LEARN. PRACTICE. GROW.Draw the parent-child boundary
A direct query to a known IP removes an important step: discovering where authority lives. Draw fund.test as parent, child.fund.test as delegated zone and the NS advertised for that zone. Record who manages each side. If a provider updates the parent and another team updates the child, the same technical change may need two approvals. The diagram should explain what information a fresh resolver receives first and which address it uses to contact the next server.
Glue is a bootstrap address
If the server is named ns.child.fund.test, discovering its address only inside the child creates a circular dependency. Glue published by the parent helps reach that authority. In this example, moving the server from 192.0.2.10 to 192.0.2.53 requires considering the initial information the parent supplies. Updating A inside the child can leave the parent stale. For a nameserver under provider.test, examine resolution of that external domain; do not indiscriminately apply the same internal-dependency explanation.
Compare destinations with a simple matrix
Build a table with one row per nameserver address: test origin, received SOA, flags, application RRset and timestamp. Use the same name and type for comparison. If ns1 returns.27 and ns2 returns.28, check for intentional balancing or incomplete publication. The serial helps investigate versions but is not a hash of served content. Two equal values do not cancel divergent RRsets. Also record servers that do not answer rather than excluding them from the conclusion.
A referral can be incomplete
In the lab, referral shows NS in authority and an address in additional. That packet was constructed to study interpretation, not to traverse a real hierarchy. In an authorized investigation, check TC before concluding that the parent lacks addresses. RFC 9471 addresses including available glue and signaling truncation when it does not fit. A complete response over another transport may change the interpretation. Preserve both observations and avoid turning absence in a partial packet into absence of configuration.
Close the change using path evidence
An NS change needs separate criteria: consistent publication, working discovery and consumer recovery. Plan feasible overlap, delegation caches and ownership of each change. A trace from a public network may not reproduce forwarding or private views used by a batch job through VPN. In the report, identify the path actually tested. A successful direct query is useful evidence, but it is insufficient for retiring old servers or declaring recovery across every origin and consumer group.
# The lab emits a synthetic referral only.
# Compare observations.referral with observations.nodata.
# It does not follow the glue address 192.0.2.53.
# Real hierarchy traversal requires an authorized separate environment.Fictional case:.53 answers correctly, but the parent supplies.10 glue. The team assigns the update to the parent provider and observes discovery and direct queries before closure.
Common pitfalls
Do not infer convergence from one authority, equal serials or a trace from a different origin. Do not use a cache flush to conceal divergent publication.
Related topics: Resolver, authority, and client context · TTL, negative caching, and controlled change · DNS transport and DNSSEC validation
Validate data and discovery, compare all relevant authorities and assign each correction to the team controlling that part of the path.
Reference: RFC 9471 · DNS RFC 1034/1035 with RFC 2181, 2308, 3596, 4033, 7766 and 8767; dig BIND 9.20