DNS Hierarchy And Delegation

How parent zones hand off domains to authoritative nameservers, including glue and bailiwick.

NS Record

An NS record names a DNS server that is responsible for a domain or zone. This checker compares the NS records published by the parent zone with the NS records returned by the authoritative nameservers themselves.

Delegation

Delegation is the hand-off from a parent DNS zone to the nameservers responsible for a child domain. For example, the .com zone delegates example.com by publishing the nameservers that should answer for that domain.

Referral

A referral is a DNS response that points the resolver to another set of nameservers lower in the DNS hierarchy. For example, a TLD server can refer a resolver to the authoritative nameservers for a registered domain.

Parent Zone

The parent zone is the zone one level above the domain being checked. For example.com, the parent zone is com. The parent zone publishes the official delegation.

Child Zone

The child zone is the domain being checked. Its authoritative nameservers should return DNS records that agree with the parent delegation.

Authoritative Nameserver

An authoritative nameserver is responsible for holding and serving the official DNS records for a domain. It should answer directly for that domain rather than returning cached recursive data.

Nameserver Hostname

A nameserver hostname is the DNS name of a nameserver, such as ns1.example.com. The hostname often needs to resolve to one or more nameserver addresses before it can be queried.

Nameserver Address

A nameserver address is the IP address used to reach a nameserver. A single nameserver hostname may resolve to multiple IPv4 or IPv6 addresses.

Glue

Glue is an IP address for a nameserver supplied by the parent zone. It is essential when the nameserver lives inside the domain it serves, because resolvers need an address before they can ask that nameserver anything.

In-Bailiwick

A nameserver is in-bailiwick when its hostname is inside the domain it serves. For example, if the domain is example.com and one of its nameservers is ns1.example.com, that nameserver is in-bailiwick. In-bailiwick nameservers normally need parent glue so resolvers can find them.

Out-Of-Bailiwick

A nameserver is out-of-bailiwick when its hostname is outside the domain it serves. For example, if the domain is example.com but its nameserver is ns1.provider.net, that nameserver is out-of-bailiwick. These nameservers should resolve independently through their own DNS chain.

Lame Delegation

A lame delegation happens when the parent zone delegates a domain to a nameserver, but that nameserver does not answer authoritatively for the domain. This can cause lookups to fail or behave inconsistently.