Questions[ns-record](server)

If we have example.com we would setup things something like this:

$ORIGIN example.com.
@  1D  IN  SOA ns1.example.com. hostmaster.example.com. (
                  2002022401 ; serial
                  3H ; refresh
                  15 ; retry
                  1w ; expire
                  3h ; nxdomain ttl
                 )
          IN  NS     ns1.example.com.
          IN  NS     ns2.example.com.

since in the parent zone .com. there is already NS record for the example.com. child zone and A glue record for the ns1.example.com. for what purpose do we state NS records again in the child zone?

and also, do we need to state A record for the name servers in the child zone itself?

Hi have created a record set for the domain:

lazycatthemes.com

on Route 53 (domain was purchased through route 53) and gave it the 4 NS settings that Route 53 told me to configure:

ns-368.awsdns-46.com 
ns-1963.awsdns-53.co.uk 
ns-848.awsdns-42.net 
ns-1332.awsdns-38.org

When I check it on any one of those DNS servers using the nslookup tool it works:

nslookup lazycatthemes.com ns-1963.awsdns-53.co.uk
Server:  UnKnown
Address:  205.251.199.171

Name:    lazycatthemes.com
Address:  54.154.51.71

but this doesn't propagate. I've waited 36 hours and I still get this:

nslookup lazycatthemes.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

*** google-public-dns-a.google.com can't find lazycatthemes.com: Server failed

I'm not sure what to do next?

$ORIGIN example.com. ; not necessary, using this to self-document

$TTL 3600
@        IN     SOA   ns1.example.com. admin.example.com. (
                      1970010100 7200 1800 1209600 300)

@        IN     NS   ns1.example.com.
@        IN     NS   ns2.example.com.

@        IN     A    198.51.100.1
ns1      IN     A    198.51.100.2
ns2      IN     A    198.51.100.3

sub1     IN     NS   ns1.example.edu.

sub2     IN     NS   ns1.sub2
ns1.sub2 IN     A    203.0.113.1 ; inline glue record

The role of a NS record beneath the apex of a domain is well-understood; they exist to delegate authority for a subdomain to another nameserver. Examples of this above would include the NS records for sub1 and sub2. These allow the nameserver to hand out referrals for portions of the domain that it does not consider itself authoritative for.

The purpose of the NS records at the apex of a domain, ns1 and ns2 in this case, seem to be less understood by the internet at large. My understanding (which may not be holistic) is as follows:

1. They are not used by caching DNS servers in order to determine the authoritative servers for the domain. This is handled by nameserver glue, which is defined at the registrar level. The registrar never uses this information to generate the glue records.
2. They are not used to delegate authority for the entire domain to other nameservers. Trying to do so with software such as ISC BIND will not result in the "expected" referral behavior at all, as the nameserver will continue to consider itself authoritative for the zone.
3. They are not used by the nameserver to determine whether it should return authoritative responses (AA flag set) or not; that behavior is defined by whether the software is told to be a master or a slave for the zone. Most nameserver software will quite happily serve apex NS records that disagree with the information contained by the upstream glue records, which will in turn cause well-known DNS validation websites to generate warnings for the domain.

With this being the case, what are we left with? Why are we defining this information if it doesn't appear to be consumed by caching DNS servers on the internet at large?

Is it allowed to have an NS record be a CNAME? E.g.:

subdomain.example.com.       IN NS  ns1.example.com.
ns1.example.com.             CNAME  foo.example.com.
foo.example.com.             IN A   10.1.1.1

This doesn't seem to work in bind though this (of course) does:

subdomain.example.com.       IN NS  foo.example.com.
foo.example.com.             IN A   10.1.1.1

Any pointers to RFCs prohibiting this setup would be appreciated.

I've seen a few guides out there, but I could not get any of them to work. I can point NS records to my domain, so it sounds like I should be able to do this. I tried setting up a DMZ for the server portion, no luck at all.