Subdomains and zone delegation

A subdomain such as shop.example.co.uk can exist in two ways. Either it is just a set of records inside the example.co.uk zone (an A record, a CNAME), or it is delegated: the parent zone holds NS records for shop.example.co.uk and a different set of nameservers, possibly run by a different organisation, answers for everything beneath it.

How to tell

The DNS facet queries the authoritative nameservers for the name you enter. If shop.example.co.uk shows its own NS records that differ from the parent's, it is delegated. If it only shows A, CNAME or other records, it lives in the parent zone.

Consequences of delegation

• Nameserver consistency is checked against the child's nameservers, not the parent's. Lame delegation (a nameserver listed in the parent that does not actually answer authoritatively) is a finding on its own.
• DNSSEC needs a DS record in the parent for the child zone. A signed parent and an unsigned child is fine (the parent proves there is no DS); a signed child without a DS in the parent gives no protection.
• Glue: if the child's nameservers are inside the child (ns1.shop.example.co.uk), the parent must carry their addresses as glue records or resolvers cannot find them.
• Changing the parent's provider does not move a delegated child; changing the child's provider requires updating the NS records in the parent.

CNAME at the apex

A zone's apex (the bare example.co.uk) cannot be a CNAME, because the apex must hold SOA and NS records and a CNAME forbids other records at the same name. Providers offer ALIAS/ANAME or CNAME-flattening records instead; the DNS facet flags an apex CNAME because many resolvers handle it unpredictably.