# How to create private nameservers (ns1.yourdomain.com)

> How to create private nameservers like ns1.yourcompany.com for hosting: register glue records, run authoritative DNS on two servers, verify with dig.

Source: https://zopanel.net/blog/private-nameservers  
Updated: 2026-10-21

## Key takeaways

- Private nameservers have two parts: glue records registered at your registrar and an authoritative DNS server answering on those IPs.
- Glue is needed because ns1.yourcompany.com sits inside the very domain it serves.
- Use at least two nameservers on two servers in different locations, not two names on one IP.
- When a server's IP changes, you update the glue and A records; customers' domains keep the same nameservers.

To create private nameservers such as `ns1.yourcompany.com` and `ns2.yourcompany.com`, you need two things: **glue records** (also called child nameservers or host records) for those names at the registrar of `yourcompany.com`, pointing to your DNS servers' IPs; and an **authoritative DNS server** running on those IPs to answer for your customers' domains. Customers then simply set their domains' nameservers to `ns1.yourcompany.com` and `ns2.yourcompany.com`.

This guide explains why glue records exist, how many servers you need, the exact steps, how to verify everything with `dig`, the mistakes to avoid, and how to do it in ZoPanel. If you only need to point one domain at a VPS without your own nameservers, see [pointing a domain to a VPS](/blog/point-domain-to-vps) instead.

## What are private nameservers and why use them?

A nameserver answers the question "where does this domain point?". By default, customers use their registrar's nameservers or Cloudflare's. Private nameservers are nameservers named under your own domain.

For hosting providers, resellers and agencies, they bring three practical benefits:

- **Branding.** Customers see `ns1.yourcompany.com` in their welcome email and at their registrar, not the name of whoever runs your infrastructure.
- **Control when you change servers.** When you move to a new server, you update your own glue and A records. Hundreds of customer domains keep the same nameservers, and nobody has to log in to their registrar.
- **DNS next to hosting.** Web and mail records (MX, SPF, DKIM) are created with the website, and wildcard SSL certificates can be validated through DNS.

The trade-off: DNS availability is now your job. If your nameservers stop answering, every domain using them disappears from the internet, even if the websites are still running.

## Why do you need glue records?

It is a chicken-and-egg problem: to find the IP of `ns1.yourcompany.com`, a resolver has to ask the nameservers of `yourcompany.com`, which are `ns1.yourcompany.com`. Without extra information, the resolver is stuck.

Glue breaks the loop: your registrar sends the IP of `ns1.yourcompany.com` to the parent zone's registry (`.com`, `.net`, a country code…), and the registry returns that IP along with the delegation. The original definition in RFC 1034, quoted in [RFC 9499 on DNS terminology](https://www.rfc-editor.org/rfc/rfc9499.html), describes glue as name server address records that are only necessary when the name server's name is "below" the delegation point.

In short: **a nameserver named inside its own domain must have glue.** When other domains use it (a customer's `example.org` using `ns1.yourcompany.com`), resolvers still find the IP through the glue of `yourcompany.com`.

## How many DNS servers do you need?

Technically, you can point `ns1` and `ns2` at the same IP. But that gives you two names and no redundancy: if that server goes down, every domain goes with it.

[RFC 2182](https://www.rfc-editor.org/rfc/rfc2182.html), the guidance on selecting and operating secondary DNS servers, recommends three servers for most organisation-level zones, with at least one well removed from the others, and says secondaries must be dispersed both topologically and geographically so that a single failure cannot disable them all.

What that means for a small host:

| Layout | Redundancy | Suits |
| --- | --- | --- |
| ns1 and ns2 on one IP | None | Testing, personal sites |
| ns1 and ns2 on two servers in one data centre | Survives one server failing | Getting started on a budget |
| ns1 and ns2 in two different data centres | Survives a whole site failing | Recommended once you sell to customers |
| Add ns3 at another provider or region | Higher still | Larger customer bases |

A secondary DNS server does not need to be powerful: a small VPS can serve DNS for a great many domains.

## Steps to create private nameservers

### Step 1: Choose names and IPs

Pick your brand domain (say `yourcompany.com`) and two names: `ns1.yourcompany.com` and `ns2.yourcompany.com`. Note the IP of each DNS server, including IPv6 addresses if you have them, for AAAA glue.

### Step 2: Run an authoritative DNS server

On each server, install authoritative DNS software (PowerDNS, BIND, NSD or Knot DNS). Open port **53 on both UDP and TCP**: TCP is needed for large answers (DNSSEC) and for zone transfers between servers.

Two things matter here:

- This is an **authoritative** server that only answers for its own zones. Do not offer recursive resolution to the whole internet: open resolvers get abused for DDoS amplification.
- Replicate zones from primary to secondary (AXFR/IXFR with NOTIFY), ideally signed with a TSIG key so nobody can inject false data.

### Step 3: Create the zone for your brand domain

In the `yourcompany.com` zone, add A (and AAAA) records for `ns1` and `ns2` that **exactly match** the IPs you will register as glue:

```text
ns1   A   203.0.113.10
ns2   A   198.51.100.20
```

### Step 4: Register the glue records at your registrar

Log in to the registrar of `yourcompany.com`. The feature goes by many names: "Child Nameservers", "Host records", "Register nameserver", "Glue records" or "Personal nameservers". Create:

- `ns1.yourcompany.com` → `203.0.113.10`
- `ns2.yourcompany.com` → `198.51.100.20`

Many registrars require at least two nameservers per domain, which is another reason to have two names from day one.

### Step 5: Move domains to the new nameservers

For your brand domain and your customers' domains, set the nameservers to `ns1.yourcompany.com` and `ns2.yourcompany.com`. Before switching, make sure each domain's zone on the new servers **already holds every record** (A, MX, TXT…), or websites and mail will break while the change propagates.

Mind the timing: the NS records in the parent zone carry a TTL set by the registry; for `.com` it is 172800 seconds (48 hours). During that window some resolvers still ask the old nameservers, so keep the zone there for a few more days. [Migrating a website without downtime](/blog/migrate-website-without-downtime) shows how to keep the nameserver change separate from the server move.

## Verifying private nameservers with dig

Check that each server answers authoritatively (look for the `aa` flag):

```bash
dig @203.0.113.10 yourcompany.com SOA +norec
dig @198.51.100.20 yourcompany.com SOA +norec
```

Follow the delegation from the root down to your servers:

```bash
dig +trace yourcompany.com NS
```

See the glue the registry actually serves (for a `.com` domain, ask the registry's servers directly):

```bash
dig +norec @a.gtld-servers.net yourcompany.com NS
```

The `ADDITIONAL SECTION` should contain A records for `ns1` and `ns2` with the right IPs. Finally, compare the SOA serial on both servers to be sure the zone is in sync.

## Creating private nameservers with ZoPanel

ZoPanel includes a DNS server component (PowerDNS) that you install from the panel:

1. At your brand domain's registrar, create glue records for `ns1` and `ns2` pointing to the server's IP.
2. In ZoPanel, open **DNS**, enter the **Nameservers** (1 to 6 names, comma separated) and click **Install DNS server**. The installer opens port 53 TCP and UDP in the firewall. You can also do it at install time with `--nameservers ns1.yourcompany.com,ns2.yourcompany.com`.
3. Any domain with a website in the account can get a zone. A new zone already has A records for `@` and `www`, a CAA record allowing only Let's Encrypt, and MX, SPF, DKIM and DMARC when email is enabled for the domain. The DNS page shows the nameservers customers must set at their registrar. Note that to host your own brand domain's zone on the server, that domain also needs a website in the panel.
4. For a second server, install ZoPanel on another machine and use the **DNS cluster** card: generate a **Cluster key (TSIG)** on the primary, add the secondary's IP under **Secondary servers (IPs)**, then paste the same key on the secondary and add the primary under **Primary servers**. Every change reaches the secondary through NOTIFY, and transfers are signed with the key.

Around that: DNSSEC can be turned on per zone (ZoPanel shows the DS records to give your registrar), wildcard SSL is validated through DNS when the zone is hosted on the server, and the welcome email to new customers can include your nameservers with the `{{nameservers}}` placeholder. The panel name itself can carry your brand (white-label) with a Business licence; contact us about it. Details are in the [DNS docs](/docs/dns) and the [reseller docs](/docs/reseller).

## Common mistakes

- **Glue IPs that do not match the ns1/ns2 A records.** Resolvers get conflicting answers, and failures come and go in ways that are hard to trace.
- **Changing a server's IP and forgetting the glue.** Glue lives at the registry, not in your zone, so it must be changed at the registrar.
- **Opening only UDP 53.** Large answers and zone transfers need TCP.
- **Both nameservers on one server.** It works fine until the day that server has a problem.
- **Turning off DNSSEC in the wrong order.** Remove the DS records at the registrar first, wait for their TTL to expire, then stop signing. The other way round makes the domain look broken.
- **Switching nameservers before the new zone is complete**, especially MX and TXT verification records.

## Conclusion

Creating private nameservers takes only a few steps: pick the names, register glue records, run authoritative DNS on at least two servers and verify with `dig`. The real work is operational: keeping the servers in sync, in different places, and updating glue whenever an IP changes.

ZoPanel puts both the setup and a two-server DNS cluster in the panel, and the DNS server is available on every plan, including Free (3 accounts, 10 websites, 10 databases). See [pricing](/pricing) and the [DNS docs](/docs/dns) to get started.

## Frequently asked questions

### What is a glue record?

A glue record is the IP address of a nameserver, registered at your registrar and stored by the parent zone's registry. It is required when the nameserver's name sits inside the domain it serves, such as `ns1.yourcompany.com` for `yourcompany.com`, so resolvers can find its IP without a loop.

### Can I create private nameservers with a single VPS?

Technically yes: point both `ns1` and `ns2` at the same IP. But there is no redundancy, so if the server goes down, every domain stops resolving. Once you sell to customers, use at least two servers in different locations.

### How long do private nameservers take to work?

New glue records usually appear at the registry within minutes to a few hours, depending on the registrar and registry. When you switch an existing domain to new nameservers, allow up to 48 hours for `.com`, because the parent zone's NS records have a 172800-second TTL.

### Do customers need to change anything if my server IP changes?

No. You update the glue records at your registrar and the A records for `ns1` and `ns2` in your brand domain's zone. Customer domains keep pointing to `ns1.yourcompany.com` and `ns2.yourcompany.com` as before.