DNS Delegation Integrity Issues

What is DNS delegation?

DNS delegation defines which nameservers are responsible for answering DNS queries for a domain. The parent zone points to these nameservers, and they must actually serve the domain authoritatively.

Delegation is created when a parent zone publishes NS records for a child domain. For example, the .com zone publishes NS records for example.com, indicating which nameservers are allowed to answer for that domain. Those nameservers must then host the example.com zone and respond authoritatively to queries.

Delegation only works when the parent and child are aligned. If the parent points to nameservers that no longer serve the zone, or if the child expects nameservers that are not listed at the parent, DNS resolution becomes unreliable. This commonly happens during registrar changes, DNS provider migrations, or incomplete cleanup of old nameservers.

When a resolver looks up a domain, it follows the delegation chain step by step until it reaches an authoritative answer.

Resolution path for www.example.com:

root zone
→ .com parent zone
→ example.com delegated nameservers
→ authoritative DNS answer

If any step in this chain points to a nameserver that does not respond authoritatively, resolution can fail or behave inconsistently.

What goes wrong when DNS delegation is broken

When delegation is misconfigured, DNS rarely fails in a clean or obvious way. Failures tend to be partial and inconsistent.

Resolvers behave differently when they encounter delegation issues. Some retry other nameservers, others cache failures. The outcome depends on which resolver a user hits and the current cache state.

Common consequences include:

• Intermittent website outages that are difficult to reproduce
• Email delivery failures affecting only part of the traffic
• TLS certificate validation errors caused by incomplete DNS resolution
• Random timeouts during API calls or third-party integrations

These issues often appear during:

• DNS provider migrations
• Partial or staged nameserver changes
• Cleanup of old or unused nameservers
• Registrar updates that were never fully applied

Because the failures are inconsistent, delegation problems are frequently misdiagnosed as application, network, or CDN issues.

DNSAudit checks delegation integrity to surface these conditions before they turn into production incidents.

Possible results from this check

This check evaluates delegation health using authoritative DNS queries and returns a single result based on the observed state.

Lame DNS Delegation Detected

Severity: Critical

What this means: One or more nameservers listed in the delegation do not answer authoritatively for the domain or do not respond at all.

What happens in practice: Some resolvers retry alternate nameservers, others cache the failure. The result is inconsistent resolution where some users can reach the domain and others cannot.

This often appears as:

• Intermittent site outages
• Email delivery failures
• TLS validation errors that are hard to reproduce

Suggested fix: Confirm that every delegated nameserver is actively hosting the zone and responding authoritatively on port 53 over both UDP and TCP. Remove any nameservers that were decommissioned or never hosted the zone. After updating the delegation, allow caches to expire and recheck authoritative responses.

Parent and Child Nameserver Mismatch

Severity: Warning

What this means: The nameservers listed at the parent level do not match the nameservers defined in the authoritative zone. All nameservers still respond correctly, but the configuration is inconsistent.

What happens in practice: This usually appears during DNS provider changes or partial migrations. Resolution works until an old nameserver is modified or removed, at which point delegation breaks unexpectedly.

Suggested fix: Make the parent and child nameserver lists identical. Only remove or add nameservers after confirming the remaining servers host the full zone and answer authoritatively.

Delegation Drift Detected

Severity: Informational

What this means: There is a one-sided difference between parent and child nameservers. Some nameservers are no longer actively used.

What happens in practice: Nothing breaks immediately. The risk appears later, when DNS changes are made and no one remembers which nameservers are still required.

Suggested fix: Review the current delegation and remove unused or transitional nameservers once changes are complete. Keep parent and child delegation aligned to avoid future mistakes.

DNS Resolver Inconsistency Observed

Severity: Informational

What this means: Different public DNS resolvers return different nameserver records for the same domain.

What happens in practice: Users may see different behavior depending on which resolver they use. This is common after recent changes and usually resolves as caches expire.

Suggested fix: If nameserver changes were made recently, wait for propagation to complete. If inconsistencies persist, review the delegation and confirm all nameservers are correctly configured.

DNS Delegation Integrity Verified

Severity: Secure

What this means: All delegated nameservers respond authoritatively and parent and child records are aligned.

Suggested action: No action required.

How DNSAudit evaluates delegation

DNSAudit verifies delegation using authoritative DNS queries. When possible, parent zone authoritative servers are queried directly over TCP. If that is not available, registry or registrar data is used as a fallback and clearly identified in the results.

Critical findings are based on authoritative behavior, not resolver cache data.