trouble delegating a subdomain via NS record

[John Ratliff]

I’m trying to delegate a subdomain to another BIND server, but when I add
the NS record, some of the records stop working. I was hoping someone
could help me figure out why.

Here is a zone file that demonstrates the problem for example.com. It’s
running on a CentOS 7 system with BIND  9.9.4. I saw the problem
originally on a Debian 8 server with BIND 9.9.5.

$TTL 3600
@       IN      SOA ns1.example.com. hostmaster.example.com. (
                2017021608      ; serial (yyyymmdd##)
                7200            ; refresh secondary every 2 hours
                3600            ; retry secondary every hour thereafter
                1209600         ; expire w/o update in 14 days.
                3600 )          ; negative cache time of 1 hour

        IN NS ipa-test-client.example.com.
idm     IN NS ipa1.example.com.

        IN MX 50 spamfw.example.com.

        IN A 10.9.6.54

ipa-test-client IN A 10.9.6.117
ipa1            IN A 10.9.6.118

www     IN CNAME example.com.
test    IN A 10.9.6.222

If I use the zone like this, the MX and A records seem to stop working (I
get NXDOMAIN with dig). If I comment out the idm NS line, it starts
working again. Other records seem fine. The www and test records resolve,
but the CNAME for www does not fully resolve into 10.9.6.117 when the idm
NS delegation is in place.

Is there a specific place I need to put the NS record for the idm
subdomain? Must it go at the end, or be placed after an $ORIGIN
declaration? I looked at a few guides on the internet, and they didn’t
suggest anything like this.

Thanks.