创建指向NS记录的NS记录：可行性、规范及相关疑问

Great question—let’s unpack each part of your scenario clearly, since DNS delegation rules can feel counterintuitive at first.

1. Can you create "pseudo-NS" records that point to real NS records? #

Absolutely, this is a common pattern used by DNS hosting providers to simplify customer onboarding. Here’s how it works in your example:

• Your customer adds an NS record for their subdomain (e.g., customer-sub.example.com NS ns1.mydomain.com)
• You then configure ns1.mydomain.com (and any other NS entries you use) with A/AAAA records pointing to your actual DNS server IPs.

This is a valid delegation setup—recursive DNS servers will follow the NS record to ns1.mydomain.com, resolve its IP, and then query that server for records under the customer’s subdomain.

2. Is this a DNS best practice? #

It’s a compromise that’s acceptable for simplifying customer workflows, but not the strictest "best practice." Here’s the tradeoff:

• The ideal best practice is to have customers delegate directly to your authoritative DNS servers’ native NS names (e.g., ns1.your-dns-service.com), which are typically registered as standalone domains with their own glue records at the registry.
• Your approach is fine if it reduces friction for customers, but you need to ensure:
  • Your mydomain.com NS entries have reliable, redundant A/AAAA records (no single points of failure)
  • You avoid using the same domain for both your NS records and a high-traffic website (to isolate DNS infrastructure from application outages)

3. Should each "pseudo-NS" point to two real NS records? #

Wait, let’s clarify the wording here—you don’t want a single NS record pointing to two targets. Instead:

• Your customer should configure multiple NS records for their subdomain (at least 2, per DNS redundancy standards) pointing to different "pseudo-NS" entries you control (e.g., ns1.mydomain.com and ns2.mydomain.com)
• Each of these pseudo-NS entries (ns1, ns2) should resolve to separate DNS server IPs (your real authoritative servers) to ensure redundancy if one server goes down.

This aligns with DNS best practices for fault tolerance.

4. Can IN NS records point to CNAMEs? #

No, this is explicitly prohibited by DNS standards (RFC 1034 and RFC 2181).

CNAME records create an alias for a domain, but NS records require a concrete, authoritative target. If you tried to point an NS record to a CNAME, recursive DNS servers would encounter ambiguity: should they use the CNAME’s target as the authoritative server, or treat the CNAME itself as the server? This breaks the delegation chain and most DNS servers will reject such a configuration outright.

内容的提问来源于stack exchange，提问作者DomE