Introduction

A child nameserver uses a hostname inside the same domain it serves, which means the parent zone needs glue records to tell resolvers where that nameserver actually lives. Without glue, resolvers can get stuck in a dependency loop: they need the nameserver IP to query the zone, but they need the zone to learn the nameserver IP. The fix is to publish the required host records at the registrar and make sure the delegation matches them exactly.

Symptoms

  • The domain fails to resolve after moving to nameservers like ns1.example.com
  • Registry or DNS validation tools report missing glue records
  • Some resolvers cannot reach the authoritative nameservers for the domain
  • Delegation checks show the child nameserver hostnames but no usable parent IPs
  • The issue started after creating custom nameservers or changing registrar settings

Common Causes

  • Host records for the child nameservers were never created at the registrar
  • The parent zone lists in-bailiwick nameservers, but their glue IPs are missing or wrong
  • Glue records exist for one nameserver but not the full delegation set
  • The child nameserver IP changed and the registrar host object was not updated
  • The authoritative zone and registrar delegation refer to different nameserver details

Step-by-Step Fix

  1. Identify whether the affected nameservers are in-bailiwick, meaning they live under the same domain they serve.
  2. Check the parent delegation and confirm whether glue IPs are published for each child nameserver hostname.
  3. Review the registrar's host record or child nameserver configuration and verify the correct IP addresses are registered there.
  4. Compare those registrar host records with the actual A or AAAA records served by the authoritative zone so they do not diverge.
  5. Create or update the missing glue entries only after confirming the target nameserver hosts are live and reachable on those IPs.
  6. Re-submit the nameserver delegation if necessary so the parent zone picks up the corrected glue data.
  7. Re-run public delegation traces and authoritative lookups until resolvers can consistently reach the child nameservers.
  8. If the zone uses both IPv4 and IPv6, verify that any published glue addresses are valid and intended for production use.
  9. Keep child nameserver IP changes tied to registrar host record updates so delegation does not silently break later.