2

I have a few domains and want to resolve their DNS records with my own name server. Let's say I have a DNS server with 2 fixed IP addresses and a domain name mydnsservers.net.

I'd like to have 2 name server -subdomains- for my other domains.

  • ns1.mydnsservers.net > 81.250.18.12
  • ns2.mydnsservers.net > 81.250.18.13

Can I just use a third party DNS (e.g. AWS Route 53) for mydnsservers.net and setup two A-records like this?

ns1. A 81.250.18.12
ns2. A 81.250.18.13

Or is it mandatory to use my own DNS server for mydnsservers.net and configure GLUE records at the TLD registry?

I know that the first option works in some cases, but my new registry gives an error when trying to use ns1.mydnsservers.net for one of the domains because it's not registred as a nameserver (doesn't have glue records).

Any help would be much appreciated!

5
  • 3
    How could it possibly work without glue? Say I want to resolve ns1.mydnsservers.net. Telling me that I need to ask ns1.mydnsservers.net for the answer doesn't help me. I need an IP address, and without glue, the only way to get it is by asking the very same servers whose IP addresses I didn't know in the first place! Feb 27 '14 at 19:20
  • I won't be using ns1.mydnsservers.net as a nameserver for mydnsservers.net. Instead, ns1.mydnsservers.net will be resolvable through third party nameservers, not a GLUE record. It works but I guess that's not the ideal way to go?
    – Niels L
    Feb 27 '14 at 21:09
  • 1
    If ns1.mydnsservers.net is not a nameserver for the domain mydnsservers.net, then no glue is needed. If it is, then glue is needed. Feb 27 '14 at 21:20
  • We have a client with a domain example.com. That domain is using ns1.mydnsservers.net as one of the nameservers. The clients domain is resolvable because mydnsservers.net is pointing at an Amazon Route 53 nameserver, which knows what IP belongs to ns1 because of the A record there. So that way, ns1.mydnsservers.net is resolvable without a GLUE record.
    – Niels L
    Feb 27 '14 at 21:26
  • The IP from ns1.mydnsservers.net belongs to another DNS server that resolves example.com. So actually it has to do 2 lookups.. I guess, without GLUE.
    – Niels L
    Feb 27 '14 at 21:36
1

You need a GLUE record when the nameserver you wish to use for the domain is itself within the domain.

As ns1.mydnsservers.net is within mydnsservers.net, you need a GLUE record.

2
  • Thanks for your answer. What if you don't use GLUE and resolve ns1.mydnsservers.net externally through third party nameservers? See comments above
    – Niels L
    Feb 27 '14 at 22:17
  • " to use for the domain is itself within the domain. " that but other cases too, especially for .com+.net which are in fact in the same registry. Imagine example.com being delegated to ns1.example.net and example.net being delegated to ns1.example.com. Without some glues somewhere, this will never work. Of course this (loops) is also strongly discouraged. Yet it may happen. Mar 29 at 15:42
1

I think you are in part confused by the term "glue". There is no "glue" record type in the DNS, that kind of records do not exist. What we do reference there are purely A or AAAA records. They are called "glues" because they exist at the parent side of the DNS delegation, instead of at a child, where expected. They exist only to aid resolution, they are not authoritative. But without them, there would be a chicken and egg problem.

Let's go back to basics.

Say you want to have domain example.com served by nameservers ns1.example.com and ns2.example.com When you register domain names, through a registrar, you provide various administrative details and for the technical part you provide the domain name obviously and its list of nameservers. The registrar sends all that to the registry, and normally, DNS wise there is only a single thing appearing as consequence: the registry publishes in its authoritative nameservers some NS records that will tie your domain name to your nameservers by letting any resolver asking that there is a zone cut, that is the registry says, with those NS records: I know nothing more about example.com because this name is handled by such and such resolvers, hence go query them for additional details.

This is all fine, if your example.com domain was using ns1.provider.example and ns2.provider.example nameserver the delegation would work as is, and the resolver would then continue by first trying to find out the IP address for the name ns1.provider.example (or the other one) and then query that nameserver for further information.

But let us go back to our example which would mean the registry is publishing this:

example.com. NS ns1.example.com.
example.com. NS ns2.example.com.

which is to say for the registry it will reply: please go ask ns1.example.com for more information on domain name example.com, but to do so a resolver will then need to get the IP address of ns1.example.com and hence it is now in a loop with no exit as it goes back to first point to get information on example.com.

This is where glue records exist and they break the loop.

Because when you (through your registrar) will create nameserver ns1.example.com you will be forced to provide an IP address (one or more, IPv4 or IPv6 of course), and same for other one. Those IP addresses will be published by the registry because they are needed for the resolution to happen. Those records are called glue records, but they are normal A/AAAA records just sitting on registry authoritative nameservers.

Those records also need to exist on your nameservers (that is if you query directly ns1.example.com and ns2.example.com) so the same exact records (of course the IP addresses must match on both sides otherwise you create havoc, and it is a known and frequent source of problems) in fact exist on both side of the delegation cuts. They would normally exist only on the child (delegate) side, but they are needed on the parent for the resolution to work, and to discriminate, on the parent side they are called "glues".

Your registrar (not registry, you never interact directly with registries, registries customers are registrars not end clients, with some exceptions for some TLDs like .de) should be able to explain all of this to you. Its interface or API should be able to let you create nameservers with IP addresses when needed (the above is a summary there are various other edge cases, like when you change the name of a nameservers, which is allowed normally, or when you associate/dissociate those nameservers with existing domains), so that the registrar sends the appropriate content to the registry.

0

In certain situations you should be able to set the following at the registrar for example.com

nameserver 1: ns1.someotherdomain.com
nameserver 2: ns2.someotherdomain.com

Now at the DNS servers on ns1.someotherdomain.com and ns2.someotherdomain.com you can set:

example.com.    86400   IN   SOA    ns1.example.com.  root.example.com. 20140827151901 60 120 604800 3
@                       IN   NS     ns1.example.com.
@                       IN   NS     ns2.example.com.
ns1                     IN   A      127.0.0.8
ns2                     IN   A      127.0.0.9

The important thing is that there should be a glue record SOMEWHERE in the chain.

1
  • In the example you give there is no glues in fact. glues are at the parent side of the delegation. Mar 29 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.