I have a domain like example.com which I have from google domains. I created 2 nameservers and called them dns1.example.com and dns2.example.com. i finished their configuration and opened port 53 on them (22 was already open). I then added them as glue records in google domain dns settings page. Now is there a way to test the glue records before switching the nameservers? What I tried is to ssh into the machine using the address dns1.example.com. but that does not work, it is not able to resolve the host. Ssh with IP address works. Why is the glue record not able to resolve the host?

I tested it with the command:

dig @dns1.example.com example.com

I get the error:

dig: couldn't get address for 'dns1.example.com': failure

If I do

dig +norec @h.gtld-servers.net. example.com NS

I do get the nameservers listed with the correct IP addresses in the ADDITIONAL SECTION.

Why is not able to get address for dns1.example.com?


A glue record for dns1.example.com will not be used in normal name resolution.

You test by digging for the NS RRs for the domain and the glue records will appear in the "ADDITIONAL SECTION" of the response. For example:

$ dig NS google.com @g.gtld-servers.net
; <<>> DiG 9.10.3-P4-Ubuntu <<>> NS google.com @g.gtld-servers.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7732
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 9
;; WARNING: recursion requested but not available

; EDNS: version: 0, flags:; udp: 4096
;google.com.            IN  NS

google.com.     172800  IN  NS  ns2.google.com.
google.com.     172800  IN  NS  ns1.google.com.
google.com.     172800  IN  NS  ns3.google.com.
google.com.     172800  IN  NS  ns4.google.com.

ns2.google.com.     172800  IN  AAAA    2001:4860:4802:34::a
ns2.google.com.     172800  IN  A
ns1.google.com.     172800  IN  AAAA    2001:4860:4802:32::a
ns1.google.com.     172800  IN  A
ns3.google.com.     172800  IN  AAAA    2001:4860:4802:36::a
ns3.google.com.     172800  IN  A
ns4.google.com.     172800  IN  AAAA    2001:4860:4802:38::a
ns4.google.com.     172800  IN  A
| improve this answer | |
  • Do we need to switch the nameservers for this to show up? – Milind Mar 29 '19 at 1:06
  • Yes, you will need to switch nameservers first. The glue records don't exist in example.com. They exist in .com (and gtld?) name servers. – Mark Wagner Mar 29 '19 at 16:01
  • To answer: "Why is not able to get address for dns1.example.com?" Glue records do not appear in the ANSWER section, ever. (Also, they do not belong to the authoritative zone data.) You will need to add an A record for dns1.example.com in the normal configuration of the zone. – Mark Wagner Mar 29 '19 at 16:09
  • @MarkWagner glue records do exist in any TLD, this is not specific to any single TLD, it is how to break the DNS resolution problem if your domain is using only in-bailiwick nameservers. – Patrick Mevzek Apr 4 '19 at 23:15
  • @PatrickMevzek I said glue records exist in com nameservers for example.com (and thus likewise for any other TLDs). Alas by GTLD in my comment I meant root nameservers since I received glue for google.com nameservers from the root nameservers I checked. I don't understand the point you are trying to make. – Mark Wagner Apr 5 '19 at 15:56

An online checking tool such as Zonemaster is able to test a non delegated zone. You specify the zone and the nameservers you wish to test, including with their IPs if needed, which is exactly your case.

Go try it at https://zonemaster.net/pre_delegated_domain_check

As for

Why is not able to get address for dns1.example.com?

this is because glue records are inserted only if needed.

Let us imagine example.com is served for now by dns1.example.org and dns2.example.org. There is no glue records in .com authoritative nameserfvers because your domain does not use in-bailiwick nameservers. If you have a dns1.example.com entry, you should get a result for it if your query either dns1.example.org or dns2.example.org but not if you query any of the .com authoritative nameservers

Now, as soon as you change your authoritative nameservers, and example.com becomes handled by dns1.example.com and dns2.example.com, then and only then the authoritative nameservers for .com will start supplying a glue for the two names because otherwise resolution would never happen properly. But before you switch nameservers the glue is not needed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.