Glue records

Glue records solve a circular dependency. If example.com is served by ns1.example.com, then finding the address of ns1.example.com requires asking the nameservers for example.com, which requires knowing the address of ns1.example.com. The way out is for the parent zone — .com — to publish the address alongside the delegation, so a resolver following the referral already has somewhere to go.

Glue is only needed when the nameserver lives inside the zone it serves (in-bailiwick). A domain delegated to ns1.provider.net needs none, because that name resolves independently through a different branch of the tree.

The failure mode when glue is missing is total: the domain does not resolve for anyone, from a cold cache. The subtler problem is glue that exists but is *stale* — the registry has one address and the zone itself has another, because somebody renumbered the nameserver and updated the zone but not the registrar. Resolvers may then use either, so the domain works intermittently in a way that depends on which resolver a person happens to use.

Glue is maintained at the registrar, not in your zone file. It is usually called "host records", "registered nameservers" or "glue records" in the control panel, and it is a separate screen from the one where you set which nameservers the domain uses.

When you renumber an in-bailiwick nameserver, change it in both places, and change the registrar side first. A resolver that has cached the old glue will keep using it until the TTL expires, so allow for that before decommissioning the old address.

If you can avoid in-bailiwick nameservers, the whole class of problem goes away — this is one reason managed DNS providers put your zone on names inside their own domain.