Cybersecurity glossary
What is a Glue Record?
Learn what a glue record is, why parent zones publish A or AAAA data for in-bailiwick name servers, and how stale glue can break delegation or misdirect traffic.
Definition
A glue record is parent-zone address data, typically A or AAAA, published alongside a delegation so resolvers can reach in-bailiwick authoritative name servers without circular dependency.
Why glue exists at all
Delegation only works if resolvers can contact the child's authoritative servers. That sounds obvious until the name servers themselves live inside the very zone being delegated. If example.com says its authority is ns1.example.com, how does a resolver learn the address of ns1.example.com before it can query example.com?
That bootstrapping problem is what glue records solve. The parent zone includes address data with the referral so the resolver has somewhere to connect next.
The reachability problem glue solves
Glue is easiest to understand as helper data that travels with delegation. It is not a substitute for the child's own zone records; it is the parent's practical answer to a circular dependency.
Lives at the parent
Glue is published in the parent zone, not authored as the primary source of truth inside the child zone.
Contains addresses
It usually consists of A and/or AAAA data for the delegated name server hostnames.
Most important in-bailiwick
Glue is especially needed when the name servers are inside the child domain being delegated.
Can go stale
If the parent and child drift apart, resolvers may be directed to obsolete server addresses.
How a resolver uses glue during delegation
A resolver walks the DNS hierarchy
It starts from higher-level servers and asks where authority for the target zone has been delegated.
The parent returns NS records
The referral says which hostnames are authoritative for the child zone.
Glue may accompany the referral
If those name servers are in-bailiwick, the parent includes their A or AAAA addresses so the resolver can reach them immediately.
The resolver contacts the child name server
Using the glued address, it sends the next query to the delegated authority.
The child serves authoritative data
The resolver receives the record it actually wanted, such as an A, MX, or TXT answer from the child zone.
Caches store what they learned
Resolvers cache both referral and glue information according to DNS rules and TTLs.
Cases where glue matters most
| Scenario | Example | Why it matters |
|---|---|---|
| In-bailiwick delegation | `example.com` is delegated to `ns1.example.com` and `ns2.example.com`. | Glue is needed so resolvers can reach those name servers without recursion loops. |
| Out-of-bailiwick delegation | `example.com` uses `ns1.provider.net`. | Glue is usually unnecessary because the resolver can resolve `provider.net` independently. |
| Stale glue | The child updates the name server IP, but the parent's glued address is not refreshed. | Some queries may fail or hit the wrong server until caches expire and the parent is corrected. |
| Missing glue in referrals | A parent omits required address data for in-bailiwick servers. | Delegation can become partially or fully unreachable for resolvers. |
Operational habits that keep glue healthy
Glue problems are rarely glamorous, but they create outages that look mysterious from the user side. The fix is disciplined coordination between parent-side registration data and child-side zone operations.
- Document whether each delegated zone uses in-bailiwick or out-of-bailiwick name servers.
- When changing name server addresses, update the child zone and the parent-side glue together.
- Verify both IPv4 and IPv6 reachability if you publish A and AAAA glue.
- Test delegation externally after registrar or registry-side changes; internal zone files alone are not enough.
- Keep multiple authoritative servers on independent infrastructure where possible so one stale glue path does not become a single point of failure.
- Review cache behavior during changes because old glue can linger even after you correct the parent.
- Avoid assuming glue equals authority; the child zone remains the authoritative source for its data.
- Monitor delegation failures as a separate operational concern from record-level application outages.
Glue mistakes have real security impact
Glue is mostly discussed as a reliability topic, but stale or incorrect parent-side address data can also misdirect traffic. If a resolver is pointed toward the wrong name server, users may see outages, inconsistent answers, or delayed recovery after a migration.
That does not make glue a primary attack technique by itself. It means delegation data deserves the same change control and verification rigor as other Internet-facing infrastructure records.
The practical takeaway
A glue record is parent-published address data that helps resolvers reach in-bailiwick delegated name servers without getting trapped in a circular lookup.
When delegations change, treat glue as operationally critical. Correct parent-side addresses keep DNS delegation reachable; stale glue can quietly break it.
Related security terms
NS Record
NS records delegate authority, while glue helps resolvers reach delegated name servers when they are inside the child zone.
A Record
Glue commonly consists of IPv4 address records published at the parent.
AAAA Record
IPv6 glue serves the same reachability purpose for delegated name servers.
Authoritative DNS Server
Glue exists to help resolvers contact the authoritative servers for a delegated zone.
DNS Zone
Delegation boundaries between parent and child zones determine when glue is needed.
Frequently asked questions
What is a glue record in simple terms?
It is address information published by a parent zone so resolvers can find the child zone's name servers when those name servers live under the same child domain.
Why is glue needed?
Without glue, a resolver could get stuck in a loop: it needs the child zone to find the name server address, but it needs the name server address to reach the child zone.
Is glue the same as an NS record?
No. NS records say which hostnames are authoritative. Glue provides the IP addresses needed to reach those hostnames in specific delegation scenarios.
When is glue required?
It is typically required for in-bailiwick name servers, such as ns1.example.com serving the zone example.com.
Can glue become stale?
Yes. If the parent's glue is not updated when the child name server address changes, some resolvers may be sent to the wrong place.
Does every delegation need glue?
No. Out-of-bailiwick name servers such as ns1.dns-provider.net usually do not need glue from the parent because their addresses can be resolved elsewhere.
Is glue a security feature?
Glue is a reachability aid, not a security control. It must still be managed carefully because wrong or stale glue can disrupt resolution.
References
Explore authoritative guidance and frameworks related to glue record.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.