Written by 10:49 am DNS

DNS Delegation

To get to the meaning of DNS Delegation, first, let’s see two things. One is the Domain Name System itself, and the second is the definition of delegation. To delegate, it means to give the right to manage, the control of some resources or tasks to another.

DNS Zones and Domains

The DNS is a hierarchy structure of domains. It starts from the root domain “.”. Underneath it, there are the TLD domains like “com”, “org”, “net” and so on. Then it is time for the domains of the second level like “co.uk” and so on. All of the domains are hosted using different DNS zones, which are globally distributed and hosted by DNS servers in different international locations.

A Domain is a unique name, like cloudns.net, in the DNS. This domain has its DNS zone which hosts all the DNS records for it – A records, AAAA records, MX records and more.

What is DNS Delegation?

DNS Delegation, also called DNS Zone Delegation, is a process of assigning authority over a domain or subdomain to different DNS servers to keep records updated. When the Authoritative DNS server to which the zone is delegated responds to DNS requests, it recursively resolves the CNAME target or responds with a referral. By delegating responsibility over a subdomain to another DNS server, an organization can receive more control over the enabling and disabling services, such as mail exchange, hosted on the subdomain.

When do you need DNS Delegation?

The DNS gives you the option to separate the namespace into different DNS zones. You can save them, copy them or distribute them to other DNS servers. There are few reasons to do it:

  • You would like to load balance by dividing one large zone into more, smaller zones. This will increase the DNS resolution and add extra security.
  • You desire to delegate management of part of your DNS namespace to another location or department in your organization.
  • Use the DNS Delegation for adding various subdomains. Use them for different purposes.
  • Delegate control of part of your DNS namespace to another location.
  • You can restructure your namespace and make other DNS servers responsible for a part of the whole information.

When you create new DNS zone, you must have delegation records in other zones that point toward the authoritative DNS servers for the new one.

The resource record information of the new DNS zone will be stored in a DNS server, which will be the primary master for that zone. You can improve the security and duplicate the zone information to another DNS server, such as Secondary DNS. It will serve as a backup DNS and will give you additional protection.

How do you delegate a subdomain?

Delegating authority over a subdomain to another organization or DNS server is a simple process. All you need to do is add NS records for the subdomain into the parent domain, pointing at the delegated server. This means that the trusted server will handle all DNS requests related to the subdomain. However, it is essential to be careful when delegating a subdomain, as any problems with the server or domain management will reflect badly on you. Therefore, it is recommended to use the “dig +norec” command on all the servers to check that the delegated server is authoritative for the subdomain before delegating it.


  • Provides an additional layer of security as delegated servers can be set up to work as a failover in the event of a system failure on the root server 
  • Delegated servers can employ more secure protocols than the root server, such as DNSSEC (Domain Name System Security Extensions) 
  • Allows organizations to create multiple backups, ensuring data and resources are fully protected in the event of an attack 
  • Reduces the attack surface by compartmentalizing the authoritative server from its clients, preventing DNS attacks

DNS Delegation example

DNS zone delegation is a process that allows organizations and companies to delegate authority over a portion of their DNS namespace to another entity. This means an external party can manage a part of a domain’s DNS settings, such as adding or removing A records or CNAME records.

There are many examples where companies delegate part of their DNS space. Such as examples are universities that have delegated a portion of their namespace for managing student email accounts. Or businesses that have delegated their Domain Name System to a third-party service provider, like ClouDNS, to provide better speed, security, and reliability for their website.

Here are some examples of what we explained above:

  • Subdomain delegation – assigning a DNS server for a specific subdomain such as ‘email.university.com’ to be managed separately from the root domain ‘university.com’.
  • Domain alias delegation – For domains in different TLDs (Top Level Domains) such as ‘example.com’ and ‘example.net’, delegating part of the DNS management to another server, allowing the same DNS records to be shared across both domains.

What is reverse DNS zone delegation?

Reverse DNS zone delegation is a process that allows organizations to delegate responsibility over a PTR (Pointer) record to a different zone within their domain name space. It is a two-step process where the organization’s name servers have first delegated the responsibility to handle the DNS records related to its domain names, then the reverse DNS zone.

Reverse DNS Delegation enables organizations to provide faster resolution for DNS requests. Furthermore, it is usually used for security and reliability purposes and for instituting adequate access control policies. By employing rDNS Delegation, organizations can have more control over how their domain and subdomains are accessed and managed.


DNS Delegation will significantly increase the performance of your DNS network. Thanks to this feature, the whole DNS is so easily scalable. It will reduce the load, increase the speed and redundancy. It is used for almost all subdomains. Knowing how to manage your DNS will increase the performance greatly.

(Visited 16,019 times, 22 visits today)
Enjoy this article? Don't forget to share.
Tags: , , , , , , Last modified: February 21, 2023