Subdomain delegation lets a different DNS service manage part of your domain. For example, example.com stays in cPanel while dev.example.com is handed to a cloud DNS service your developers control. You do it by adding NS records for the subdomain in the parent zone. This guide shows how.
Before you start
- Access to the DNS zone of the parent domain (for example cPanel's Zone Editor).
- The subdomain zone created at the other provider, with its nameserver names.
How delegation works
When a resolver asks for api.dev.example.com, the parent zone answers "dev.example.com is served by these nameservers" (a referral). The resolver then asks those nameservers. The parent no longer answers for anything under dev.
Step 1: create the zone at the new provider
- At the new DNS service, create a zone named
dev.example.com. - Note the nameservers it assigns, e.g.
ns-1.clouddns.exampleandns-2.clouddns.example. - Add the records you need in that zone (A, CNAME, TXT…).
Step 2: add NS records in the parent zone
dev.example.com. 3600 IN NS ns-1.clouddns.example.
dev.example.com. 3600 IN NS ns-2.clouddns.example.In cPanel: Domains → Zone Editor → Manage → Add Record, type NS, name dev.example.com., and the nameserver as the value. Repeat for each nameserver.
Step 3: remove conflicting records
Delete any other records for dev.example.com or names below it in the parent zone (for example an existing A record for dev). Once delegated, the parent's copies are ignored and only confuse things.
Glue records (only if needed)
If the subdomain's nameservers are inside the subdomain itself (for example ns1.dev.example.com), the parent must also publish their A records as glue:
dev.example.com. IN NS ns1.dev.example.com.
ns1.dev.example.com. IN A 203.0.113.10With external nameserver names (the usual case for cloud DNS), no glue is needed.
DNSSEC
If the parent zone is signed and you want the subdomain signed too, add a DS record for dev.example.com in the parent zone with the values from the new provider. Without a DS record, the subdomain is simply treated as unsigned.
Test the delegation
- Referral from the parent:
dig @parent-ns.example.com dev.example.com NS - Full path:
dig api.dev.example.com +trace - Answer from the child:
dig @ns-1.clouddns.example api.dev.example.com +short
Troubleshooting
- SERVFAIL or REFUSED: the zone doesn't exist at the new provider or the NS names are wrong.
- Old answers still appear: the parent zone still has records for the subdomain, or resolvers cache old data until the TTL ends.
- Lame delegation: one listed nameserver doesn't serve the zone – fix or remove it.
FAQ: subdomain delegation
Why delegate instead of adding records in the main zone?
It gives another team or service full control of that subdomain (including automation via its API) without access to your main domain.
Can I delegate the www subdomain?
Yes, but it's uncommon; usually a CNAME is simpler for single hostnames.
Does delegation affect email for the main domain?
No. Only names at or below the delegated subdomain move.