Glue Records Explained: Breaking the DNS Chicken-and-Egg Problem
How glue records solve the circular dependency that arises when a domain's nameservers live under its own name.
Core Concept
Glue records provide the IP address of a nameserver directly within a parent zone's response, solving a circular dependency that occurs when a domain's nameservers are hosted under the domain itself.
Without glue, resolving ns1.example.com would require first resolving example.com — which itself requires knowing where ns1.example.com is.
When Glue Records Are Required
Not every domain needs glue records — only those with a specific structural pattern.
- Nameservers hosted as subdomains of the domain they serve
- In-bailiwick nameservers, as this configuration is called
- Registrar systems that require explicit glue record submission
In-Bailiwick vs Out-of-Bailiwick
A domain using entirely separate nameservers — a different domain altogether — never needs glue records at all.
How Glue Records Are Configured
Glue records are submitted through the registrar, not the domain's own DNS zone, since they need to appear in the parent zone's response.
- Registered separately from standard A/AAAA records
- Stored at the registry level for the relevant TLD
- Required to stay synchronized with the nameserver's actual IP
Diagnosing Glue Record Issues
Glue-related failures often present as intermittent or partial resolution problems rather than a clean, total outage.
Because different resolvers cache differently, a glue mismatch can cause some users to resolve a domain successfully while others fail entirely.
Inconsistent Symptoms
Glue record problems are notorious for producing inconsistent symptoms across different resolvers, making them harder to diagnose than a straightforward misconfiguration.
Keeping Glue Records Current
A few practices prevent glue-related issues from arising.
- Update glue records immediately after changing a nameserver's IP
- Verify glue matches the actual A/AAAA record at the nameserver
- Check glue configuration whenever migrating hosting for in-bailiwick nameservers
Real-World Implementation
Glue records are a routine consideration for domains running their own nameservers.
- Hosting providers running nameservers under their customers' domains
- Registrars providing glue record management interfaces
- DNS audits checking glue consistency during migrations
Though a relatively obscure DNS mechanism, glue records are essential infrastructure for any domain hosting its own in-bailiwick nameservers.
Common Mistakes to Avoid
A few common mistakes cause glue-record-related resolution failures.
- Forgetting to update glue records after changing an in-bailiwick nameserver's IP.
- Assuming glue records are managed through the domain's own DNS zone rather than the registrar.
- Overlooking glue record configuration entirely when a domain doesn't obviously need it yet.
- Misdiagnosing inconsistent resolution symptoms as an unrelated DNS issue.
- Failing to verify glue matches the nameserver's actual current A record after a migration.
- Assuming all registrars provide the same interface for managing glue records.
- Overlooking that some TLDs have specific formatting requirements for glue record submission.
- Failing to verify glue records propagated correctly after submission.
- Overlooking that some registries require glue records to be pre-created before nameserver assignment.
- Assuming glue record changes propagate instantly across the parent zone.
- Failing to check glue configuration when troubleshooting intermittent nameserver resolution failures.
- Overlooking that glue record propagation timing follows the same rules as other parent zone changes.
Best Practices Checklist
These practices help avoid glue-record-related outages.
- Update glue records at the registrar immediately after changing an in-bailiwick nameserver's IP.
- Verify glue records match the nameserver's actual A record after any infrastructure change.
- Document which domains use in-bailiwick nameservers requiring glue record management.
- Check glue configuration specifically during any hosting migration involving nameservers.
- Treat inconsistent, resolver-dependent resolution symptoms as a potential glue record issue.
- Familiarize yourself with your specific registrar's glue record management interface.
- Check TLD-specific formatting requirements before submitting glue record changes.
- Verify glue record propagation after submission rather than assuming it applied immediately.
- Check your specific registry's ordering requirements for glue record and nameserver setup.
- Account for propagation delay when verifying a recent glue record change.
- Include glue record checks as a standard step in nameserver troubleshooting.
- Apply standard DNS change propagation expectations when planning a glue record update.
Frequently Asked Questions
Frequently asked questions about glue records.
Does every domain need glue records?
No — only domains using nameservers hosted as subdomains of themselves, known as in-bailiwick nameservers, require glue records.
Where are glue records actually configured?
At the registrar, not within the domain's own DNS zone, since they need to appear in the parent zone's response.
Why do glue record problems produce inconsistent symptoms?
Because different resolvers cache differently, some users may resolve successfully while others fail, depending on their cache state.
What happens if a glue record is outdated?
It can cause resolution failures for the domain, since resolvers may be pointed to an incorrect or unreachable nameserver IP.
How do I know if my domain needs glue records?
If your nameservers are subdomains of the domain they serve, such as ns1.example.com serving example.com, glue records are required.
Do all registrars handle glue records the same way?
No — interfaces and submission processes vary, so it's worth familiarizing yourself with your specific registrar's approach.
Are there TLD-specific requirements for glue records?
Yes — some TLDs have particular formatting or validation requirements that differ from the general convention.
How can I confirm a glue record update actually took effect?
Querying the parent zone directly for the nameserver's glue record after submission confirms whether the change has propagated.
Do some registries require glue records before nameserver assignment?
Yes — certain registries have a specific ordering requirement, needing the glue record created before the nameserver itself can be properly assigned.
Does a glue record change apply immediately?
No — like other DNS changes, it needs to propagate, so verification should account for reasonable propagation delay.
Does glue record propagation follow the same rules as other DNS changes?
Yes — it's subject to similar caching and propagation timing as any other change at the parent zone level.
Check Glue Record Configuration
Run a DNS analysis to inspect a domain's nameserver and glue record setup.
Launch Tool →