Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesA subdomain such as test.example.com is a DNS name; it is not automatically a separate administrative boundary. Its records can stay in the example.com zone, or the parent zone can delegate that name to a separately managed child zone. Keep records in the parent when simple naming is all you need and its permissions are sufficiently scoped. Delegate a child zone when another team or account needs to manage non-production DNS without routine write access to parent-zone records.
What is the difference between a subdomain and a DNS zone?
A subdomain is a name beneath another DNS name. For example, test.example.com is beneath example.com. A DNS zone is the set of names and records managed by an authoritative DNS service. The subdomain’s records may be held in the parent zone, so creating test.example.com records alone does not create a separate management boundary.
As an Amazon Associate I earn from qualifying purchases.
To manage test.example.com as a child zone, configure that zone with its own authoritative nameservers and add an NS record for test.example.com in the parent zone. That parent-side delegation directs resolvers to the child zone for the delegated name and names beneath it. See AWS Route 53’s subdomain routing guide and Cloudflare’s documentation on subdomain setup and available delegation setups.
Recommended Free Tools
Should you create a separate zone for staging?
Base the choice on who needs to change DNS, not just on the fact that an environment is called staging or test.
#1 Best Overall
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
| Consideration | Records in the parent zone | Delegated child zone |
|---|---|---|
| Write access | Same zone; the boundary depends on the DNS provider’s permission model. | Can be managed separately. AWS documents that IAM permissions can restrict access to a subdomain hosted zone. |
| Parent-zone authority | No child-zone NS delegation is needed. | A trusted owner or controlled process must be able to change the parent NS record. |
| Operational work | Fewer zones and no delegation setup. | Requires a child zone, record inventory and migration, delegation validation, and clear ownership. |
| Resolution | Answers come from the existing authoritative zone. | Resolvers follow the delegation; AWS notes an extra referral on the initial lookup. |
| Provider features | Uses the existing zone configuration. | Check DNSSEC and DS records, certificates, access products, and CDN or security behavior before splitting. |
Keep staging records in the parent when
- The same trusted team manages production and non-production DNS.
- The provider lets you grant sufficiently narrow permissions for the required records.
- A separate zone would add handoffs and operational work without meaningfully changing who can write.
Delegate a child zone when
- A different team, account, or provider needs routine control of non-production names.
- You want to limit that team’s direct write access to the parent zone.
- You can keep the parent-zone delegation under a separate trusted owner or controlled automation path.
AWS describes this permission boundary directly: “When you use a separate hosted zone to route traffic for a subdomain, you can use IAM permissions to restrict access to the hosted zone for the subdomain.” That narrows day-to-day zone access; it does not remove the need to protect the parent NS change.
Does delegation keep test DNS changes away from production?
It separates DNS authority for the delegated name and can narrow who is allowed to edit its records. It does not, by itself, isolate application deployments, credentials, network access, or resolver visibility. A non-production record can still point to production infrastructure, and a change to the parent delegation can redirect authority for the child names. Treat DNS delegation as an administrative boundary, not as complete environment isolation.
Rank #2
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
How to delegate a subdomain without granting parent-zone write access
- Decide the ownership boundary. Identify who will manage the child zone and who will approve or perform parent-zone NS changes. A child-zone operator does not automatically need parent-zone permissions.
- Create the child zone. In the DNS provider that will host it, create a zone for the exact delegated name, such as
test.example.com, and record its assigned authoritative nameservers. - Inventory and copy the records. Move every required record at and beneath the delegated name, including deeper names such as
api.test.example.com. Check service records as well as address records. - Publish the delegation in the parent. Add the child zone’s NS record at
test.example.comin theexample.comzone. If the nameservers are inside the delegated domain, check whether the provider requires glue records. - Remove conflicting records from the parent. After moving the necessary data, remove stale address and other records below the delegation from the parent zone. Records remaining there may be shadowed and can contribute to inconsistent answers; AWS warns that duplicate records across the parent and child hosted zones can result in NXDOMAIN in some cases.
- Validate before handing over routine changes. Check authoritative answers from the child nameservers and recursive resolution through a resolver. Confirm the expected records are served, then document who owns the child zone and who can change the parent delegation.
AWS outlines the hosted-zone delegation and duplicate-record risks in its Route 53 guide. Cloudflare describes records left in the parent below a delegation as shadowed records; check the relevant provider’s documentation for its terminology and behavior.
What changes with DNSSEC, certificates, and edge services?
DNSSEC
DNSSEC across a delegated boundary needs coordinated parent and child configuration. Cloudflare’s documented subdomain setup requires DNSSEC on the parent zone and the child’s DS record to be added to the parent. This is Cloudflare-specific guidance; follow the actual provider’s process and verify answers with DNSSEC-aware resolvers. See Cloudflare’s DNSSEC instructions for subdomain setup.
Rank #3
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
- 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
- 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.
Certificates and access products
Splitting an existing zone can affect certificate coverage or overlap and access-control applications. Cloudflare calls out these considerations in its subdomain setup documentation. Check the equivalent behavior for your certificate issuer and access product before moving names.
CDN and security services
DNS authority does not guarantee that edge services follow the delegation. Cloudflare states that its CDN and security services do not apply to delegated subdomains; verify equivalent behavior with the provider actually serving your DNS and traffic. Its delegated-subdomain documentation covers NS delegation and in-bailiwick glue as well as the stated service effects.
Quick Recap
Best Value
- 𝗢𝗻𝗲 𝗦𝘄𝗶𝘁𝗰𝗵 𝗠𝗮𝗱𝗲 𝘁𝗼 𝗘𝘅𝗽𝗮𝗻𝗱 𝗡𝗲𝘁𝘄𝗼𝗿𝗸: 5× 10/100/1000Mbps RJ45 Ports supporting Auto Negotiation and Auto MDI/MDIX.
- 𝗚𝗶𝗴𝗮𝗯𝗶𝘁 𝘁𝗵𝗮𝘁 𝗦𝗮𝘃𝗲𝘀 𝗘𝗻𝗲𝗿𝗴𝘆: Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money.
- 𝗥𝗲𝗹𝗶𝗮𝗯𝗹𝗲 𝗮𝗻𝗱 𝗤𝘂𝗶𝗲𝘁: IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation.
- 𝗣𝗹𝘂𝗴 𝗮𝗻𝗱 𝗣𝗹𝗮𝘆: Easy setup with no software installation or configuration needed.
- 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀: Prioritize your traffic and guarantee high quality of video or voice data transmission with Port-based 802.1p/DSCP QoS and IGMP Snooping.
Rank #4
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
What should remain protected?
- The parent NS record: changing it controls where authority for the child names is sent.
- Zone ownership and recovery: define who can change child-zone records, who can restore access, and how the zone is handled when a team or account changes.
- Production dependencies: review whether certificates, access controls, CDN settings, or security policies depend on names being in the original zone.
- Record consistency: avoid maintaining competing versions of the same names in parent and child zones.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
