Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hello I have just set up a DNS server for my domain with 2 name servers and I have attempted to set up a glue record for ns1 and ns2 at my registrar.

It seems to work for now when I do a dig but when I do a whois it lists and but not their IP address which should be set up as a glue record.

So I am wondering how do I check for the existence of a glue record? Do I do it with whois? I have seen .com and .net whois records that have both the domain name as well as the IP address for the name servers, is .org different? What's the proper way to test this?


share|improve this question

4 Answers 4

up vote 31 down vote accepted

Glue records only ever exist in the parent zone of a domain name.

Hence in the case of your domain name, first find the .org name servers:

% dig +short org. NS

Then, for as many of these as you feel like testing, explicitly ask those name servers for the NS records for your domain:

% dig +norec NS

You should get back the correct list of NS records in the "ANSWER SECTION". For any name servers that have correctly configured glue you should see those glue A (and/or AAAA) records appear in the "ADDITONAL SECTION".

share|improve this answer
Thanks a lot Alnitak that makes perfect sense! :) – Sunnz May 17 '10 at 12:09

To check if a GLUE record is setup:

dig +trace

If the GLUE is setup you should see a record that ends with:

“Recevied XXX bytes from x.GTLD-SERVERS.NET.”

There is also sites which will do it for you such as

share|improve this answer
Thanks, intodns worked great, getting all green ticks on the glue and NS stuff. I don't get the dig command though. I did get a Received message. In particular, I got this: "Received 433 bytes from in 183 ms." But then it ends with: "connection timed out; no servers could be reached" I also get similar messages when uses a random number for the ns part, e.g. – Sunnz May 16 '10 at 13:44
that dig diagnostic test is completely wrong... – Alnitak May 17 '10 at 10:25
I know this is old but very helpful. I piped the results into sed/awk to compare the root vs. nameserver to identify mismatched NS records. – jeffatrackaid Jun 12 '13 at 13:55

Here is a little shell script which implements Alnitak's answer:

for P in $1; do

echo "TLD: ${TLD}"
DNSLIST=$(dig +short ${TLD}. NS)
for DNS in ${DNSLIST}; do
  echo "Checking ${DNS}"
  dig +norec +nocomments +noquestion +nostats +nocmd @${DNS} $1 NS

Pass the name of the domain as parameter:

share|improve this answer

dig +trace is generally the most straightforward way to inspect the chain of delegations. However, glue records are in the additional section and by default trace output does not include the additional section. You will need to specify explicitly that you want this included in the output.

dig +trace +additional

If the idea is to check the sanity of the delegation chain you will probably want to see the authoritative NS records as well, in this case:

dig +trace +additional NS
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.