Parent returns a referral

Walking down the DNS tree works because each level declines to answer and points at the next. Ask a .com registry server about example.com and the correct response is a referral: the AA bit unset, an empty answer section, the NS records in the authority section, and any glue in the additional section. "I am not authoritative for this, ask these servers" is not a failure mode — it is the entire mechanism.

This check reads the AA bit on what the registry actually gave us. AA set means the server we asked believes it is authoritative for the name itself, which is not how a parent answers a delegation query. The ordinary explanation is that the registry also hosts the zone: some ccTLD registries run DNS for their registrants, and parked or suspended domains are frequently served from registry infrastructure. The other explanation is that we did not reach the parent at all, but something sitting in front of it.

It is a warning rather than a failure because the domain can resolve perfectly well in either case. What it tells you is that the parent-side comparisons in the rest of this section are describing something other than a normal delegation, and should be read with that in mind.

Reproduce it before acting on it: dig +norecurse @<a registry server> example.com NS, and read the flags line. A referral shows no aa flag, an empty answer section, and NS records under authority.

If your registry hosts the zone and you did not intend that, set your own nameservers at the registrar. If the domain is parked or suspended, the referral returns to normal once that ends.

If the domain resolves correctly everywhere and nothing else in this section disagrees, there is nothing here to fix.