TL;DR: When the primary hosted zone contains two NS records, containing the name servers for the primary hosted zone (example.com) and the subdomain hosted zone (sub.example.com) would that be sufficient to get sub.domain.com resolved going over the nameserver of example.com?


Domains are currently managed by name.com but DNS should be managed by AWS Route 53 in order to automate creation of new sub-domains and set up records dynamically.

The domain ownership should stay with name.com which means a custom name server needs to be configured for the domain example.com

Subdomains like sub.example.com should be resolved through the name server of example.com as well, otherwise adding a new subdomain would require to configure a custom name server on name.com.

In the current setup, each domain and sub-domain is in its own hosted zone. example.com has a NS record and sub.example.com has one, too. Now to delegate I have added another NS record in example.com for sub.example.com containing the name servers of sub.example.com

So two NS records in the hosted zone example.com. Yet when I run

dig @ns-of-example.com sub.example.com

I don't get an answer section, though authority section containing the right nameservers. I would have assumed dig does a recursion and then asks the authoritive nameservers listed there.

But I assume I have a flaw in my logic how the DNS protocol works here.

  • Provide the true name involved, without obfuscations. As for the DNS protocol, yes, you seem a little off. Typically each zone is served by two authoritative nameservers. "Subdomains" can be just records in the zone and do not need always to be delegated to other nameservers, it all depends on what you want to achieve really but your question is not clear enough and your obfuscation makes it hard to help you. – Patrick Mevzek Nov 23 '17 at 4:22
up vote 1 down vote accepted

I don't get an answer section, though authority section containing the right nameservers.

Then you should be good. By default, dig only asks the server you told it to ask, and shows you the answer from that server.

I would have assumed dig does a recursion and then asks the authoritive nameservers listed there.

That's an incorrect assumption. If you want a recursive lookup that is a fully valid test of how the domain behaves on the Internet, you need to ask a public recursive resolver to do it for you, e.g. dig @8.8.8.8 my-sub.example.com.

Otherwise, you can get the behavior you want it you use dig ... +trace but be aware that there are circumstances where this can give you a false sense of success, because it's not doing a lookup using a recursive resolver -- which is how normal machines will do their lookups.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.