I'm totally all set.
The +norecurse option is exactly what I needed.
So this was a learning item for me.
The nameserver was indeed loading my NS records all along.
I just couldn’t see it.
And everything worked as expected once I loaded all five NS records and the
other remote DNS could see them.
-Steve
-----Original Message-----
From: Mark Andrews <ma...@isc.org>
Sent: Wednesday, August 27, 2025 8:19 PM
To: Steve Gladden <st...@michiganbroadband.com>
Cc: bind-users@lists.isc.org
Subject: Re: Trying simple NS delegation for a subdomain * I cannot get it to
load/work.
> On 28 Aug 2025, at 10:01, Steve Gladden <st...@michiganbroadband.com> wrote:
>
> Hi this is my first post ever.
> I’m stuck on a very simple task that I have not been able to get it to work.
> I have done this in the past with older versions of BIND but it has been
> quite a while.
>
> I’m trying to delegate to an external provider’s nameserver for a “subdomain”
> of mine.
> The parent zone file works properly and loads and serves everything as
> expected.
> But will not load and serve my NS record pointing an external provider’s DNS.
>
>
> I can get much more specific as need-be
> I am on and up to date version of Debian Server and up to date version
> of Bind9 named -v BIND 9.18.28-1~deb12u2-Debian (Extended Support
> Version) <id:>
>
> This is a generic example of what I am trying to do.
> The top two parent NS records load and serve as expected.
> As well as the A record of course.
>
> But the delegated NS record at the bottom does not get loaded or
> served when queried for it I am using dig as you may expect to determine this.
> I must be totally missing something simple but I am totally stumped on this
> at the moment.
To test whether the record is loaded do a NON-RECURSIVE query. You are
currently testing the loading AND the recursive lookup.
Check whether the delegation is present:
dig +norec test.domain.com NS @the-parent-server
Check whether the delegated zone is loaded:
dig +norec test.domain.com NS @ns1.anothernameserver.com
Check whether recursion worked:
dig test.domain.com NS
> $TTL 3600
> $ORIGIN domain.com.
> @ IN SOA domain.com. admin.domain.com. (
> 2017090101 ; Serial
> 10800 ; Refresh
> 1800 ; Retry
> 1209600 ; Expire
> 3600 ; Negative Cache TTL
> )
> @ IN NS ns1.domain.com.
> @ IN NS ns2.domain.com.
> @ IN A 1.2.3.4
> www IN A 1.2.3.4
> $ORIGIN test.domain.com.
> @ IN NS ns1.anothernameserver.com.
>
>
>
> dig @localhost test.domain.com NS
> ; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> @localhost test.domain.com
> ns ; (2 servers found) ;; global options: +cmd ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 59084 ;; flags:
> qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT
> PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 1232
> ; COOKIE: fb069e980ad743db0100000068af9952a0efd48210391401 (good) ;;
> QUESTION SECTION:
> ;test.domain.com. IN NS
> ;; Query time: 31 msec
> ;; SERVER: 127.0.0.1#53(localhost) (UDP) ;; WHEN: Wed Aug 27 19:48:34
> EDT 2025 ;; MSG SIZE rcvd: 69
>
> Thank you for any pointers..
> I have spent about a day searching the web before posting. Many examples say
> to do it the way I am doing it.
> And I’ve done it before this way.
> Not sure what I am missing.
>
> -SteveG
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
> from this list
>
> ISC funds the development of this software with paid support subscriptions.
> Contact us at https://www.isc.org/contact/ for more information.
>
>
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
