# Find Cloudflare records shadowed by a subdomain delegation before editing their values

> A record can remain visible in the parent zone while another nameserver set is authoritative for it.

- Canonical URL: https://update.dsesecurity.com/updates/find-cloudflare-records-shadowed-by-a-subdomain-delegation-before-editing-their-values/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:54+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A record can remain visible in the parent zone while another nameserver set is authoritative for it.

## Potentially affected

This concerns Cloudflare delegation diagnostics and shadow metadata.

## DSE recommendation

DSE recommends checking the authoritative boundary before changing an apparently ineffective address.

## Article

A record can remain visible in the parent zone while another nameserver set is authoritative for it.

## Source facts

Cloudflare documents that an NS delegation moves authority for the delegated name and its descendants. Records retained at or below that point can be shadowed even though they still appear in the zone. Shadow metadata identifies the affected records and delegations when requested. Required in-zone A/AAAA glue is a special case and can still be served in referral responses.

Source: [Cloudflare — Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records/).

## Applicability

This concerns Cloudflare delegation diagnostics and shadow metadata.

## DSE recommendation

DSE recommends checking the authoritative boundary before changing an apparently ineffective address. Locate the child zone owner and edit the record at the nameservers that actually serve it. Preserve required glue and document any stale parent copies for controlled cleanup. Treat a newly added NS delegation as an impact change for every descendant record, not just the visible NS row. Have the parent and child DNS owners review the same authority diagram before cleaning up retained rows. Mark each candidate deletion as obsolete data or required glue, with an owner for the classification. Keep a referral trace so the reason for editing the child rather than the parent remains reproducible.

## Verification

Trace an approved hostname through the delegation and compare the parent’s stored row with the child’s authoritative answer. Request the relevant shadow metadata and inspect any glue dependency. Confirm the final answer comes from the intended authority, then verify the application without using repeated parent-zone edits as a substitute for fixing the delegation boundary.

## Official reference

[Cloudflare — Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Shadowed records
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Find Cloudflare records shadowed by a subdomain delegation before editing their values,” DSE Security, https://update.dsesecurity.com/updates/find-cloudflare-records-shadowed-by-a-subdomain-delegation-before-editing-their-values/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.