A DNS warning about missing parent delegation or glue concerns how resolvers find authoritative servers. It is not an SPF or DMARC syntax verdict. Start with the exact delegated zone and the nameserver relationship: a missing address in one display is not always a broken delegation, but a circular lookup dependency can prevent resolution entirely.
Read parent and child views separately
References: RFC 1034 §4.2.
The parent zone publishes delegation information directing queries toward the child. The child also has an apex NS set. Compare the parent referral and child authoritative answers, preserving full response sections and the queried server. Differences can reflect an incomplete migration or stale configuration and deserve investigation.
A record visible in a DNS control panel does not establish that the public parent delegates to that provider. Query from the parent side and confirm which servers are actually advertised. A direct query to an otherwise unreachable child server can succeed while ordinary recursive discovery still fails.
Determine when glue is needed
References: RFC 9471 §2.1, RFC 9471 §2.3, RFC 9471 §3.1, RFC 9471 §3.2.
When a delegated zone's nameserver name lies inside that child zone, resolving the nameserver address can depend on reaching the very server whose address is needed. Parent-side glue supplies address information to break that circular dependency. RFC 9471 specifies requirements for including available in-domain glue in referrals and using truncation when it does not fit.
Out-of-domain nameserver addresses can normally be resolved through their own delegation path. Their absence from a particular referral is therefore not automatically the same defect as missing required in-domain glue. Cyclic sibling delegations can still require sibling glue to break their dependency; RFC 9471 §3.2 recommends including available sibling glue, while its truncation obligation differs from in-domain glue. Sibling relationships and implementation details need careful interpretation; follow the actual resolution chain rather than applying a simplistic rule to every nameserver name.
Check addresses and reachability
References: RFC 9471 §3.1, RFC 1035 §4.1.1.
Compare parent glue with the authoritative address data for the nameserver where appropriate. An old address can send resolvers toward a retired endpoint. Test the advertised addresses and both relevant address families from authorized monitoring locations. A valid-looking record does not prove the server answers correctly or serves the child authoritatively.
Inspect UDP and TCP behavior when responses are truncated or large. Capture response codes, authority flags and referrals. Do not diagnose an application timeout solely from a screenshot of an NS list. Work with the registrar for parent-side host or glue changes and the DNS host for child-zone changes; these may be different organizations.
Reproduce the circular dependency
The offline fixture delegates example.test to ns1.example.test with no supplied address. The classification flags an in-domain bootstrap dependency requiring glue investigation. Adding the documentation address 192.0.2.53 removes that specific warning in the model. A second delegation to ns1.example.net is labeled external-address resolution required, not automatically missing glue.
Run the supplied script to reproduce these labels. It does not emulate a full resolver or prove the documentation address is reachable. For a real repair, retain parent referrals, authoritative address answers and successful recursive resolution from relevant networks. No registrar or live zone changes were performed here.
Translate the result into mail impact
References: RFC 1034 §5.3.3, RFC 7208 §4.4.
If the domain cannot be resolved reliably, receiving MX and authentication lookups can fail even when their intended values are correct. Identify which names share the broken delegation and test the exact SPF, DKIM and policy paths. A sibling subdomain with a different delegation may have a different outcome.
Close with corrected parent and child state, tested server availability and resolver evidence. Account for cached delegation and address data during recovery. Do not change authentication policy merely to silence a delegation warning; repair the discovery path and then verify the mail-specific dependencies.
Retained historical wire evidence
The following describes the retained 7 November 2026 loopback capture, inspected but not rerun as a network experiment for this review. New offline model checks are recorded separately.
The retained loopback trace queries a minimal parent endpoint for _dmarc.example.test TXT and records an NS referral plus glue for ns1.example.test. The client then queries the child at the returned loopback address using the separately configured lab port and obtains its authoritative DMARC TXT response. Both packet captures retain owner/type, flags, TTLs and UTC time. This is a genuine two-step wire exchange, but not a full recursive resolver: port discovery is supplied by the lab, DNSSEC and sibling cases are not exercised, and no public registrar or parent was changed.