Delegation check

What the delegation check measures

A delegation is the parent zone handing a name to a set of nameservers, recorded in two places that must agree: the parent's NS records for the child, held at the registry, and the child zone's own. This tool reads both. The zone's set is asked of Cloudflare's 1.1.1.1. The parent's set is asked of the parent's own nameservers directly, up to three in turn when one does not answer, with recursion off, the only way to receive a referral rather than a resolver's opinion; the referral also carries the glue.

The parent is the nearest zone above the name: for a two-label domain its top-level zone, for example.co.jp the jp zone (co.jp is not a zone of its own), and for a top-level zone the root, so delegation ir is a valid question. The nameservers are then resolved to addresses through an ordinary lookup, which is a different thing from glue and labelled as such.

How to read the result

The banner says whether the zone and its parent name the same nameservers, or why no comparison was made: the zone's NS query unanswered, the parent's nameservers not found or unreachable, a timeout, a SERVFAIL from the parent. One outcome is a finding rather than a failure: the parent answering that it does not delegate this name at all, correct for an ordinary subdomain and the whole problem for a domain that should be live. A subzone whose parent runs on the same servers is recognised as delegated too: the parent then gives the subzone's NS directly in its answer.

Below are the two lists, then Glue in the parent's answer, then the nameservers' addresses from resolving their names. Glue is required only when a nameserver sits inside the zone it serves; if the parent should have given addresses and did not, the page says so, and such a zone is unreachable from a cold cache. A nameserver whose name resolves to no address is a real fault. The Full report goes further and asks each nameserver for the zone, naming those that answer REFUSED or NXDOMAIN for the zone, answer without authority, or have no address (lame) and those that could not be asked (unverified, which a firewall on the path can cause).

When it is useful

After a transfer to new nameservers, when the registrar says the change is done and the zone still resolves to the old addresses, or for some people only. A mismatch here stays quiet for months and then surfaces as random outages, because resolvers following the parent and those following the zone reach different servers.

When a nameserver was renamed or renumbered, to confirm the parent's glue follows. The NS record tool shows the zone's own view, WHOIS the registry's record of the nameservers, and the Full report the SOA serials across all of them.

Common questions

What is DNS delegation?

The parent zone's statement of which nameservers serve a child zone: NS records at the parent and, for in-zone nameservers, their addresses as glue. The child repeats the NS set in its own records, and the two must match.

What are glue records?

Addresses the parent includes in its referral for nameservers whose names are inside the zone being delegated; without them a resolver would have to ask the zone for the address of the server it needs to reach the zone. They are set at the registrar.

The zone and the parent disagree. Which one is wrong?

Whichever was not updated. After a hosting change the registrar's record is usually behind; after a provider renames its servers the zone may be ahead. Make both lists identical.

Why does it say the name is not delegated?

The parent was reached and hands this name to no nameserver. For www.example.com that is normal; for a domain that should be live it means the registry has no nameservers for it.