Is it required to register a name server with GLUE records?

Question

I have a few domains and want to resolve their DNS records with my own name server. Let's say I have a DNS server with 2 fixed IP addresses and a domain name mydnsservers.net.

I'd like to have 2 name server -subdomains- for my other domains.

• ns1.mydnsservers.net > 81.250.18.12
• ns2.mydnsservers.net > 81.250.18.13

Can I just use a third party DNS (e.g. AWS Route 53) for mydnsservers.net and setup two A-records like this?

ns1. A 81.250.18.12
ns2. A 81.250.18.13

Or is it mandatory to use my own DNS server for mydnsservers.net and configure GLUE records at the TLD registry?

I know that the first option works in some cases, but my new registry gives an error when trying to use ns1.mydnsservers.net for one of the domains because it's not registred as a nameserver (doesn't have glue records).

Any help would be much appreciated!

Answer 1

I think you are in part confused by the term "glue". There is no "glue" record type in the DNS, that kind of records do not exist. What we do reference there are purely A or AAAA records. They are called "glues" because they exist at the parent side of the DNS delegation, instead of at a child, where expected. They exist only to aid resolution, they are not authoritative. But without them, there would be a chicken and egg problem.

Let's go back to basics.

Say you want to have domain example.com served by nameservers ns1.example.com and ns2.example.com When you register domain names, through a registrar, you provide various administrative details and for the technical part you provide the domain name obviously and its list of nameservers. The registrar sends all that to the registry, and normally, DNS wise there is only a single thing appearing as consequence: the registry publishes in its authoritative nameservers some NS records that will tie your domain name to your nameservers by letting any resolver asking that there is a zone cut, that is the registry says, with those NS records: I know nothing more about example.com because this name is handled by such and such resolvers, hence go query them for additional details.

This is all fine, if your example.com domain was using ns1.provider.example and ns2.provider.example nameserver the delegation would work as is, and the resolver would then continue by first trying to find out the IP address for the name ns1.provider.example (or the other one) and then query that nameserver for further information.

But let us go back to our example which would mean the registry is publishing this:

example.com. NS ns1.example.com.
example.com. NS ns2.example.com.

which is to say for the registry it will reply: please go ask ns1.example.com for more information on domain name example.com, but to do so a resolver will then need to get the IP address of ns1.example.com and hence it is now in a loop with no exit as it goes back to first point to get information on example.com.

This is where glue records exist and they break the loop.

Because when you (through your registrar) will create nameserver ns1.example.com you will be forced to provide an IP address (one or more, IPv4 or IPv6 of course), and same for other one. Those IP addresses will be published by the registry because they are needed for the resolution to happen. Those records are called glue records, but they are normal A/AAAA records just sitting on registry authoritative nameservers.

Those records also need to exist on your nameservers (that is if you query directly ns1.example.com and ns2.example.com) so the same exact records (of course the IP addresses must match on both sides otherwise you create havoc, and it is a known and frequent source of problems) in fact exist on both side of the delegation cuts. They would normally exist only on the child (delegate) side, but they are needed on the parent for the resolution to work, and to discriminate, on the parent side they are called "glues".

Your registrar (not registry, you never interact directly with registries, registries customers are registrars not end clients, with some exceptions for some TLDs like .de) should be able to explain all of this to you. Its interface or API should be able to let you create nameservers with IP addresses when needed (the above is a summary there are various other edge cases, like when you change the name of a nameservers, which is allowed normally, or when you associate/dissociate those nameservers with existing domains), so that the registrar sends the appropriate content to the registry.

Answer 2

You need a GLUE record when the nameserver you wish to use for the domain is itself within the domain.

As ns1.mydnsservers.net is within mydnsservers.net, you need a GLUE record.

Answer 3

In certain situations you should be able to set the following at the registrar for example.com

nameserver 1: ns1.someotherdomain.com
nameserver 2: ns2.someotherdomain.com

Now at the DNS servers on ns1.someotherdomain.com and ns2.someotherdomain.com you can set:

example.com.    86400   IN   SOA    ns1.example.com.  root.example.com. 20140827151901 60 120 604800 3
@                       IN   NS     ns1.example.com.
@                       IN   NS     ns2.example.com.
ns1                     IN   A      127.0.0.8
ns2                     IN   A      127.0.0.9

The important thing is that there should be a glue record SOMEWHERE in the chain.