How DNS delegation works and why it matters

explainer · networking

SUMMARY DNS is a delegated tree: every zone can hand responsibility one level down. Understand that and you understand why changes propagate slowly and where to look for faults.

Every domain name is a path through the tree – from the root servers through the TLD to the authoritative server. Delegation is the handover of responsibility for a subtree.

FIG. 01 – root → TLD → authoritative server

The name tree and who answers for what

Root servers do not know the answer for a specific name – they only know who sits one level below. TLD servers (.cz) hold the NS records of individual domains.

How a recursive query proceeds

A resolver walks the tree step by step: root → TLD → authoritative server. It caches each answer according to its TTL, so most queries never reach the root.

Where delegation breaks

The most common faults: a delegation pointing at a server that does not answer authoritatively for the zone (lame delegation), NS records in the parent zone disagreeing with those in the zone itself, a missing glue record for an in-zone nameserver, or a TTL so long that a fix takes a day to show.

Key terms

delegation an NS record handing a zone to another server

glue record the IP address of an NS server inside the parent zone

resolver the server that walks the tree on the client’s behalf