What Is a Glue Record? The Hidden Link That Makes DNS Delegation Work
CodexFuse Team · 2026-11-04T11:27:55.896Z · 12 min read min read
A glue record is the bootstrap address a parent DNS zone publishes for in-zone nameservers — breaking the chicken-and-egg problem of DNS delegation. RFC-sourced definitions, how to read glue in the Additional section with dig, and when you actually need it.
A glue record — the answer to the beginner's question "what is a glue record?" — is an A or AAAA address record that a parent DNS zone publishes for a nameserver whose hostname lives inside the domain it serves: the bootstrap address that breaks the chicken-and-egg problem of DNS delegation. When you point example.com at ns1.example.com, a resolver cannot find ns1.example.com's address by asking ns1.example.com itself; it needs the answer handed to it first. That answer is the glue record. If you have ever wondered how a DNS lookup can find a domain whose nameservers are inside that same domain, glue is the reason — and you can watch a referral happen live with our DNS lookup tool.
What Is a Glue Record?
A glue record is an address record — an A record for IPv4, or an AAAA record for IPv6 — that accompanies a delegation in the parent zone so a resolver can reach the child zone's nameservers. It is not ordinary zone content. It exists for one reason: a resolver that receives a referral to a nameserver must be able to contact that server, and when the server's name is inside the delegated zone itself, there is no other way to learn its address.
Geoff Huston described the mechanism on the APNIC blog in 2021 in plain terms: the parent zone contains non-authoritative records for the names of the nameservers of the delegated domain and provides these names in referral responses as glue records, contained in the "Additional" section of a DNS response. The DNS community even has a nickname for the situation glue prevents: the SIDN registry's glossary calls it the "chicken-and-egg problem" — "without a glue record, it would not be possible to initially locate a name server to ask it for information about itself and the domains it serves."
Why Does DNS Need Glue Records? The Chicken-and-Egg Problem
DNS needs glue records because a nameserver that lives inside the zone it serves creates a circular dependency: you cannot ask it for addresses until you already know its address. Imagine you delegate example.com to two nameservers, ns1.example.com and ns2.example.com. A resolver asking the .com servers for example.com receives a referral: "ask ns1.example.com." But where is ns1.example.com? To find out, the resolver would have to resolve a name inside example.com — which requires asking ns1.example.com, the very server whose address it does not have. The lookup deadlocks.
RFC 1034, the original DNS specification from November 1987, describes this exact trap and its fix:
"The NS RRs that name the servers for subzones are often not enough for this task since they name the servers, but do not give their addresses. In particular, if the name of the name server is itself in the subzone, we could be faced with the situation where the NS RRs tell us that in order to learn a name server's address, we should contact the server using the address we wish to learn. To fix this problem, a zone contains "glue" RRs which are not part of the authoritative data, and are address RRs for the servers. These RRs are only necessary if the name server's name is "below" the cut, and are only used as part of a referral response."
"Below the cut" means inside the delegated zone. When your nameservers sit at the registry or at a provider — say hera.ns.cloudflare.com serving example.com — no circular dependency exists, because those hostnames resolve through a completely different branch of the DNS tree. Glue is the escape hatch reserved for the in-zone case.
Where Do Glue Records Live? The Parent Zone, Not Your Zone File
Glue records live in the parent (delegating) zone, and you create them through your domain registrar — never by editing your own zone file. This is the single most misunderstood fact about glue. Adding an A record for ns1.example.com inside example.com's own zone does nothing for the bootstrap problem, because the resolver cannot reach your zone in the first place without the glue.
RFC 1033, the classic Domain Administrators Operations Guide, states the rule exactly:
"If the name server host for a particular domain is itself inside the domain, then a 'glue' record will be needed. A glue record is an A (address) RR that specifies the address of the server. Glue records are only needed in the server delegating the domain, not in the domain itself."
RFC 1034's administrative guidance makes the same point as an installation step: "As the last installation step, the delegation NS RRs and glue RRs necessary to make the delegation effective should be added to the parent zone." For a .com domain, "the parent zone" means the registry-operated .com servers; your registrar is the channel that writes to them.
The practical chain works like this. You enter your nameserver hostnames and their IP addresses in your registrar's control panel — Namecheap calls the feature "personal nameservers" and explains that "personal DNS for your domain name is created by means of glue records that associate an IP address of a DNS server with a personal nameserver. You can input the nameserver name and IP address in your account, and this information will be submitted to the Registry." DNSimple notes that registrars label the same feature differently — "glue records," "host records," or "child name servers" — but whatever the label, "the registrar sends the addresses to the registry, and the registry publishes them in the TLD zone, where every resolver can see them." If you run your own nameservers on infrastructure you control, such as a VPS, this registrar step is what makes your delegation effective worldwide. Delegations are how subdomains get carved off to their own zones too — our subdomain finder guide covers how NS records steer resolution between them.
How to Read Glue in a DNS Referral: The Additional Section
Glue records travel in the Additional section of a referral response, sitting right below the Authority section's NS records. The referral algorithm in RFC 1034 §4.3.2 is explicit about the assembly: "Copy the NS RRs for the subzone into the authority section of the reply. Put whatever addresses are available into the additional section, using glue RRs if the addresses are not available from authoritative data or the cache."
You can watch this yourself with dig. Asking a TLD server directly, without recursion, returns the referral instead of the final answer (the +[no]additional flag, verified present in DiG 9.18.39 this run, controls whether the Additional section displays):
dig example.com NS +norec +additional @a.gtld-servers.net
A referral that needs glue looks like the packet published in RFC 9471 §2.1 — shown here verbatim from the RFC, with the documentation addresses the RFC itself uses, not a live capture:
;; QUESTION SECTION: ;www.foo.test. IN A ;; AUTHORITY SECTION: foo.test. 86400 IN NS ns1.foo.test. foo.test. 86400 IN NS ns2.foo.test. ;; ADDITIONAL SECTION: ns1.foo.test. 86400 IN A 192.0.2.1 ns2.foo.test. 86400 IN AAAA 2001:db8::2:2
The Authority section names the servers; the Additional section carries their addresses — that is the glue. Note that "additional records" is not a synonym for glue, as LogicMonitor points out: "Glue records are A and AAAA address records that the parent zone supplies for your delegated nameservers, per RFC 9471. They show up in the Additional section of a referral, though the Additional section can carry other records too." Real-world contrast: a DNS-over-HTTPS query for example.com this run returned NS records hera.ns.cloudflare.com and elliott.ns.cloudflare.com with no Additional section at all, because both hostnames live outside example.com — a TLD referral for them carries no glue, and needs none.
When Do You Actually Need a Glue Record?
You need a glue record only when your nameserver's hostname is inside the zone it serves. If your nameservers live elsewhere — at your registrar, your DNS provider, or another domain you own — you need none. IBM states it in one line: "Glue records are needed for any nameserver that is authoritative for itself. If a 3rd party, such as a managed DNS provider hosts the DNS for a zone, no glue records are needed."
| Your nameservers | Example | Glue needed? |
|---|---|---|
| Hostnames inside your own zone | example.com delegated to ns1.example.com | Yes — circular dependency without it |
| Hostnames in another domain you own | example.com delegated to ns1.example.net | No — example.net resolves independently |
| Your DNS provider's hostnames | example.com delegated to hera.ns.cloudflare.com | No — out-of-zone nameservers |
| Your registrar's default nameservers | example.com delegated to dns1.registrar.com | No — nothing inside your zone |
Run this four-step check before you touch anything:
- List the nameservers your domain is delegated to (ask your registrar or query the TLD with dig as shown above).
- Check whether each nameserver hostname ends with your own domain name.
- If any hostname is inside your zone, register glue records for it at your registrar — server name plus IP, submitted to the registry.
- If every hostname is out-of-zone, stop: there is nothing to register and no glue to maintain.
Glue Records vs NS Records: What's the Difference?
An NS record only names the authoritative server; a glue record is the A or AAAA address data for that server, served from the parent zone so the resolver can bootstrap contact. DNSimple draws the line cleanly: "NS records at the parent state which hosts are authoritative for the child zone. When those hosts are out-of-zone, the resolver can resolve them without glue from the parent. When they are in-zone, glue at the parent carries the bootstrap addresses."
| NS record | Glue record | |
|---|---|---|
| Answers | Who is authoritative? (a hostname) | Where is that server? (an IP address) |
| Record type | NS | A or AAAA |
| Lives in | Parent zone's delegation (always) | Parent zone's delegation (only when the nameserver is in-zone) |
| Authoritative data? | Yes — part of the delegation | No — extra data, used only in referral responses |
What Happens When Glue Goes Wrong
Bad glue breaks or misroutes your domain in three distinct ways, and each has a different fix. First, missing glue: when in-bailiwick nameservers have no glue at the parent, resolvers simply cannot bootstrap the lookup. RFC 9471, the 2023 update to the delegation rules, is blunt: "In-domain glue records, however, are not optional." Its missing-glue section notes that "while not common, real examples of responses that lack required glue, and with TC=0, have been shown to occur and cause resolution failures." The fix is to register the glue at your registrar.
Second, stale glue: delegation data lives in the parent zone while your zone data lives with you, "two separate sources, maintained through two separate channels, and they can disagree. When they do, resolvers follow the parent, not the child." So if you move ns1.example.com to a new IP and update your zone but forget the registrar, resolvers keep hammering the old address from the parent's glue. The fix is to update glue at the registrar every time a nameserver IP changes.
Third, lame delegation, which is a different failure wearing a similar disguise: the delegation names a server that does not actually serve your zone. As the cc.la blog puts it, "a delegation is lame when one of those named servers does not serve the zone it was delegated" — "the pointer is fine and the server is reachable. The server simply is not the authority it claims to be." Glue cannot help there; the fix is to correct the NS set itself.
How to Create Glue Records for Your Domain
Create glue records at your domain registrar, usually under "personal nameservers," "private nameservers," "child nameservers," or "host records" — the registrar submits them to the registry, which publishes them in the TLD zone. Enter the nameserver hostname (ns1.yourdomain.com) and its IP address (IPv4, and IPv6 if your server has one); the registry then attaches those addresses to every referral for your domain. Changes propagate as the TLD zone updates and TTLs expire — this is one delegation setting you cannot rush by lowering your own zone's TTL, because the TTL on glue comes from the parent. And if you are running your own authoritative nameservers on a rented machine, make sure the underlying server is solid first — our VPS hosting guide covers what that infrastructure looks like.
Sources
- RFC 1034 — Domain Names: Concepts and Facilities (P. Mockapetris, STD 13, Nov 1987), rfc-editor.org/rfc/rfc1034.txt — fetched 2026-11-04
- RFC 1033 — Domain Administrators Operations Guide, rfc-editor.org/info/rfc1033/ — fetched 2026-11-04
- RFC 9471 — DNS Glue Requirements in Referral Responses (Sept 2023), rfc-editor.org/rfc/rfc9471.txt — fetched 2026-11-04
- "What Are Glue Records?" — DNSimple Help (updated 2026-10-26), support.dnsimple.com — fetched 2026-11-04
- "Stale DNS Glue Records" — LogicMonitor Blog (published 2026-09-09), logicmonitor.com — fetched 2026-11-04
- "Glue Records" — IBM Think Topics, ibm.com/think/topics — fetched 2026-11-04
- "How do I register personal nameservers for my domain?" — Namecheap Help, namecheap.com — fetched 2026-11-04
- SIDN Registry Glossary — "Glue record", sidn.nl/en/definitions — fetched 2026-11-04
- "Lame Delegation, Explained" — cc.la Blog (published 2026-10-30) — fetched 2026-11-04
- "DNS talk @ IETF 111" — Geoff Huston, APNIC Blog (2021), blog.apnic.net — fetched 2026-11-04
- "How to Do a DNS Lookup" — CodexFuse Blog (the site's DNS pillar)
- "What Is VPS Hosting?" — CodexFuse Blog (the infrastructure pillar)
- "Subdomain Finder: How to Find All Subdomains of Any Domain" — CodexFuse Blog
Frequently Asked Questions
What is a glue record in simple terms?
A glue record is the IP address of a nameserver, published by the parent zone (like .com) alongside the delegation, so resolvers can find a nameserver that lives inside the very domain it serves. Without it, the resolver would need to ask the server for its own address — the chicken-and-egg problem.
Are glue records in my zone file?
No. Glue records live only in the delegating (parent) zone — for a .com domain, that means the registry-operated .com servers — and you manage them through your registrar. They are not part of your zone's authoritative data and are only used inside referral responses.
Do I need glue records for my domain?
Only if your nameservers' hostnames are inside your own domain (for example, example.com using ns1.example.com). If you use your registrar's nameservers, a managed DNS provider, or nameservers under a different domain, you need no glue records at all.
What is the Additional section in a DNS response?
The Additional section is the part of a DNS response that carries extra records helpful for following up on the answer — in a referral, it carries the glue A/AAAA records for the nameservers named in the Authority section. You can view it with dig +additional.
What is the difference between missing glue and lame delegation?
Missing glue means the parent zone never published the nameserver addresses, so resolvers cannot bootstrap the lookup at all. Lame delegation means the addresses are fine and the server is reachable, but the named server does not actually serve your zone. Missing glue is fixed at the registrar; lame delegation is fixed by correcting your NS records.
