DNS delegation assigns responsibility for a subdomain or subzone to separate nameservers. The parent domain’s DNS records identify those nameservers, which can then manage records within the delegated portion without changing the parent zone.
Delegation supports distributed administration, but it also creates a security boundary to monitor. If an attacker gains access to the parent domain’s DNS settings, they may redirect a subzone to nameservers they control. That can enable malicious subdomains under a trusted domain while the main website continues to work. Defenders should review delegation changes, verify that listed nameservers are authorized, and monitor subordinate records for unexpected content or destinations.