1. I assume example.com is signed. 2. I don't understand why you can't just remove the NS records and fold the foo.bar.example.com data in. 3. After some interval of TTL, you can delete the DS records.
If bar.example.com is served by the same server (I assume not: because if it was, why would you need to delegate it at all), then maybe there a problem.
signature.asc
Description: PGP signature
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
