How to create private nameservers (ns1.yourdomain.com)

To create private nameservers such as ns1.yourcompany.com and ns2.yourcompany.com, you need two things: glue records (also called child nameservers or host records) for those names at the registrar of yourcompany.com, pointing to your DNS servers' IPs; and an authoritative DNS server running on those IPs to answer for your customers' domains. Customers then simply set their domains' nameservers to ns1.yourcompany.com and ns2.yourcompany.com.

This guide explains why glue records exist, how many servers you need, the exact steps, how to verify everything with dig, the mistakes to avoid, and how to do it in ZoPanel. If you only need to point one domain at a VPS without your own nameservers, see pointing a domain to a VPS instead.

What are private nameservers and why use them?

A nameserver answers the question "where does this domain point?". By default, customers use their registrar's nameservers or Cloudflare's. Private nameservers are nameservers named under your own domain.

For hosting providers, resellers and agencies, they bring three practical benefits:

• Branding. Customers see ns1.yourcompany.com in their welcome email and at their registrar, not the name of whoever runs your infrastructure.
• Control when you change servers. When you move to a new server, you update your own glue and A records. Hundreds of customer domains keep the same nameservers, and nobody has to log in to their registrar.
• DNS next to hosting. Web and mail records (MX, SPF, DKIM) are created with the website, and wildcard SSL certificates can be validated through DNS.

The trade-off: DNS availability is now your job. If your nameservers stop answering, every domain using them disappears from the internet, even if the websites are still running.

Why do you need glue records?

It is a chicken-and-egg problem: to find the IP of ns1.yourcompany.com, a resolver has to ask the nameservers of yourcompany.com, which are ns1.yourcompany.com. Without extra information, the resolver is stuck.

Glue breaks the loop: your registrar sends the IP of ns1.yourcompany.com to the parent zone's registry (.com, .net, a country code…), and the registry returns that IP along with the delegation. The original definition in RFC 1034, quoted in RFC 9499 on DNS terminology, describes glue as name server address records that are only necessary when the name server's name is "below" the delegation point.

In short: a nameserver named inside its own domain must have glue. When other domains use it (a customer's example.org using ns1.yourcompany.com), resolvers still find the IP through the glue of yourcompany.com.

How many DNS servers do you need?

Technically, you can point ns1 and ns2 at the same IP. But that gives you two names and no redundancy: if that server goes down, every domain goes with it.

RFC 2182, the guidance on selecting and operating secondary DNS servers, recommends three servers for most organisation-level zones, with at least one well removed from the others, and says secondaries must be dispersed both topologically and geographically so that a single failure cannot disable them all.

What that means for a small host:

Layout	Redundancy	Suits
ns1 and ns2 on one IP	None	Testing, personal sites
ns1 and ns2 on two servers in one data centre	Survives one server failing	Getting started on a budget
ns1 and ns2 in two different data centres	Survives a whole site failing	Recommended once you sell to customers
Add ns3 at another provider or region	Higher still	Larger customer bases

A secondary DNS server does not need to be powerful: a small VPS can serve DNS for a great many domains.

Steps to create private nameservers

Step 1: Choose names and IPs

Pick your brand domain (say yourcompany.com) and two names: ns1.yourcompany.com and ns2.yourcompany.com. Note the IP of each DNS server, including IPv6 addresses if you have them, for AAAA glue.

Step 2: Run an authoritative DNS server

On each server, install authoritative DNS software (PowerDNS, BIND, NSD or Knot DNS). Open port 53 on both UDP and TCP: TCP is needed for large answers (DNSSEC) and for zone transfers between servers.

Two things matter here:

• This is an authoritative server that only answers for its own zones. Do not offer recursive resolution to the whole internet: open resolvers get abused for DDoS amplification.
• Replicate zones from primary to secondary (AXFR/IXFR with NOTIFY), ideally signed with a TSIG key so nobody can inject false data.

Step 3: Create the zone for your brand domain

In the yourcompany.com zone, add A (and AAAA) records for ns1 and ns2 that exactly match the IPs you will register as glue:

ns1   A   203.0.113.10
ns2   A   198.51.100.20

Step 4: Register the glue records at your registrar

Log in to the registrar of yourcompany.com. The feature goes by many names: "Child Nameservers", "Host records", "Register nameserver", "Glue records" or "Personal nameservers". Create:

• ns1.yourcompany.com → 203.0.113.10
• ns2.yourcompany.com → 198.51.100.20

Many registrars require at least two nameservers per domain, which is another reason to have two names from day one.

Step 5: Move domains to the new nameservers

For your brand domain and your customers' domains, set the nameservers to ns1.yourcompany.com and ns2.yourcompany.com. Before switching, make sure each domain's zone on the new servers already holds every record (A, MX, TXT…), or websites and mail will break while the change propagates.

Mind the timing: the NS records in the parent zone carry a TTL set by the registry; for .com it is 172800 seconds (48 hours). During that window some resolvers still ask the old nameservers, so keep the zone there for a few more days. Migrating a website without downtime shows how to keep the nameserver change separate from the server move.

Verifying private nameservers with dig

Check that each server answers authoritatively (look for the aa flag):

dig @203.0.113.10 yourcompany.com SOA +norec
dig @198.51.100.20 yourcompany.com SOA +norec

Follow the delegation from the root down to your servers:

dig +trace yourcompany.com NS

See the glue the registry actually serves (for a .com domain, ask the registry's servers directly):

dig +norec @a.gtld-servers.net yourcompany.com NS

The ADDITIONAL SECTION should contain A records for ns1 and ns2 with the right IPs. Finally, compare the SOA serial on both servers to be sure the zone is in sync.

Creating private nameservers with ZoPanel

ZoPanel includes a DNS server component (PowerDNS) that you install from the panel:

1. At your brand domain's registrar, create glue records for ns1 and ns2 pointing to the server's IP.
2. In ZoPanel, open DNS, enter the Nameservers (1 to 6 names, comma separated) and click Install DNS server. The installer opens port 53 TCP and UDP in the firewall. You can also do it at install time with --nameservers ns1.yourcompany.com,ns2.yourcompany.com.
3. Any domain with a website in the account can get a zone. A new zone already has A records for @ and www, a CAA record allowing only Let's Encrypt, and MX, SPF, DKIM and DMARC when email is enabled for the domain. The DNS page shows the nameservers customers must set at their registrar. Note that to host your own brand domain's zone on the server, that domain also needs a website in the panel.
4. For a second server, install ZoPanel on another machine and use the DNS cluster card: generate a Cluster key (TSIG) on the primary, add the secondary's IP under Secondary servers (IPs), then paste the same key on the secondary and add the primary under Primary servers. Every change reaches the secondary through NOTIFY, and transfers are signed with the key.

Around that: DNSSEC can be turned on per zone (ZoPanel shows the DS records to give your registrar), wildcard SSL is validated through DNS when the zone is hosted on the server, and the welcome email to new customers can include your nameservers with the {{nameservers}} placeholder. The panel name itself can carry your brand (white-label) with a Business licence; contact us about it. Details are in the DNS docs and the reseller docs.

Common mistakes

• Glue IPs that do not match the ns1/ns2 A records. Resolvers get conflicting answers, and failures come and go in ways that are hard to trace.
• Changing a server's IP and forgetting the glue. Glue lives at the registry, not in your zone, so it must be changed at the registrar.
• Opening only UDP 53. Large answers and zone transfers need TCP.
• Both nameservers on one server. It works fine until the day that server has a problem.
• Turning off DNSSEC in the wrong order. Remove the DS records at the registrar first, wait for their TTL to expire, then stop signing. The other way round makes the domain look broken.
• Switching nameservers before the new zone is complete, especially MX and TXT verification records.

Conclusion

Creating private nameservers takes only a few steps: pick the names, register glue records, run authoritative DNS on at least two servers and verify with dig. The real work is operational: keeping the servers in sync, in different places, and updating glue whenever an IP changes.

ZoPanel puts both the setup and a two-server DNS cluster in the panel, and the DNS server is available on every plan, including Free (3 accounts, 10 websites, 10 databases). See pricing and the DNS docs to get started.

Frequently asked questions

What is a glue record?

A glue record is the IP address of a nameserver, registered at your registrar and stored by the parent zone's registry. It is required when the nameserver's name sits inside the domain it serves, such as ns1.yourcompany.com for yourcompany.com, so resolvers can find its IP without a loop.

Can I create private nameservers with a single VPS?

Technically yes: point both ns1 and ns2 at the same IP. But there is no redundancy, so if the server goes down, every domain stops resolving. Once you sell to customers, use at least two servers in different locations.

How long do private nameservers take to work?

New glue records usually appear at the registry within minutes to a few hours, depending on the registrar and registry. When you switch an existing domain to new nameservers, allow up to 48 hours for .com, because the parent zone's NS records have a 172800-second TTL.

Do customers need to change anything if my server IP changes?

No. You update the glue records at your registrar and the A records for ns1 and ns2 in your brand domain's zone. Customer domains keep pointing to ns1.yourcompany.com and ns2.yourcompany.com as before.