Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to delegate to third party provider. Using BIND, in the zone file I set up six NS records like this:

test            IN      NS
test            IN      NS
test            IN      NS
test            IN      NS
test            IN      NS
test            IN      NS

They specifically ask for delegating like this. I then set up the glue records:

a.ns.test       IN      A       IP1
a.ns.test       IN      A       IP2
a.ns.test       IN      A       IP3
a.ns.test       IN      A       IP4
a.ns.test       IN      A       IP5
a.ns.test       IN      A       IP6

Now if I query for the A record of with dig I get a response with an AUTHORITY SECTION and ADDITIONAL SECTION, but no ANSWER SECTION. I assume this is by design, to avoid lame delegation problems, so that a resolver caches results from the authoritative servers. However, the third party will NOT turn on the service we want from them unless our servers return an A record.

How can I do that with BIND?

share|improve this question
up vote 3 down vote accepted

Records returned as glue are never authoritative and will never appear in the answer section. If the provider just wants to verify that the glue exists, they should see it in the additional section.

Whoever is running the nameservers will need to add the A or AAAA records in the zone since your delegating nameserver cannot.

BIND will automatically turn A records into glue when they are providing addresses for nameservers for zones you are delegating away. Once you set up a delegation as you have with, BIND will treat any A or AAAA records for hosts you're delegating to as glue only.

Here is a dig with the delegation removed:

; <<>> DiG 9.7.0-P1 <<>> +norecurse @0 a
;; flags: qr aa ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;     IN  A




;; Query time: 0 msec

It is answering authoritatively. Here is the same with only the delegation added (the first block in your question):

; <<>> DiG 9.7.0-P1 <<>> +norecurse @0 a
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 6

;     IN  A

;; AUTHORITY SECTION:   5   IN  NS   5   IN  NS   5   IN  NS   5   IN  NS   5   IN  NS   5   IN  NS

;; ADDITIONAL SECTION:  5   IN  A  5   IN  A  5   IN  A  5   IN  A  5   IN  A  5   IN  A

;; Query time: 0 msec

Notice the A records for a-f.ns.test are now glue. This is done automatically. Since you are delegating, the superordinate nameservers can no longer answer authoritatively for anything in They can, however, return the A records in the zone as glue since they are delegating to them.

share|improve this answer
This is my understanding as well. However, the people managing have a script to test delegation before setting up the zone file. As far as I can tell, this script tests for the A records with host, which does not return any since, the delegated zone is still not set up. So basically my question is if there is some hack to tell BIND te reply with an A record, even if it is not authoritative, or, worse yet, set the authoritative bit. I know I shouldn't do this, but anyone dealing with clueless external service providers will understand my frustration. – Prof. Moriarty Apr 12 '11 at 9:30
They should know that the authoritative records for belong in, not your zone. You can make it respond authoritatively by removing the delegation, but they might be checking for that, too. Better, they should fix their script to look for glue in the additional section where it belongs. :) – Cakemox Apr 12 '11 at 9:34
+1; sounds like their script is at fault. – nickgrim Apr 12 '11 at 11:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.