What Is a Glue Record and When Do You Need One?

A glue record is one of those DNS concepts that seems baffling until the "aha" moment, then feels obvious. In short: it's an A record stored at your registrar that breaks a chicken-and-egg loop when your nameservers live on the very domain they're responsible for. This guide explains the problem and exactly when you need glue.

The chicken-and-egg problem

Say you run custom nameservers named after your own domain:

• ns1.example.com
• ns2.example.com

When a resolver wants example.com, the .com servers say "ask ns1.example.com." But to contact ns1.example.com, the resolver needs *its* IP address — which is stored... at example.com's nameservers, which is exactly what it's trying to reach. Circular dependency. Nothing resolves.

Glue records break the loop: the registrar publishes the IP addresses of ns1.example.com and ns2.example.com directly in the parent (.com) zone, alongside the delegation. Now the resolver gets the nameserver IPs "for free" and can proceed. The parent zone provides the glue that holds it together.

For the broader picture of how delegation works, see what are nameservers and how DNS works.

When you need a glue record

You need glue only when your nameservers are subdomains of the domain they serve — i.e. you're running vanity/custom nameservers like ns1.example.com for example.com. This usually happens when you:

• Run your own authoritative DNS (BIND, PowerDNS, Knot) and brand the nameservers on your domain.
• Resell hosting and want ns1.yourbrand.com nameservers.

You do not need glue when you use a third-party DNS host, because their nameservers (e.g. dana.ns.cloudflare.com) live on a *different* domain (cloudflare.com), whose glue is already handled. Pointing at Cloudflare or Route 53 needs no glue from you.

How to add glue records

Glue is created at your registrar, not in your DNS zone, because it lives in the parent zone. The registrar feature is usually called "Register a nameserver," "Private nameservers," "Host records," or "Glue records."

1. In your registrar panel, find Nameserver registration / host records (often under advanced domain settings).
2. Register ns1.example.com with its IP, e.g. 203.0.113.10.
3. Register ns2.example.com with its IP, e.g. 203.0.113.11.
4. Then set the domain's nameservers to ns1.example.com and ns2.example.com.

Steps 1–3 create the glue; step 4 uses it. Do them in that order — pointing the domain at nameservers that have no glue registered yet leaves it unresolvable. The full custom-nameserver flow is in how to set up custom nameservers for your domain.

Verify the glue

Query the parent (.com) servers directly and look for the glue in the ADDITIONAL section:

dig example.com NS +norecurse @a.gtld-servers.net

You should see ns1.example.com / ns2.example.com in the AUTHORITY section and their IPs in the ADDITIONAL (glue) section. If the IPs are missing, the glue isn't registered. See diagnosing DNS problems with dig and nslookup for reading dig output.

What running your own nameservers actually requires

Glue is just one piece. If you want ns1.example.com / ns2.example.com to be real, you need:

• Two DNS servers running authoritative software — BIND, PowerDNS, Knot or NSD — ideally on two different machines (or at least two IPs) for redundancy.
• Static IP addresses for each, which is why a VPS beats a home connection.
• Glue records registered at your registrar mapping each nameserver name to its IP.
• A correctly configured zone on those servers holding your A, MX, TXT and other records.

That's a real commitment. For most people, a managed DNS host (Cloudflare, Route 53) is simpler and more resilient — no glue, no server to patch. Vanity nameservers make sense mainly for hosting resellers who want branded ns1.yourbrand.com nameservers, or people who specifically want to run their own DNS.

Two nameservers, one server?

Best practice is two nameservers on separate infrastructure so a single outage doesn't take DNS down. You *can* register ns1 and ns2 pointing at the same box (two IPs on one VPS, or even the same IP), and registrars will usually accept it — but it defeats the redundancy the two-nameserver requirement exists for. If you're serious about self-hosting DNS, run the secondary on a different machine or region, and consider a hidden-primary setup with a secondary provider as backup.

Updating glue when an IP changes

Because glue lives at the registrar (in the parent zone), it doesn't update itself when your server moves. If you rebuild the nameserver on a new IP:

1. Update the glue record at the registrar to the new IP.
2. Update the nameserver's own A record in your zone to match.
3. Verify both agree:

dig example.com NS +norecurse @a.gtld-servers.net
dig ns1.example.com A +short

Miss the glue update and the whole domain stops resolving, because resolvers still try the old, dead IP. This coordination is exactly why glue and custom nameservers go together — see how to set up custom nameservers for your domain, and read output with help from diagnosing DNS problems with dig and nslookup.

FAQ

Do I need a glue record if I use Cloudflare's nameservers?

No. Cloudflare's nameservers are on cloudflare.com, not your domain, so their glue is already published. Glue is only needed for nameservers named after your own domain.

Where are glue records stored?

In the parent zone (e.g. .com), published by your registrar — not in your own DNS zone. That's why you register them at the registrar, not your DNS host.

What happens without glue when I need it?

A circular dependency: resolvers can't find your nameservers' IPs, so the domain fails to resolve entirely until glue is added.

Do glue records need updating if my nameserver IP changes?

Yes. Since glue holds the nameserver's IP at the registrar, changing that IP means updating the glue record too, or resolution breaks.

How do I check whether my glue records are set correctly?

Query a parent (TLD) nameserver directly and look at the additional section, where glue lives. For a .com domain: dig example.com NS +norecurse @a.gtld-servers.net. The authority section should list your nameservers (ns1.example.com, ns2.example.com), and the additional section should show their IP addresses — that's the glue. If the names appear but the IPs are missing, the glue isn't registered and the domain will fail to resolve. You can also use your registrar's "registered nameservers" or "host records" screen to confirm the IPs it publishes. After any change to a nameserver's IP, re-run the query to make sure the parent zone reflects the new address, since stale glue points resolvers at a dead server.

Running your own nameservers means running your own DNS server — which needs a reliable box with a static IP. A fast NVMe VPS from Nxeon is ideal, with full root access to run BIND or PowerDNS.