What are the changes made to gTLD registry DNS servers in relation to my domain?

Question

Let's say that I register myself an example.com domain at one of the domain registrars and in domain registrars web-portal, I decide to use ns1.digitalocean.com, ns2.digitalocean.com and ns3.digitalocean.com name servers. Now what are the changes made to Verisign DNS servers? I guess simply following three NS records in their huge com zone file:

example.com.           172800  IN      NS      ns1.digitalocean.com.
example.com.           172800  IN      NS      ns2.digitalocean.com.
example.com.           172800  IN      NS      ns3.digitalocean.com.

Is there something else? Or have I misunderstood something?

Answer 1

If you use out-of-bailiwick nameservers (like in your test case) and you do not use DNSSEC (you did not say) then you are right, the 3 NS records will be the only things inserted in the parent zone related to your domain.

1) Out-of-bailiwick nameservers

As long as you use nameservers that are not "in" your own zone, you are using out-of-bailiwick nameservers and hence the registry does not need to publish glue records.

On the contrary, if you decided to use ns1.example.com as nameserver for example.com, then, to resolve the chicken-and-egg problem you just created, the registry will also need to publish a glue record for ns1.example.com which just means basically one or multiple A or AAAA records for this nameserver. This will of course need to be done through the registrar.

And you will need later to make sure that this gets updated each time the IP addresses of this server change, otherwise major problems will occur.

2) DNSSEC

If you decide to activate DNSSEC on your domain, then the parent zone needs to publish one or more DS records for your zone. This is again done through the registrar but it also depend on what the registry wants to receive (basically either a DS or a DNSKEY, in the latter case it means the registry generates the DS by itself from the DNSKEY), and which algorithms they allow (which change your list of options for your DS/DNSKEY records).

The registry will also publish RRSIG records on your DS record(s), to enable the whole chain of trust that validating resolvers will be able to check at each DNS exchange.

The NS records themselves are not covered by RRSIG records, irrespective to the fact that they are in the AUTHORITY section (but they are signed inside the child zone of course). And glue records, that is A+AAAA records corresponding to targets of the NS records are in the ADDITIONAL section, and so without associated RRSIG records also. (see https://www.slideshare.net/edizdar/dnssec-3980994#58)