Module 2 · 2.3
Changing nameservers and glue records
Module 2: Nameservers and zones · Reading time: 8 minutes
Learning objective: After this lesson, you'll be able to change nameservers safely, explain what a glue record is, and recognise why a registry might refuse a change.
Key concepts: nameserver change via the registrar, glue record, own nameservers (such as ns1.example.com), predelegation check by the registry, lame delegation
When do you change nameservers?
You change a domain's nameservers when you want to move DNS management to another party. For example:
- you're switching to a different hosting provider and want them to manage the DNS;
- you want to use a DNS service such as Cloudflare;
- a website platform asks you to point the nameservers to them;
- you're moving back to your registrar's default nameservers.
It's a big step: after the switch, the new party determines all records for your domain, including those for email. If you only want your website or only your email to run elsewhere, you usually don't need to change the nameservers. In that case you just adjust a few records (modules 3 and 4).
The safe order
- Make a list or backup of your current records. Many control panels have a button to export the zone or create a backup.
- Set up the zone at the new party. Copy over all the records you need: website (A, AAAA, www), mail (MX, and the A record of the mail server if it falls under your domain), SPF, DKIM, DMARC, verification records, subdomains.
Check the new zone by querying the new nameservers directly, before you switch. For example:
dig @ns1.newprovider.example example.com MXIf the new nameservers reply with the correct records, the zone is ready.
- Do you have DNSSEC enabled? If so, arrange first how the keys will move across. Turn off DNSSEC and wait until the old DS data has cleared from caches, or submit the new DS data at the same time. Otherwise the chain breaks and your domain becomes unreachable for validating resolvers (lesson 8.1).
- Change the nameservers at your registrar. Enter at least two. The registrar passes them on to the registry.
- Wait and check. Resolvers remember the old nameservers until the TTL of the delegation has passed. For
.nlthis is one hour, for.comtwo days. As a rule of thumb, allow for a few hours up to a day. Leave the old zone unchanged in the meantime.
Why might a registry refuse your nameservers?
Some registries check your nameservers before carrying out the change. This is called a predelegation check. DENIC (.de) is well known for this: if the new nameservers don't yet recognise your domain, or if the answers from the nameservers don't match up, the change is refused. Other registries may also carry out checks, or have rules about the number of nameservers.
The solution is always the same: set up the zone at the new party first, then try again. That's step 2 of the safe order. For .nl, you can test your nameservers in advance with a public tool such as Zonemaster.
Lame delegation
If the nameservers at the registry point to servers that don't recognise your domain, this is called a lame delegation. The resolver is referred to a server that has no answer. The result: your domain doesn't work, or only works sometimes (if one of the nameservers is correctly configured).
This happens, for example, when:
- you changed the nameservers before the new party had the zone ready;
- you left an old provider, who deleted the zone, while the nameservers still point to that provider;
- there's a typo in a nameserver name.
You check this by querying each nameserver separately. Every nameserver should give a reply with the "authoritative" flag (in dig you'll see aa in the flags).
Own nameservers and glue records
You can also use nameservers with a name under your own domain, such as ns1.example.com and ns2.example.com. These are called own nameservers or vanity nameservers. This creates a chicken-and-egg problem:
- to look up
example.com, the resolver needs to go tons1.example.com; - but to find the IP address of
ns1.example.com, it needs to look in the zone ofexample.com.
That's why the registry includes the IP address alongside the nameserver name in the referral. This extra address is called a glue record:
; in the .com zone, at the registry (Verisign)
example.com. NS ns1.example.com.
example.com. NS ns2.example.com.
ns1.example.com. A 192.0.2.53 ; glue
ns2.example.com. A 198.51.100.53 ; glueGlue is only needed if the nameserver falls within the domain itself (or within a domain that depends on the same delegation). If you use ns1.hosting.example for example.com, no glue is needed: that address is in the zone of hosting.example.
You arrange glue through your registrar, often under a button such as "Register own nameserver", "Child nameserver" or "Create host". If the IP address of your nameserver changes, you also need to update the glue at the registry. Otherwise resolvers will keep pointing to an old address.
Most domain registrants don't need their own nameservers. They're mainly used by hosting companies and resellers who want to display their own name.
In practice: what it looks like in a control panel
In My WebOké, go to My Domains, click on the domain, and click the pencil icon on the Nameservers card. You enter at least two nameservers. You first create own nameservers there using the button for an own nameserver (glue). With other registrars this is often called "Change nameservers", "DNS servers" or "Custom nameservers", and for glue "Child nameservers" or "Host records"; the fields are the same.
Summary
- Changing nameservers moves management of all your records to another party.
- Safe order: back up, set up the zone, test the new nameservers, arrange DNSSEC, then switch.
- Some registries (such as DENIC) refuse a change if the new nameservers don't yet have the zone.
- Lame delegation: the registry points to nameservers that don't recognise your domain.
- Glue records are IP addresses at the registry for nameservers that fall within the domain itself.
Quiz
Exercise
Exercise Z2.3: Are all nameservers the same? Look up the nameservers of sidn.nl (the website of SIDN, the registry of .nl in the Netherlands). Then query the SOA record of sidn.nl at each nameserver separately (dig @ns1.sidn.nl sidn.nl SOA, or an online tool where you can choose the server). Enter the serial number for each nameserver, and whether they match.
Further reading
These articles describe the situation at WebOké. The process is similar with other registrars.