A nameserver inside the domain has no glue record
What this check looks for
One of your nameservers lives inside the domain it serves, and the registry does not hold its address. To find the address a resolver must ask the nameserver — which it cannot find without the address.
Why it matters
This is a circular dependency, and whether it works depends entirely on what a resolver happens to have cached. Fresh resolvers fail outright; ones with a warm cache succeed, which is why the problem is so often reported as intermittent.
When the check passes, your report says: “The registry holds glue for every nameserver inside the domain”.
What it costs your score
When this check fails it removes 8 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.delegation family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 8 points
- Family cap
- dns.health.delegation · 35
- Category
- DNS
- Module
- Dns health
- Fix owned by
- registrar
- In the ruleset since
- 2026.09
How to fix it
Register the nameserver's address as a glue record at your registrar.
Without glue, a resolver with a cold cache cannot resolve your domain at all.
Find the "register a nameserver" / "host records" / "private nameservers" section of your registrar's control panel.
Register each in-domain nameserver name with its IPv4 and IPv6 address.
Alternatively, avoid the problem entirely by using nameserver names outside this domain — a managed DNS provider's names need no glue.
Allow up to a day for the registry to publish the change.
How to confirm it worked
dig +norecurse @<tld-nameserver> NS ‹domain› — expect the additional section to carry the nameserver's address
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
These nameservers are inside ‹domain› and the parent sent no glue address for them: ‹server list›. RFC 1034 §4.2.1 requires the parent to publish glue A/AAAA records for any nameserver inside the zone it delegates. Glue is entered at the registrar, not in your zone file — it is usually called "register a nameserver", "host records", or "private nameservers" in a registrar's control panel.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours
- Your nameservers are serving different versions of the zone