Advanced zone delegation with bind, delegate part of delegated zone elsewhere

Question

I'm having trouble with bind9 to configure the following dns setup:

I want to delegate a zone to a remote dns server. But I want to delegate a sub-zone of that zone to a different dns server.

Example:

• project.example.com -> to dns server dns1
• prd.project.example.com -> to dns server dns2

For obvious reasons, I don't want to delegate everything to dns1 and then delegate prd.project.example.com to dns2. I could go deeper into the details (dns1 needs dynamic subdomains such as dev, hotfix1 etc.) but I don't think they would help right now.

I was able to successfully set up this solution with cloudflare and with aws route53. But bind does not work as expected. It keeps delegating everything (for example test.prd.project.example.com) to dns1.

What am I missing?

Here is the simplified zone file:

$ORIGIN example.com.
$TTL 300
@       IN  SOA dns.example.com. ( 2021020506 3600 720 1209600 3600 )
        IN  NS  dns.example.com.

dns     IN  A  1.2.3.4

$ORIGIN project.example.com.
$TTL 60
@       IN NS ns-1.awsdns-1.net.
        IN NS ns-1.awsdns-1.co.uk.

$ORIGIN prd.project.example.com.
$TTL 60
@       IN NS ns-2.awsdns-2.net.
        IN NS ns-2.awsdns-2.co.uk.

Answer 1

DNS delegation fundamentals

The combination of delegations in the question is not possible in DNS.
Your zone ends right at the delegation point and you cannot delegate something that is not part of your own zone.

In your example, the delegation for prd.project.example.com would have to be made in the project.example.com zone, it cannot be done in the example.com zone.

AWS Route53 behavior

After some experimentation with AWS Route53, I now understand the basis of the question better:

It appears that AWS Route53 is completely lacking consistency checks with regards to adding out-of-zone records.
For most record types Route53 seems to simply ignore the existence of these out-of-zone records when queried (which makes them largely harmless), but for NS it actually serves them even though that makes for an impossible combination of delegations exposed to the world.

This must clearly be a bug, it exposes an impossible combination of delegations that I expect leads to inconsistent behavior on the client end (based on whichever delegation the resolver gets to see first, essentially) and is not something that is desirable.
I do not expect BIND or anything else to replicate this particular behavior as it is at odds with the fundamental nature of DNS being a tree structure. (I also don't expect that it actually works in practice, so there is no reason to implement it.)