Resolve a Subdomain BAD (HORIZONTAL) REFERRAL Error in UltraDNS

Overview

This article explains how to troubleshoot a subdomain lookup that repeatedly returns the same nameserver referral and displays BAD (HORIZONTAL) REFERRAL in a DNS trace.

In the documented example, the parent zone contained NS records delegating the subdomain to UltraDNS nameservers, but the separate subdomain zone did not exist.

The source article provides two resolutions: remove the subdomain delegation and retain the records in the parent zone, or create the separate subdomain zone and retain the delegation.

Symptoms

• A lookup for a newly configured subdomain does not complete successfully.
• A DNS trace repeatedly returns the same NS records for the subdomain.
• The trace displays BAD (HORIZONTAL) REFERRAL.

Check the DNS Trace

Run the following command on a computer with dig installed. Replace sub.example.com with the affected subdomain.

dig sub.example.com +trace +nodnssec

The following excerpt shows the repeated referrals from the source example. The domain has been replaced with example.com.

sub.example.com. 86400 IN NS pdns78.ultradns.net.
sub.example.com. 86400 IN NS pdns78.ultradns.com.
sub.example.com. 86400 IN NS pdns78.ultradns.org.

sub.example.com. 86400 IN NS pdns78.ultradns.net.
sub.example.com. 86400 IN NS pdns78.ultradns.com.
sub.example.com. 86400 IN NS pdns78.ultradns.org.
;; BAD (HORIZONTAL) REFERRAL

sub.example.com. 86400 IN NS pdns78.ultradns.net.
sub.example.com. 86400 IN NS pdns78.ultradns.com.
sub.example.com. 86400 IN NS pdns78.ultradns.org.
;; BAD (HORIZONTAL) REFERRAL

The nameservers above belong to the source example. Do not copy them into your configuration.

Why This Happened in the Documented Example

A parent zone is the zone containing the subdomain delegation. In this example, example.com is the parent zone.

A child zone is a separate zone for the delegated subdomain. In this example, the child zone would be sub.example.com.

The parent zone contained NS records for sub.example.com, but no separate sub.example.com zone existed. The source article identifies this configuration as the cause of the repeated referrals.

The error message alone does not establish that a child zone is missing. Check the parent-zone NS records and confirm whether the separate child zone exists before selecting a resolution.

Resolution: Keep the Records in the Parent Zone

Use this resolution when you want to manage the subdomain records within example.com, without a separate sub.example.com zone.

1. Locate the NS records for sub.example.com inside the example.com zone.
2. Delete those subdomain NS records.
3. Retain the other resource records for sub.example.com in the parent zone.

Important: This change applies to the NS records for sub.example.com. Do not delete the NS records for the parent zone, example.com.

Resolution: Create a Separate Child Zone

Use this resolution when you want to manage sub.example.com as a separate zone.

1. Create a new zone named sub.example.com.
2. Create the required resource records for sub.example.com in the new child zone.
3. Retain the NS records for sub.example.com in the parent zone, example.com.
4. After creating the required records in the child zone, delete the other resource records for sub.example.com from the parent zone. Retain the subdomain NS records.

Verify the Result

Run the trace again using the affected subdomain.

dig sub.example.com +trace +nodnssec

Confirm that the trace no longer repeats the same referral with BAD (HORIZONTAL) REFERRAL.

Query a record that you configured for the subdomain and compare the response with the configured value. For example, if you configured an A record:

dig sub.example.com A