On Sun, Aug 2, 2020 at 6:43 PM John Petrini <jpetrini@coredial.com> wrote:
I believe what you're seeing is normal behavior. If you ran that query
against a TLD you'd get the NS servers of the TLD in the answer
section but I don't believe it works that way when delegating
subdomains.

I just tested in my environment and when I query an a-record in the
delegated subdomain the proper NS records appear in the authority
section but I do not get a response querying for NS records directly
against a delegated subdomain.

Shouldn't my TLD tell the client where to get that record though?

In my case I have cloud.chx and I delegated ad.cloud.chx to my Windows DNS server.

When a query comes to the NS of cloud.chx it should get that answer from the NS of ad.cloud.chx right? There's something I must be missing on the IPA side because when I try this setting from a BIND to BIND set up...it works as expected.

[root@ns1 ~]# dig test.ad.example.com

; <<>> DiG 9.11.21-RedHat-9.11.21-1.fc32 <<>> test.ad.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56885
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: bcf0f0a951a4c7fc9bac74fd5f29c35a5305f69d279f3827 (good)
;; QUESTION SECTION:

;; ANSWER SECTION:
test.ad.example.com. 604628 IN A 172.16.1.101

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:
dc1.ad.example.com. 604358 IN A 172.16.1.206

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Aug 04 13:21:46 PDT 2020
;; MSG SIZE  rcvd: 126

 On my IPA server, this setup (this is the live setup) isn't working...

[root@ipa1 ~]# dig dc1.ad.cloud.chx 

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> dc1.ad.cloud.chx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64904
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dc1.ad.cloud.chx. IN A

;; Query time: 13 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Aug 04 13:24:16 PDT 2020
;; MSG SIZE  rcvd: 45

[root@ipa1 ~]# dig cloud.chx AXFR | grep dc1
ad.cloud.chx. 86400 IN NS dc1.ad.cloud.chx.
dc1.ad.cloud.chx. 86400 IN A 192.168.1.253