@ is a simply "origin". It is used where domain name syntactically should go, but that name is the same as origin set. I.e. in the BIND config you said zone "domain.com"
, then the origin is domain.com
(until re-set by $ORIGIN directive in the zone file) and @ NS ns
is same as domain.com. NS ns.domain.com.
. Note, any record without trailing dot gets an origin automatically appended, but to exploit this feature you had to leave "empty name" for NS record, which means other things (for this case think incorrect syntax). Thus the symbol @ was invented.
This means, it has nothing to do with glue records or delegation records specifically. You may even opt to not use it at all anywhere, you may well write everything explicitly. Like this: if you want to make A record, you may use @ for that, like @ A 192.0.2.1
, but you may also don't use it and write as domain.com. A 192.0.2.1
(provided origin is still domain.com
).
Read http://www.zytrax.com/books/dns/apa/origin.html
Glue is needed when the subdomain has DNS server name inside its zone. Let's delegate sub.example.com
to ns.sub.example.com
which has address 192.0.2.2
. For this to work, we need to resolve that ns.sub.example.com
A record beforehand, but who should answer the query? The server where we delegate a zone couldn't, because we still don't know its address until we resolved this query. This chiken-and-egg problem is solved by the glue record: the delegating server will store a ns.sub.example.com A 192.0.2.2
record. Then, we can also use a nameserver delegation record, sub.example.com. NS ns.sub.example.com.
.
Or, if your origin is example.com
, that would be ns.sub A 192.0.2.2
- glue and sub NS ns.sub
- delegation. The @ symbol isn't used here, because we don't meet "empty name" anywhere.
Or, you can set $ORIGIN sub.example.com
and then @ would have to be used: our records will be written as ns A 192.0.2.2
and @ NS ns
.
Note, that despite the fact I suggested three ways to express this delegation with glue record, all three cases express the exactly same information and will work the same. It just syntactical difference, not principal.
If you delegate the zone to the server not having its name inside that zone, glue is not needed. For example, if sub.example.com
is being delegated to the ns.example.org
, then a single sub.example.com. NS ns.example.org.
is needed, because ns.example.org
's address will be resolved other way.
And a remark. The fact DNS registrars require you to specify at least two DNS servers doesn't mean you have to also require multiple DNS servers. It doesn't improve anything if you specify the same server twice. For your particular case one glue and one delegation record will suffice.