Domains & DNS
Subdomain delegation: hand part of a DNS namespace to another set of nameservers
Subdomain delegation lets a parent zone give authority for a child such as app.example.com to a different nameserver set. It is useful when teams or platforms need independent control, but delegation introduces a second DNS authority and a clear boundary where records must live on one side or the other.
Choose the exact delegation boundary
Decide whether the child is a single hostname or an entire subtree. Delegating app.example.com means the child authority owns records at and below that name; ordinary records for the delegated node should not be split ambiguously between parent and child.
Keep unrelated parent-zone records untouched.
Create the child zone before parent NS records
Configure the child authority with SOA, NS, and required application records, then query those servers directly. Only after the child answers correctly should you publish NS delegation in the parent.
If child nameservers are inside the delegated zone, glue/address considerations may apply.
Plan DNSSEC across the delegation
A signed parent can securely delegate to a signed child using a DS for the child. If the child is unsigned, the parent must represent an insecure delegation correctly and must not publish a fabricated DS.
Coordinate key changes with whoever operates the child.
Monitor both authorities
Troubleshooting now requires checking parent delegation and child data. Document ownership and renewal/access for both DNS providers so one team cannot silently abandon the child zone.
- Define the subtree owner.
- Prebuild child authority.
- Publish parent NS delegation.
- Document DNSSEC/operational ownership.