TLD Nameservers
The second tier of DNS delegation. TLD nameservers manage the namespace beneath each top-level domain — directing resolvers to the authoritative nameservers responsible for each registered domain within that TLD.
The Registry Tier
When a recursive resolver asks a root server about thedns.guru, the root server responds with a referral to the .guru TLD nameservers. These servers are operated by the registry — the organization that manages the entire .guru namespace.
TLD nameservers hold NS (delegation) records for every registered domain in that TLD. They know which authoritative nameservers are responsible for each domain, but — like root servers — they do not hold the final A, AAAA, MX, or TXT records for individual domains. They only point resolvers to the right authoritative nameserver.
A TLD typically runs multiple nameservers for redundancy. For example, the .com TLD is served by a.gtld-servers.net through m.gtld-servers.net — 13 servers operated by Verisign.
Types of Top-Level Domains
TLDs fall into several categories with different governance models
Generic TLD
Open to any registrant worldwide. The original set (.com, .net, .org, .edu, .gov, .mil) was defined in RFC 920 in 1984. Today there are over 1,200 gTLDs.
Country-Code TLD
Two-letter codes assigned to each country or territory per ISO 3166-1. Managed by the country's designated registry, which sets its own registration policies.
New Generic TLD
ICANN's New gTLD Program (launched 2012) opened the namespace to custom extensions. Over 1,200 new gTLDs were delegated, including brand, city, and industry TLDs.
Sponsored TLD
Restricted to communities or organizations meeting specific eligibility criteria. Governed by a sponsoring organization that establishes registration policies.
Major Registry Operators
Who operates the nameservers for the most popular TLDs
| TLD(s) | Registry Operator | Nameservers | Notes |
|---|---|---|---|
| .com, .net | Verisign | a–m.gtld-servers.net | Largest registry by volume. ~160M+ .com domains. DNSSEC signed. |
| .org | Public Interest Registry (PIR) | a0–b2.org.afilias-nst.org | Non-profit steward of .org since 2003. Acquired by Ethos Capital deal blocked by ICANN 2020. |
| .uk | Nominet | nsa–nsd.nic.uk | UK ccTLD. Also operates .co.uk second-level registrations directly. |
| .de | DENIC | a.nic.de – f.nic.de | German ccTLD registry, member-owned cooperative. Largest ccTLD by volume. |
| .guru, .app, .dev | Identity Digital (formerly Donuts) | Various nic.tld servers | Largest new gTLD operator with 300+ TLDs in portfolio. |
| .io | NIC.IO / Afilias | Various | ccTLD for British Indian Ocean Territory; popular with tech startups. Transfer to IANA pending. |
Domain Registration & TLD Delegation
What happens when you register a domain — from purchase to DNS delegation
Registrant selects a domain
A user searches for "thedns.guru" at a registrar (e.g., Namecheap, GoDaddy). The registrar checks real-time availability via the registry's EPP (Extensible Provisioning Protocol) interface.
Registrar submits to Registry via EPP
On purchase, the registrar sends a signed EPP <domain:create> command to the .guru registry (operated by Donuts / Identity Digital). The registry creates the domain object in its database.
Registry updates TLD zone
The registry adds NS glue records for the domain to the .guru zone file. Zone changes propagate to TLD nameservers typically within minutes. The TLD zone SOA serial is incremented.
TLD nameservers serve the delegation
Now, when any recursive resolver queries the .guru TLD nameservers for "thedns.guru NS", they receive the authoritative nameserver records for that domain — completing the delegation chain.
Root zone updated (if needed)
The root zone already has the .guru TLD delegation (added when .guru was first delegated in 2014). No root zone change is needed for individual domain registrations — only new TLD delegations require root zone updates.
Glue Records — Breaking the Chicken-and-Egg Problem
How TLD nameservers resolve in-bailiwick nameserver addresses
A "glue record" is an A or AAAA record included in the additional section of a TLD's referral response when the authoritative nameserver is itself within the delegated zone.
The problem: If your domain is example.com and your nameservers are ns1.example.com, a resolver cannot look up ns1.example.com's IP without first talking to example.com's nameserver — a circular dependency.
The solution: When you register these nameservers, your registrar also submits their IP addresses ("glue") to the TLD registry. The .com TLD nameservers then include these A records in referral responses, giving resolvers the IP without needing an extra lookup.
ns1.cloudflare.com, the .com TLD doesn't need to provide glue — the resolver can look up cloudflare.com independently.Querying TLD Nameservers
Find TLD nameservers
Find .com TLD servers
Check glue records
WHOIS / RDAP lookup
Related Topics
Root servers delegate to TLD nameservers by returning NS records for each TLD zone.
Authoritative NameserverTLD nameservers hold the NS glue records that point to each domain's authoritative nameservers.
Recursive ResolverRecursive resolvers query TLD nameservers during iterative resolution after the root referral.