A subdomain added shortly after its parent domain gets the parent's nameservers instead of its own. The operator caches registry lookups by registered domain for 15 minutes and returns that cached answer for any name under it, so the subdomain's own delegation is never checked. The wrong answer is then kept until the next registration refresh, 24 hours later by default. While it's wrong, load balancers on that subdomain won't create DNS records, and nothing tells the user why.
What happened
A user on production had a parent domain and a subdomain delegated to Datum's nameservers, both in the same project.
- They added the parent domain at 10:39:59. The registry lookup returned the parent's nameservers, which point at a different set of servers, and the operator cached that for 15 minutes.
- They added the delegated subdomain at 10:51:48, inside that window. It got the cached parent answer. Its own nameservers, Datum's, were never looked up.
- They added a custom hostname on the subdomain to a load balancer. The operator compared the subdomain's recorded nameservers with its zone's, found no overlap, and skipped the record.
- The next refresh for that subdomain is scheduled 24 hours after it was created.
An hour and a half later the same user created a second delegated subdomain under the same parent, set up the same way. Nothing had looked up the parent for more than 15 minutes, so it got a fresh lookup, its real nameservers, and a working DNS record straight away. That's what made this look like a leftover from a deleted project when it's really about timing.
Why it matters beyond this user
The cache is shared across the whole process, not per project. Any customer who adds a subdomain within 15 minutes of anyone looking up the same parent domain, or a sibling subdomain, gets that other name's nameservers. It can go the other way too: after a delegated subdomain is looked up, the parent domain can be handed the subdomain's nameservers.
When the subdomain's own lookup fails, the operator also falls back to the parent's nameservers without saying so, and that answer is kept for the full refresh interval as well.
What success looks like
- Each name gets its own nameserver lookup. Registration data can still be shared across names under the same registered domain.
- A domain with a zone on Datum whose recorded nameservers don't match that zone is rechecked after a few minutes, backing off towards the normal interval, instead of waiting a day.
- When a zone becomes ready or its nameservers change, the matching domain is rechecked straight away, skipping the cache.
- A failed subdomain lookup is retried rather than silently replaced by the parent's answer for a day.
Workaround
Setting the domain's requested refresh time to now forces a fresh lookup that skips the cache. Deleting and re-adding the domain also works, but only if nothing has looked up the parent in the last 15 minutes.
Related
A subdomain added shortly after its parent domain gets the parent's nameservers instead of its own. The operator caches registry lookups by registered domain for 15 minutes and returns that cached answer for any name under it, so the subdomain's own delegation is never checked. The wrong answer is then kept until the next registration refresh, 24 hours later by default. While it's wrong, load balancers on that subdomain won't create DNS records, and nothing tells the user why.
What happened
A user on production had a parent domain and a subdomain delegated to Datum's nameservers, both in the same project.
An hour and a half later the same user created a second delegated subdomain under the same parent, set up the same way. Nothing had looked up the parent for more than 15 minutes, so it got a fresh lookup, its real nameservers, and a working DNS record straight away. That's what made this look like a leftover from a deleted project when it's really about timing.
Why it matters beyond this user
The cache is shared across the whole process, not per project. Any customer who adds a subdomain within 15 minutes of anyone looking up the same parent domain, or a sibling subdomain, gets that other name's nameservers. It can go the other way too: after a delegated subdomain is looked up, the parent domain can be handed the subdomain's nameservers.
When the subdomain's own lookup fails, the operator also falls back to the parent's nameservers without saying so, and that answer is kept for the full refresh interval as well.
What success looks like
Workaround
Setting the domain's requested refresh time to now forces a fresh lookup that skips the cache. Deleting and re-adding the domain also works, but only if nothing has looked up the parent in the last 15 minutes.
Related