Glossary
What Is Lame Delegation?
Published Last updated
A lame delegation is a domain pointed at a nameserver that will not answer authoritatively for it. The delegation exists, the answer does not, and the gap is something an attacker can fill.
A delegation is lame when the parent zone names a nameserver for a domain and that nameserver does not serve the zone: it refuses, it returns a non-authoritative answer, or it no longer exists at all. Resolution still works as long as one of the other delegated nameservers answers, so a lame delegation is invisible to anyone just loading the site.
It matters because it is a gap with a shape. If the lame nameserver is a hostname that has itself lapsed, whoever registers that hostname next inherits authority over the zone that still delegates to it. That is a takeover of the domain, achieved without touching the domain. Lame delegations also accumulate quietly at organisations that migrate DNS providers and leave the old records in place.
Finding them is a traversal, not a flag: walk NAMESERVER_FOR from a domain to each nameserver it delegates to, and check that each of those nameservers still resolves and still answers for the zone. WhisperGraph carries the delegation edges and the resolution for both sides, so the comparison is one query rather than a round of manual digs.
See it in practice
Run it live: Detect nameserver hijacks and DNS inconsistency.
Workflows that use this
Runnable workflows where this concept does the work.
Nameserver & DNS Delegation Audit
Your name servers decide where your domain points — and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts — so you can catch delegation weakness before it's exploited.
