A nameserver such as ns1.example.com can host example.com only when resolvers can find its address without first depending on the same unreachable zone. Parent-side glue provides that starting address for an in-domain nameserver.
IN THIS ARTICLE
Gather the details you will need
Distinguish registrar host or child-nameserver registration from an ordinary A/AAAA record in your DNS zone. Record the current domain delegation, registered host addresses and actual nameserver listeners. Confirm that you control every address being advertised.
01 Fix a private nameserver delegation that depends on missing glue
- Check the domain's referral from its parent zone. Identify whether the listed nameserver names fall inside the domain they serve and require glue.
- Query each intended nameserver directly by its IP address. Confirm it answers authoritatively for the domain over the required networks before publishing that address.
- Use the registrar's host-registration or private-nameserver function to register or correct the applicable glue. For a delegated subdomain, the parent-zone operator may supply this instead.
- Publish matching A/AAAA records for the nameserver hostname in its own authoritative zone. Keep the parent glue and authoritative address data consistent.
- Retest the complete delegation from an independent resolver. Keep old working nameserver addresses active during a planned address transition until cached data has expired.
02 Example: investigate missing glue for an in-domain nameserver
Assume example.com is delegated to ns1.example.com, which is inside the very domain it must answer for. Use dig from a DNS-capable workstation to inspect the parent referral and the nameserver host record. Substitute your actual names.
dig +trace example.com NS
dig ns1.example.com A +noall +answer
dig ns1.example.com AAAA +noall +answerRead the result: The parent delegation needs usable glue for an in-domain nameserver to avoid a circular dependency. A correct A record inside the child zone is not enough if resolvers cannot reach that zone to discover it. Compare the registrar's child-host registration with the addresses actually serving DNS.
Update glue through the registrar's supported host-management workflow, then keep the child-zone address records consistent. Verify every listed nameserver answers authoritatively before relying on the delegation. A nameserver hostname with no functioning DNS daemon remains broken even when its glue exists.
Verify the authoritative DNS result
A trace should reach an authoritative server without a circular lookup failure. Check all listed nameservers, not only the first. Confirm both UDP and TCP DNS work on the addresses you publish.
If the problem continues
If your registrar rejects the host update, check its allowed host object, IP family and ownership requirements. Adding another random NS record or only changing the zone's A record will not update a separate parent host object.
A common question
Are the A record for ns1.example.com and its glue entry the same database record?
Not necessarily. The authoritative zone record and parent-side referral data have different roles and can be stored by different operators. A nameserver address move may require updating both, with a controlled overlap period.