A delegation is lame when a nameserver listed for a zone cannot provide the expected authoritative service for that zone. Symptoms can be intermittent because one listed server works while another refuses the same query.
IN THIS ARTICLE
Gather the details you will need
Find the nameservers published by the parent delegation, not only those displayed inside a control panel. Record each server's addresses and confirm which organisation operates it. Use read-only queries while diagnosing the difference.
01 Diagnose a listed nameserver that does not serve the delegated zone
- Query every delegated server directly for the zone's SOA using non-recursive queries. Check the response status and authoritative-answer flag.
- Compare the results with a known record such as the apex A or MX. A timeout indicates a connectivity or server issue; REFUSED or a referral elsewhere can indicate the wrong zone or permissions.
- At a server you administer, confirm the zone is loaded, its configuration validates and it is available in the public DNS view. A zone configured only in an internal view will not serve outside resolvers.
- For a secondary server, investigate transfer permissions, source reachability and serial convergence. Never solve a transfer issue by allowing unrestricted public transfers.
- Correct the provider configuration or remove a genuinely retired server from the parent delegation as part of a documented transition. Keep the child zone's own NS records consistent.
02 Read-only diagnostic example
dig @ns1.example.net example.com SOA +norecurse
dig @ns2.example.net example.com SOA +norecurseReplace example names and documentation addresses with the exact authorised service details. These commands query existing configuration; they do not change DNS.
Verify the authoritative DNS result
Repeat queries against all delegated servers from an external network. Confirm they are authoritative and return the intended zone data. Recheck after delegation and record TTLs have elapsed.
If the problem continues
A successful query to one server does not clear the incident. Preserve the failing server address, query name/type, flags and timestamp. Escalate to the responsible DNS operator when you cannot change its zone configuration.
A common question
Can adding the missing website A record at the registrar fix a lame nameserver?
Only if that registrar is also the authoritative DNS operator and the actual issue is a missing record. A listed server that does not serve the zone needs a delegation or authoritative-service repair. Records in an unused DNS dashboard have no public effect.