Understanding Glue Records and Dedicated DNS

Domain Name System (DNS) resolution is an iterative process in which a recursive resolver attempts to look up a domain name using a hierarchical resolution chain. First, the recursive resolver queries the root (.), which provides the nameservers for the top-level domain (TLD), egcom. Next, we query the TLD nameservers that provide the authoritative nameservers for the domain. Finally, the recursive resolver queries the appropriate authoritative name servers.

In many cases, you will see domains delegated to nameservers within their own domain (e.g. “example.com”). Delegated to “ns01.example.com”. In these cases, a glue record is needed at the parent nameserver (usually your domain registrar) to continue the verification chain.

What is a glue record?

Glue records are DNS records created by your domain registrar. These records provide a complete answer when your nameserver returns a reference to the authoritative nameserver for your domain. For example, the domain name “example.com” has nameservers “ns01.example.com” and “ns02.example.com”. To resolve a domain name, DNS queries the root, then the TLD name servers, then the authoritative name servers, in that order.

If a domain’s name servers are within the domain itself, a circular reference is created. Having a glue record in the parent zone prevents circular references and enables DNS resolution.

Glue records may be created in the TLD through your domain registrar, or from the name servers in the parent zone if the subdomain is delegated.

When do you need glue records?

Every self-authoritative nameserver requires a glue record. If a third party, such as a managed DNS provider, hosts the DNS for your zone, no glue records are required.

IBM NS1 Connect dedicated DNS name servers require glue records.

IBM NS1 Connect requires customers to use a separate domain for dedicated DNS name servers. Therefore, name servers within this domain require glue records. Here you can see a glue record of exampledns.net configured in Google Domains using a random IP address.

Once the glue record is added to the registrar, the dedicated DNS domain must be delegated to the IBM NS1 Connect managed name servers and dedicated DNS name servers. For most customers, their domain delegation will have a total of 8 NS records.

What does a glue record look like in an excavation tool?

Glue records appear in additional sections of the response. To view glue records for a domain using the dig tool, query the TLD nameservers directly for the domain’s NS records. The glue record in this example is in quotes. Below we use quotation marks for emphasis.

How do I know my glue record is correct?

To ensure that your glue records are correctly listed in your TLD nameservers, use the dig tool shown above to directly query the TLD nameservers for your domain’s NS records. Compare the ADDITIONAL SECTION contents of the response with the expected values ​​entered as NS records in IBM NS1 Connect.

Learn more about Dedicated DNS