DNS Zone

A DNS zone is the unit of administrative delegation in DNS. Roughly: it's a named portion of the DNS tree that one set of nameservers is responsible for.

Zones vs domains

Casually, "zone" and "domain" are often used interchangeably, but they're not exactly the same. A domain is the namespace ("everything under example.com"); a zone is what one set of nameservers actually serves. A domain can be split across multiple zones — example.com could be one zone, with uk.example.com delegated to a different team's nameservers as its own child zone.

Zone apex

The "apex" of a zone is the top of it — for example.com, the apex is example.com itself. The apex always has an SOA record and at least two NS records. The DNS spec also forbids CNAME records at the apex.

Delegation

A parent zone delegates a child zone by publishing NS records pointing to the child's nameservers. So the com zone has NS records for example.com, example.com has NS records for uk.example.com, and so on down the tree.

Lame delegation

If the parent's NS records don't match what the child publishes (or the child's nameservers don't actually answer authoritatively), you have a "lame delegation" — resolvers will sometimes succeed and sometimes fail, depending on which nameserver they pick. It's an annoying intermittent problem.

Related: SOA record · NS record · resolver.