What is a DNS glue record?

Glue supplies name-server addresses in a parent-zone referral so a resolver can reach a delegated zone without a circular dependency.

Guance Editorial Team 2026-10-27 3 min read Updated 2026-10-27

Best practices

A glue record supplies an A or AAAA address for a name server in a parent zone's referral. It is especially important when the server's name lies inside the zone being delegated: the resolver needs an address before it can ask that server for the zone's records.

See the dependency

Suppose example.com is delegated to ns1.example.com:

The resolver asks the parent for example.com.
The parent identifies ns1.example.com as an authoritative server.
To reach ns1.example.com, the resolver needs its address.
That address normally belongs to the example.com zone itself.

Without a bootstrap address, the resolver faces a circular dependency. The parent supplies glue so it can contact the child server. The child zone should also publish the server's authoritative A/AAAA records; parent glue and child address records serve different roles.

Determine who maintains it

Delegation	Typical responsibility
`example.com` uses `ns1.example.com`	Register the in-domain server address with the parent, usually through the registrar/registry.
`example.com` uses an external provider's nameservers	The provider normally maintains the necessary dependencies for its own nameserver domain.
A zone you manage delegates a child to names inside that child	The administrator of your parent zone maintains the delegation and glue.

Glue is not exclusively a registrar feature. Registrars are the usual management channel for registered-domain delegations; ordinary subdomain delegations are maintained in their parent zones. External names can also have cross-domain dependencies, so an out-of-domain server name alone is not proof that every dependency is safe.

Configure an in-domain nameserver

In a registrar's interface, look for registered nameservers, host objects, or host records. For example:

ns1.example.com -> 203.0.113.8
ns2.example.com -> 203.0.113.9

These documentation addresses are placeholders. Register the actual reachable addresses, change the domain's delegation to the intended nameservers, and publish matching address records in the child zone. Include IPv6 glue only when the nameserver is reliably reachable at that IPv6 address and the parent supports registration of it.

Adding only an A record inside the child zone does not solve the initial dependency. Conversely, updating parent glue does not automatically update the child's authoritative A/AAAA data.

Verify parent and child independently

dig +trace www.example.com

Use the trace to identify the parent-zone server. Then query that server directly for the child NS delegation with recursion disabled and inspect the referral, including its additional addresses. Query each child server at its IP to verify the authoritative zone and nameserver address records.

A referral may need TCP if the available glue does not fit a UDP answer. RFC 9471 defines requirements for including in-domain glue and marking truncated responses; a partial-looking UDP reply should be checked accordingly.

Plan address changes around caches

When moving an authoritative server, update both parent glue and child address records. Preserve service on the old address during the transition where possible. Publication delay, the parent TTL, and recursive caches affect how quickly clients move; there is no universal propagation time.

If you use managed DNS with external nameservers, those host registrations are normally the provider's responsibility. You still need to keep your own delegation correct.

Guance HTTP synthetic tests can show whether the application remains reachable from selected locations. A successful request may use cached data or another nameserver, so it does not replace direct parent/child checks.