Summary

  • A delegation may tell a resolver to ask ns.child.example for child.example, even though finding that server's address would ordinarily require asking the same unreachable child zone.
  • DNS glue breaks the loop by putting a limited address copy in the parent referral. It provides reachability, not authority; later specifications refined how resolvers rank it and how servers must signal incomplete glue.

The impossible next step

An iterative DNS lookup advances by referrals. A root server points toward a top-level domain, the top-level domain points toward a child, and the resolver asks the next server. The chain seems straightforward until the child's server is named inside the child itself.

Suppose the parent says that child.example is served by ns.child.example. The resolver now needs the A or AAAA record for that host. But the authority for names under child.example is the server it has not yet reached. The instruction becomes circular: obtain the address from the machine whose address is required to ask the question.

This is not an exceptional syntax trick. Keeping a zone's server names inside the zone gives an operator a coherent namespace. The difficulty comes from crossing an administrative boundary when the destination needed for the crossing lies on the far side.

One address borrowed from the child

RFC 1034, published in November 1987, defined the zone cut. The parent carries NS records naming the servers for the delegated child. Those records point the resolver onward, but names alone may not establish communications. The RFC therefore lets the parent carry address records for servers below the cut. It called them glue.

The word describes both the necessity and the limit. The address joins two otherwise disconnected stages of resolution. It is copied into the parent's zone so that a referral can include a usable next hop. Yet RFC 1034 explicitly says the glue is not authoritative data. It is needed only when the server name lies below the cut and is used as part of a referral.

The parent is not answering the general question “what is the authoritative address of this host?” It is saying, more narrowly, “here is enough address information to try the authority I am delegating to.” Once reached, the child can answer from its own zone.

That distinction keeps DNS decentralised in a practical sense. The parent controls whether the delegation can be bootstrapped, a real operational lever. The child controls its zone. The resolver executes the referral and decides what evidence to retain. No single record needs to impersonate all three roles.

Why the exception had to remain weak

Additional data is convenient precisely because it arrives without a separate query. That also makes it dangerous to over-trust. A server can attach records that were not the subject of the question, and a cache can accidentally promote a hint into a durable answer.

RFC 2181 clarified the ranking in 1997. Authoritative zone data sits above non-authoritative answers and additional information. Unauthenticated records from the least trustworthy groups must not be cached so that they later emerge as answers. Glue may guide the next query; it must not acquire authority merely by surviving in memory.

The same RFC acknowledged an operational fact: glue for one name can exist in several zones and disagree. Unlike correctly configured authoritative copies, those parent-side hints can conflict. That is why a resolver needs provenance and rank, not just a bag of address records.

Where glue is necessary—and where it is noise

Later terminology made the geometry clearer. RFC 8499 calls a server name inside the delegated zone “in-domain.” An in-domain server needs glue; without it, resolution fails.

A sibling server sits elsewhere under the same parent. Its address can usually be resolved by following that sibling's own delegation, so sibling glue is an optimization. But siblings can depend on each other in a cycle. If foo.test uses a server under bar.test and bar.test uses one under foo.test, the parent must provide an address that breaks the circle.

An out-of-bailiwick server name lies outside the parent's zone. Supplying glue for it is useless: the resolver can and should resolve that name through the appropriate branch of the DNS tree. Accepting arbitrary out-of-scope additional addresses would enlarge both ambiguity and attack surface without solving a bootstrap need.

“Bailiwick” therefore names a protocol scope, not a legal jurisdiction. It tells the resolver whether a parent is in a position to provide a useful bootstrap record. It does not establish ownership of the name, the organisation or the address.

The two clocks on one delegation

Glue also introduced coordination work. The parent and child hold related but different data, and caches let those copies age on different clocks. RFC 1035 advised rejecting a zone file when required glue is missing. Its resolver discussion describes a subtler failure: cached NS records can remain after shorter-lived glue addresses expire, leaving a candidate server list with no reachable address.

Address changes are therefore not one atomic edit. The child may publish a new address before the parent changes glue, or the parent may change first while old child data remains cached. A resolver with a warm cache may continue working, while a cold resolver reveals the broken bootstrap path. Availability depends on the order, overlap and expiry of the change.

This is authority without omniscience. The parent can strand the child with stale glue, but it cannot see every resolver cache. The child can serve correct authoritative records, yet new resolvers may never reach them. Operational truth is distributed across two zones and many independent clocks.

When a complete answer did not fit

The original rule said to put available server addresses in the additional section. Modern DNS responses can also carry DNSSEC material, and a UDP response has a finite size. Some implementations sent a referral containing only part of the available glue without declaring that anything was missing.

RFC 9471 updated RFC 1034 in September 2023. A server must include all available glue for in-domain name servers or set the TC flag when size prevents it. The flag tells the resolver that the evidence set is incomplete and that it should retry using a transport able to carry the full response.

The clarification came from bounded operational evidence. RFC 9471 records a June 2020 response in which required glue did not fit and TC remained clear, causing resolution trouble. Its authors also found 222 cyclic sibling-only delegations among approximately 209 million delegations in late-2021 ICANN CZDS data. That is not a failure rate for the Internet. It shows that rare dependency shapes still need deterministic handling.

The repair is characteristic of the mechanism. It does not appoint a new DNS authority. It makes partial evidence visible. Servers disclose incompleteness; resolvers choose the retry; operators remain responsible for coherent delegation data.

A narrow bridge, not a title deed

Glue solved a real self-reference problem by permitting one bounded exception. The parent may carry a child's server address because otherwise the child can be unreachable. The resolver may use that address because it needs a first packet to reach the authority. Neither step turns the borrowed record into proof of ownership, server health or institutional legitimacy.

The historical achievement was not simply faster DNS. It was a division of powers encoded in data handling: delegation names the next authority, glue makes that authority reachable, the child supplies authoritative answers, and the resolver preserves the difference. The Internet escaped a loop without making the bootstrap hint sovereign.

Sources and limits

The 1987 zone-cut, referral and glue mechanism comes from RFC 1034 and RFC 1035. Trust ranking and conflicting glue are bounded by RFC 2181. Current terminology comes from RFC 8499, and completeness, truncation and the two deployment observations from RFC 9471. Later language is not projected back into 1987, and the observations are not treated as a census.