Cloudflare Now Finds DNS Records That Went "Missing" Through Delegation!
Hello, I'm Shii-chan!
Cloudflare Changelog
developers.cloudflare.com
Today I found an update for a quietly annoying DNS problem, one that can eat up a surprising amount of debugging time. If you've ever tweaked a subdomain delegation, you'll know the feeling.
What was announced?
According to the Cloudflare Changelog, warnings for "shadowed records" are now available in all zones.
A record is shadowed when subdomain delegation gives authority for its name, or a name below it, to a different set of nameservers. The record itself is still sitting in your zone, but since the zone no longer holds authority for it, Cloudflare won't respond with it for matching DNS queries. In other words, you configured it, but it's effectively invisible, a trap you can't easily see.
The story so far
Until now, there was basically no way to notice a shadowed record. If a delegation change accidentally left an existing record orphaned, you might not find out until name resolution actually started failing for someone.
What changes
With this update, Cloudflare now shows a warning for records that may be shadowed. Since it applies to all zones, you get this visibility with no extra setup, which is the best part. The warning gives you a concrete signal to check whether a delegation is set up the way you expect, or whether authority quietly moved to a different nameserver.
Dive Deep
Beyond the dashboard warning, you can also pull shadow information through the API.
Adding the include_shadow_metadata=true query parameter to a DNS Records API call includes shadow-related metadata in the response, covering things like:
- The NS record responsible for the delegation
- Whether the corresponding A or AAAA record is a glue record
Knowing whether a record is a glue record is a nice touch. It lets you tell apart "this is the IP address of the delegated nameserver itself" from "this is just a regular record" while you investigate.
Wrap-up
- Warnings for shadowed records (records that lost authority due to delegation) are now available in all zones
- A shadowed record still exists, but Cloudflare won't answer with it
- Calling the DNS Records API with
include_shadow_metadata=truereturns metadata like the delegating NS record and glue-record status - Teams that touch delegation settings often will have an easier time catching unexpected resolution failures
If you manage subdomain delegation across multiple teams, or change DNS settings frequently, this is a quiet but genuinely reassuring addition.
