it serves (ns1.example.com serving example.com), glue is required. Without it, the circular dependency above makes your domain unreachable.
Out-of-bailiwick nameservers must not have glue. When you use a managed provider whose nameservers live in a different domain (say ns1.provider.net serving example.com), no glue is needed or wanted. The resolver simply looks up ns1.provider.net through provider.net normally. The TLD should not publish glue for a host it is not authoritative for, both because it is unnecessary and because accepting out-of-bailiwick additional data is a cache-poisoning risk that modern resolvers deliberately reject.
The practical takeaway: if you run nameservers inside your own domain, glue is critical and must be correct. If you use a managed DNS provider, glue is the provider's concern and not something you maintain. Knowing which case you are in is the first step to knowing what to monitor.
How to Inspect Your Delegation and Glue
You can check all of this directly. The key is to query a parent (TLD) nameserver, because glue lives in the parent, not your zone.
Ask a TLD server for your domain's NS records and look at the Additional section for the glue:
# Query a .com TLD nameserver directly for the delegation + glue
dig @a.gtld-servers.net example.com NS
# Compare with the NS records your own zone reports
dig example.com NS +short
# Check the addresses your nameservers actually have now
dig ns1.example.com A +shortWhat you are checking for: that the parent's NS records match your apex NS records, that glue addresses in the Additional section match the real current addresses of your nameservers, and that you do not have stale glue pointing at an address you no longer control.
What Can Go Wrong, and Why It Is Worth Monitoring
Delegation and glue fail in specific, high-impact ways, and because they live in the parent zone, they are easy to forget until something breaks.
Stale glue after an IP change. If you renumber a nameserver, change its IP, but forget to update the glue at the registrar, resolvers keep receiving the old address from the parent. The domain can become unreachable even though your own zone is perfect. This is one of the most common and most confusing glue failures.
Parent and child NS mismatch. When the NS records at the registrar drift from the NS records at your apex, resolution may still work but delegation is in an inconsistent state that hides problems and complicates troubleshooting. Keeping them aligned is basic hygiene that is easy to let slip.
Broken or lame delegation. If a nameserver listed in the delegation no longer answers authoritatively for the zone, resolution becomes unreliable, sometimes working, sometimes not, depending on which nameserver a resolver tries. These lame delegations are notoriously hard to notice because the domain appears to work much of the time.
Delegation to a nameserver you no longer control. If a delegation or its glue points at infrastructure you have given up, it becomes a takeover risk at the delegation level, conceptually similar to the dangling-record problem but one layer higher in the hierarchy. We cover the record-level version in our guide to dangling DNS and subdomain takeover.
The DNSSEC connection. Delegation also carries the DS record that links your zone into the DNSSEC chain of trust at the parent. A DS record that does not match your zone's keys breaks validation entirely, which is one of the delegation-level failures behind the DNSSEC problems we discuss in our DNSSEC guide.
What unites these is that they are all changes at the boundary of your domain, and they all cause outsized damage relative to how rarely anyone looks at them. That is precisely the profile of something worth watching continuously rather than checking manually once a year.
Where DNS Assistant Fits
Delegation and glue are part of the DNS surface that continuous monitoring is well suited to watch, because the failure mode is a change you did not expect, at a layer you rarely inspect. DNS Assistant monitors nameserver and delegation changes and surfaces them in real time, so an unexpected change to your NS records, or a delegation that stops behaving as it should, is something you hear about promptly rather than discovering through an outage. Its NS-delegation takeover detection specifically addresses the case where a delegation points at infrastructure that could be claimed by someone else.
As with the rest of the platform, it watches and alerts rather than making changes for you: the correction, updating glue at the registrar, realigning NS records, fixing a DS record, happens in your registrar and DNS provider, and DNS Assistant's job is to make sure you know a change happened in time to act on it.
Check Your Delegation
You can inspect a domain's nameservers and delegation with the free DNS lookup tool or a Free Domain Risk Report, a good way to confirm your current delegation looks the way you expect.
To be alerted when your nameservers or delegation change unexpectedly, start free at dnsassistant.com.
Start Monitoring Your DNS Today
Get real-time alerts, track record changes, and keep your domains secure with DNS Assistant.
Sign Up Free