Network & Infrastructure / DNS, DNSSEC & Service Discovery
Lame delegations and intermittent resolver failures
Some queries succeed while others time out because one delegated nameserver is not authoritative for the zone. Resolver server selection can make the fault appear random.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Query every parent-listed server for the zone apex and representative records, noting authority flags, response codes and serial numbers. Compare server configuration with the delegation inventory.
Explain the result
A listed server that does not serve the delegated zone is a lame dependency. Redundant NS records increase availability only when every listed server is correctly configured and reachable.
Plan the fix
Provision the missing authoritative zone or remove the obsolete delegation through its owner. Do not rely on resolvers eventually choosing a different server after repeated timeouts.
Check the result and rollback
Require correct authoritative answers from every remaining delegated endpoint over UDP and TCP. Revert removal if it leaves insufficient independent service or accidentally excludes the only current zone copy.