[ DNS & domains ]

DNS NS records and subdomain delegation

Plan the correct zone boundary, prepare child authority and verify the referral chain before delegating email-authentication DNS.

By the EmailAuth research team · 8 min read

[ Key points ]

  • An NS delegation transfers authority for a child zone, not just one TXT value.
  • Prepare every required child record before changing the parent referral.
  • Verify the delegation chain, each server and affected sender messages.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Delegate only the intended namespace, preserve all dependent records, and require both authoritative DNS and received-message evidence.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Map every selector below the cut

A delegation can affect multiple senders.

Next steps

  1. Inventory all records below the proposed child boundary.
  2. Check each child server and the parent referral.
  3. Retest every affected signing workflow.

CISO / SecOps

Review the authority being delegated

A child operator controls a defined portion of the authentication namespace.

Next steps

  1. Approve the narrowest supported scope.
  2. Coordinate DS and signing changes with the DNSSEC owner.
  3. Retain recovery authority and access ownership.

Founder / Non-technical

Protect all sending dependencies

A working newsletter test can hide a broken billing selector.

Next steps

  1. Identify business-critical senders under the delegated branch.
  2. Approve the change owner and recovery plan.
  3. Require delivery acceptance across those workflows.

[ FAQs ]

Frequently asked questions

Does an NS record contain an IP address?

No. NS RDATA identifies a nameserver hostname. Address records and any required glue are separate parts of reaching that server.

RFC1035

Where is a subdomain delegation published?

The parent zone publishes the child NS set. The child also has apex NS data; editing only the child does not establish a public referral from the parent.

RFC9499

Is delegating _domainkey the same as delegating one selector?

No. The _domainkey subtree can contain selectors for multiple senders. Inventory the whole transferred namespace and use only the scope actually intended.

RFC1034

Can I replace a requested CNAME with NS records?

Not as an equivalent substitution. An alias and a child-zone delegation have different DNS meanings and operational requirements. Use the service’s supported method.

RFC1034

When might glue be needed?

In-domain nameserver names can create a dependency on the delegated zone to find its own servers. Appropriate parent-side address information breaks that dependency. Confirm the actual topology.

RFC9499

Why do old selector records in the parent no longer help?

Once resolution follows the child delegation, ordinary data below that cut must be served by the child. A leftover record in the old panel is not evidence of the effective answer.

RFC1034

Should I delete a DS record when a delegation fails?

Do not delete it as an unexplained workaround. Have the DNSSEC owner check the parent DS and child signing configuration and approve any trust-chain transition.

RFC4035

Does a successful TXT lookup prove DKIM passes?

No. The signer must use the corresponding key and the received message must verify. Test the selector actually used by each affected sender.

RFC6376

[ Sources ]

Sources

  1. RFC9499

    Sections §6. DNS servers and clients · §7. Zones

  2. RFC4035

    Sections §2.4 Including DS RRs in a Zone · §5. Authenticating DNS Responses

  3. RFC1034

    Sections §4.2.1 Technical considerations · §4.2.2 Administrative considerations · §4.3.2 Algorithm

  4. RFC2308

    Sections §2. Negative Responses · §5. Caching Negative Answers

  5. RFC1035

    Sections §3.3.11 NS RDATA format · §3.3.13 SOA RDATA format · §4.1 Message format

  6. RFC6376

    Sections §3.5 DKIM-Signature Header Field · §3.6 Key Management and Representation · §6. Verifier Actions

[ Glossary ]

Glossary

Zone cut
The boundary between authority held by a parent zone and a delegated child zone.

RFC9499

Glue
Address records supplied to help reach nameservers when resolution would otherwise depend on the delegated zone.

RFC9499

Child apex
The top name of the delegated child zone, where its own SOA and NS data reside.

RFC1035

Referral
A DNS response directing resolution toward another authoritative server set.

RFC9499

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base