Subject: [DNSOP] simple question

From: "A. Schulze" <[email-masked]>
Date: Fri, 13 Nov 2015 17:55:12 +0100

Hello,

consider a nameserver ns.example.com serving example.com. There is a delegation from com. including glue.
Now we add a childzone sub.example.com. served by the same nameserver ns.example.com.

should I add a entry in example.com to delegate the subzone to myself?

Thanks for opinions!
Andreas

---

From: Ray Bellis <[email-masked]>
Date: Fri, 13 Nov 2015 17:03:41 +0000

> should I add a entry in example.com to delegate the subzone to myself?

Yes, you should.

Ray

---

From: Havard Eidnes <[email-masked]>
Date: Fri, 13 Nov 2015 18:06:05 +0100 (CET)

> should I add a entry in example.com to delegate the subzone to myself?

Generally, yes, although with the specific example, your name
server software may let you get away with not having the NS
record in the example.com zone for sub.example.com.

However, think more generally: if example.com is served by one
set of name servers, and there are some of them which do not
serve the sub.example.com zone, and you have no NS records for
sub.example.com in the parent zone, you've just created breakage,
because those which don't serve sub.example.com will return
NXDOMAIN when queried for names in that zone.

The general rule is therefore: to delegate a zone, you copy the
NS RRset from the child zone into the parent zone.  If you follow
this rule always you won't get into the above problem.

Regards,

- Håvard

---

From: "Joe Abley" <[email-masked]>
Date: Fri, 13 Nov 2015 12:50:10 -0500

> record in the example.com zone for sub.example.com.

This will also lead to unexpected hilarity when you sign the zones, 
since the lack of a zone cut will cause a validator not to establish a 
chain of trust to the child zone.

As you say, best to install the delegation set in the parent zone even 
if the choice of nameservers for the parent and child means it will be 
obscured.

Joe

---

From: "A. Schulze" <[email-masked]>
Date: Fri, 13 Nov 2015 21:27:54 +0100

Am 13.11.2015 um 18:50 schrieb Joe Abley:
> As you say, best to install the delegation set in the parent zone even if the choice of nameservers for the parent and child means it will be obscured.

thanks for the advise
Andreas

---

From: Grant Taylor <[email-masked]>
Date: Fri, 13 Nov 2015 23:27:49 -0700

> should I add a entry in example.com to delegate the subzone to myself?

Is the subdomain, sub.example.com,  a separate (child) zone?  Or is it 
simply part of the same zone on the same server(s) as the parent domain, 
example.com?

If you are breaking the sub-domain, sub.example.com, out into it's own 
zone, then yes you need to delegate via NS records.  If you aren't 
breaking the sub-domain into it's own zone, I see no reason for NS records.

Remember that zones do not have to line up with (sub)domain boundaries.

-- 
Grant. . . .
unix || die