Network & Infrastructure / DNS, DNSSEC & Service Discovery
Broken delegation glue despite correct child-zone records
A domain answers from its own authoritative servers when queried directly, but normal recursive resolution fails. The parent delegation may point at unreachable or outdated server addresses.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Compare parent NS records and glue with child-zone NS and address records. Test reachability to every delegated authoritative server using the exact addresses resolvers receive from the parent.
Explain the result
Authoritative zone correctness does not repair a broken path to discover that zone. In-bailiwick nameservers can require parent glue to bootstrap resolution without a circular dependency.
Plan the fix
Correct delegation through the authorized registrar or parent-zone owner and coordinate glue with server addressing. Keep old nameserver addresses active during the planned propagation interval when possible.
Check the result and rollback
Verify resolution from multiple independent recursive paths and test each delegated server. Restore the former reachable delegation if updated glue or authoritative service is not consistently available.