A glue record's address does not match the nameserver's own
What this check looks for
The address your registry publishes for a nameserver is not the address that nameserver's own record gives. Queries are sent to a machine that may no longer be yours.
Why it matters
Glue is what a resolver uses before it can ask you anything, so a stale glue address routes real DNS traffic to whatever now occupies that address. If it was a cloud IP that has since been reassigned, someone else is receiving lookups for your domain.
When the check passes, your report says: “Glue addresses match the nameservers' own records”.
What it costs your score
When this check fails it removes 8 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.delegation family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- high
- Status when triggered
- warn
- Deduction
- 8 points
- Family cap
- dns.health.delegation · 35
- Category
- DNS
- Module
- Dns health
- Fix owned by
- registrar
- In the ruleset since
- 2026.09
How to fix it
Update the glue record at your registrar to the nameserver's current address.
Stale glue sends real lookups to an address that may now belong to someone else.
Confirm the current address of each nameserver from your own zone.
Update the registered host record at the registrar to match.
Re-test after the registry has published the change; this can take up to a day.
How to confirm it worked
dig +norecurse @<tld-nameserver> NS ‹domain› — compare the additional section against dig +short A ‹nameserver›
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹server list›. Glue at the parent and the A/AAAA records in the zone must agree; RFC 1034 §4.2.1 makes glue a copy of the zone's own data, and a copy that has drifted is worse than no copy. Glue is changed at the registrar, in the same place it was registered. Note that the two values were read at different moments, so a change made between the two reads would look like a mismatch — re-test after a few minutes before acting.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone