Glue records, delegation and DNSSEC

A few more advanced concepts round out authoritative DNS:

• Delegation — you can hand a subdomain to another set of nameservers using NS records (e.g. delegate dev.example.com to a separate DNS provider). The parent zone points down; the child zone becomes authoritative for that branch.
• Glue records — when your nameserver's own name lives inside the domain it serves (e.g. ns1.example.com serving example.com), the registry must publish the nameserver's IP as a glue record to break the chicken-and-egg lookup. Glue is set at the registry/registrar level, not in the zone. Most customers using Transcom's nameservers never touch glue.
• DNSSEC — cryptographically signs your zone so resolvers can verify answers haven't been forged. It works by publishing a DS record at the registry that chains to the signing keys. DNSSEC protects against cache-poisoning attacks.

These features exist for the cases that need them; for a typical website and mailbox you'll never have to think about glue or delegation.