NS delegation is the DNS mechanism that assigns authority for a domain or subdomain to specific name servers. The parent zone publishes NS records, and resolvers then query the delegated servers for that portion of the namespace, which separates administrative control and affects how DNS changes propagate.
How NS Delegation Works
NS delegation is the DNS handoff that tells resolvers which name servers are authoritative for a domain or subdomain. It creates a boundary of control inside the namespace, so the child zone can be administered separately from the parent.
The practical effect is simple: the parent zone points to the delegated servers, while the delegated servers answer queries for that part of the tree. That separation is what makes large DNS estates manageable, but it also means the delegation chain itself becomes part of the trust path.
Because resolvers follow referrals, NS delegation is not just a record type, it is the mechanism that determines where authority lives. When the delegation is incorrect, stale, or redirected, users may be sent to the wrong authoritative source even if the rest of the zone is healthy.
Why Delegation Matters for DNS Control
Delegation is the point where operational ownership and DNS authority diverge from the parent zone. That matters for any organisation that uses external DNS providers, regional hosting, managed DNS services, or separate teams for subdomains, because a change in one layer does not automatically update the other.
It also affects how fast and how safely DNS changes propagate. A delegation can remain technically valid while still pointing to obsolete name servers, which is why authoritative DNS management needs continuous review rather than one-time setup.
For organisations that want a deeper view of DNS authority boundaries and registrar-side hardening, Authoritative DNS and Registrar Account Security Guide is a useful companion reference.
Security Implications of NS Delegation
NS delegation is security-sensitive because it defines which servers resolvers are willing to trust for a zone. If an attacker can alter delegation at the parent, compromise the delegated name servers, or exploit weak registrar controls, they can influence where traffic and validation logic go.
This makes delegated zones attractive targets for DNS hijacking, traffic redirection, and service disruption. Even without changing records inside the child zone, control over the delegation path can break availability, intercept lookups, or create persistent misdirection.
Delegation security also depends on operational hygiene around registrar access, authoritative DNS credentials, and monitoring of related changes such as NS, glue, and DS records. A healthy child zone can still be undermined if the parent continues to refer resolvers to the wrong authority.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | NS delegation changes depend on tightly controlled DNS and registrar accounts. |
| Recommendation — Restrict and review DNS and registrar account access that can modify delegation records. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Delegation authority is exercised through managed administrative accounts. |
| AC-6 — Least Privilege | Delegation changes should be limited to only the roles that need DNS authority. | |
| IA-5 — Authenticator Management | Protecting the accounts that control delegation depends on secure authenticator lifecycle management. | |
| Recommendation — Review and limit accounts that can change authoritative DNS delegation. Assign only the minimum privileges needed to manage DNS delegation and registrar settings. Enforce strong authenticator and secret management for DNS and registrar access. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Delegation governance depends on controlled administrative access to DNS authority. |
| A.8.20 — Network security | Delegation affects the DNS trust path that underpins network name resolution. | |
| Recommendation — Apply access control rules to DNS and registrar systems that can alter delegation. Protect DNS resolution paths and authoritative name server exposure as part of network security. | ||
Practitioner Guidance
Why practitioners should care: Treat delegation changes as high-impact DNS events, because they alter which servers speak for the namespace and can outlive the intended change window if left unchecked. The safest posture is to verify both the parent zone and the delegated zone after every change.
What to watch for: Unexpected NS edits, inconsistent glue records, stale provider references, and delegation drift between registrar data and authoritative zone contents are the main warning signs. These often surface first as intermittent resolution failures, inconsistent answers across resolvers, or sudden loss of authority for a subdomain.
Practitioner takeaway: Own delegation as part of DNS governance, not as a routine record update, because the security outcome depends on the full chain from registrar to authoritative servers.