Zones, the apex, and subdomains

A zone is a chunk of the DNS tree that one authority manages as a unit. The zone for example.com holds the records for example.com itself and for the names under it.

The name at the top of the zone is the zone apex. For our zone that’s example.com. Dashboards usually show it as @.

Subdomains are usually just records

Here’s a common misunderstanding. www.example.com and api.example.com look like separate things, but they’re normally plain records inside the example.com zone. Same zone, same dashboard, same nameservers.

A name below the apex doesn’t become its own zone until someone delegates it.

What makes a zone a zone

A zone is an administrative boundary. Its authoritative servers publish every record in it, starting with the two records every zone must have: SOA and NS.

The DNS tree and the zone boundaries don’t have to line up. You can cut the tree wherever you want.

Say a company wants a separate team to manage team.example.com at a different DNS provider. The company publishes NS records for team.example.com in the parent zone. That’s a delegation. After it:

• the parent example.com zone only says which servers know about team.example.com
• the child team.example.com zone publishes its own records, at its own provider
• api.example.com stays in the parent zone, unaffected

Two zones, two dashboards, one domain.

Relative names in the dashboard

Record names in a zone editor are usually relative to the zone. Type www in the example.com zone and you create www.example.com. Type @ and you create data at the apex.

Some editors want the complete name instead. Check the preview before you save. Getting this wrong gives you www.example.com.example.com, which nobody visits.

Is it delegated?

You can tell whether a child name is its own zone with two queries:

dig NS team.example.com
dig +trace team.example.com

The first comes from your resolver’s cache and tells you whether an NS set exists for that name. The trace shows where the parent actually sends the lookup. If team.example.com has no delegation, the trace ends at the example.com servers.

Try this on paper: draw one zone with an apex, two ordinary subdomains, and one delegated child zone. Next to each record, write which provider’s dashboard you’d open to change it.