What is a DNS glue record and when you need one
A glue record exists to solve a chicken and egg problem: a domain's nameserver has a name inside the very domain it is supposed to serve, so to find the nameserver's address you would first need to ask the nameserver you cannot yet reach. Glue breaks that loop.
The circular dependency
Suppose example.com uses nameservers named ns1.example.com and ns2.example.com. A resolver wanting the IP for example.com first needs to reach a nameserver for the zone. It asks the .com servers, which reply: the nameservers are ns1.example.com and ns2.example.com. Now the resolver needs the address of ns1.example.com, but that name is itself inside example.com, the zone it is still trying to resolve. The only server that knows the address of ns1.example.com is ns1.example.com itself, which the resolver cannot find without first knowing its address. The lookup cannot complete.
How glue resolves it
The .com registry stores the A and AAAA records for those nameservers alongside the delegation, in the parent zone. When a resolver asks .com for example.com, the response names the nameservers in the AUTHORITY section and includes their IP addresses in the ADDITIONAL section. Those addresses are the glue. The resolver now has an address to query directly, and the loop is broken. The glue is authoritative data held by the parent purely to bootstrap the lookup.
When glue is required
Glue is needed only when a nameserver's name falls inside the zone it serves. This situation has a name: the nameserver is in bailiwick.
| Setup | Nameserver name | Glue needed |
|---|---|---|
| Vanity nameservers | ns1.example.com for example.com | yes |
| Third party DNS | ns1.provider.net for example.com | no |
| Subdomain delegation | ns1.sub.example.com for sub.example.com | yes |
If you point example.com at a provider like ns-123.awsdns.com, no glue is required, because that nameserver lives in a different zone that resolves on its own. The circular dependency never appears. This is why most domains using a managed DNS provider never think about glue at all.
Setting and checking glue
Glue is created at your registrar, not in your zone file. Registrars usually call it "register a nameserver," "host records," or "private nameservers." You register the name ns1.example.com with its IP, and the registrar pushes that to the parent zone. Putting the A record only in your own zone file is not enough, because a resolver cannot reach your zone to read it until the glue is already in place.
To check glue, query the parent directly and look at the ADDITIONAL section:
dig +norecurse @a.gtld-servers.net example.com NS
If the nameservers are in bailiwick and their A records appear in ADDITIONAL, the glue is present. An empty ADDITIONAL section there is the classic symptom of missing glue, and it produces intermittent resolution failures that are maddening to diagnose because a cached answer can mask it.
Common gotcha
When you change a vanity nameserver's IP, you must update the glue at the registrar, not just the A record in your zone. Resolvers trust the parent glue to find the server in the first place, so a stale glue address makes the zone unreachable even though the zone file looks correct.
To inspect the records returned for a domain and its nameservers, the DNS Lookup tool runs the queries for you and shows each section.