iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To run your own authoritative nameserver, install BIND9 on a VPS with a stable public IP, define your domain’s zone, publish matching NS and address records, register glue at your registrar, and then change the parent delegation. This guide walks through that chain on Ubuntu or Debian, explains when you need a second server, and shows how to verify and maintain the result.
What you are building
An authoritative nameserver stores the definitive DNS records for a domain and answers queries with those records. A recursive resolver, such as the resolver supplied by an internet provider, looks up answers on behalf of users; your server’s job is different. It is authoritative for the zone you configure.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
BIND9 is the standard open-source DNS implementation available on Ubuntu and Debian. In a normal setup, one VPS acts as the primary server where you edit the zone. A second server, preferably on another provider network or in another region, serves a replicated copy as a secondary. The registrar publishes your nameserver hostnames in the parent zone, and glue records tell the parent how to reach those hostnames when they are inside the domain they serve.
Before you start
Minimum requirements
- A VPS with a stable, publicly routable IPv4 address. Add IPv6 only when the VPS has a working, routable IPv6 address.
- Administrative access through SSH and permission to install packages and edit files under
/etc/bind. - A domain at a registrar that lets you change its authoritative nameservers and create host (glue) records.
- Firewall and provider security rules that allow both UDP and TCP traffic on port 53.
- A plan for a second authoritative server if the domain must remain resolvable during a VPS, host, or network outage.
Use the domain example.com and documentation addresses in the examples below. Replace every example name and address with the values assigned to your VPS. Documentation ranges such as 203.0.113.0/24 and 198.51.100.0/24 are not usable internet addresses.
#1 Best Overall
Choose an architecture
| Design | What it means | Trade-off |
|---|---|---|
| One VPS | A single BIND9 instance is authoritative. | Simple and inexpensive, but a host or network failure can make the domain unavailable. |
| Primary and secondary | The primary contains the editable zone; the secondary serves a replicated copy. | More configuration and an additional server, but fewer single points of failure. |
| IPv4 only | Publish A records for reachable IPv4 addresses. | Broad compatibility, with no IPv6 service. |
| Dual stack | Publish A and AAAA records for addresses the servers genuinely provide. | IPv6 reachability, but an incorrect AAAA record can make IPv6 clients fail. |
| Unsigned DNS | Ordinary authoritative DNS without DNSSEC signatures. | Easiest to operate; it does not provide DNSSEC’s authenticity validation. |
| DNSSEC-signed DNS | BIND publishes DNSKEY and RRSIG records and the parent normally publishes a DS record. | Adds authenticity protection and key-management work. |
BIND documentation recommends two or more authoritative servers on different networks for fault tolerance. A second VPS is therefore the sensible production design even though a single VPS is sufficient for learning or low-consequence domains.
Install BIND9 and DNS troubleshooting tools
Run these commands over SSH on the VPS. The package names are the same on current Ubuntu and Debian installations.
sudo apt update
sudo apt install bind9 dnsutils
sudo systemctl enable --now bind9bind9 provides the DNS server. dnsutils supplies tools such as dig, which you will use to query the server directly and trace the delegation.
Confirm that the service is running before editing the zone:
systemctl status bind9 --no-pager
ss -luntp | grep ':53'The second command should show BIND listening on the intended interfaces. If your provider has a separate cloud firewall or security group, allow UDP and TCP port 53 there as well as in the operating system firewall. DNS uses UDP for most queries, while TCP is required for larger responses and other protocol situations.
Define an authoritative zone
Add the zone declaration
Open BIND’s local configuration file:
sudo nano /etc/bind/named.conf.localAdd a primary zone declaration:
zone "example.com" {
type primary;
file "/etc/bind/db.example.com";
};BIND’s newer terminology uses primary and secondary; older documentation may call these roles master and slave. The primary reads the editable zone data from a file on its host and is authoritative for that zone.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCreate the zone file
Create the file named in the declaration:
sudo nano /etc/bind/db.example.comStart with this minimal structure:
$TTL 3600
@ IN SOA ns1.example.com. hostmaster.example.com. (
2026101501 ; serial
3600 ; refresh
900 ; retry
1209600 ; expire
3600 ) ; negative cache
IN NS ns1.example.com.
IN NS ns2.example.com.
ns1 IN A 203.0.113.10
ns2 IN A 198.51.100.20
@ IN A 203.0.113.10$TTL 3600sets a one-hour default cache lifetime for records that do not specify another TTL.- The SOA record identifies the primary server and the responsible mailbox. In DNS notation, the first dot in the mailbox is replaced by
@, sohostmaster.example.com.representshostmaster@example.com. - The serial identifies the version of the zone. It must increase whenever you change records. A date-based value such as
YYYYMMDDnnis a common convention; monotonic increase is the actual requirement. refresh,retry, andexpireguide secondary-server synchronization. The negative-cache value controls how long negative answers may be cached.- The NS records name the authoritative servers. Each NS target must resolve to address records; do not use a CNAME as an NS target.
- The A records for
ns1andns2identify the nameserver addresses. The final A record makes the zone apex,example.com, resolve to the first example address.
If you have IPv6, add an AAAA record for each nameserver only when that address is assigned to the VPS and reachable from the internet:
ns1 IN AAAA 2001:db8:1234::10Do not publish an address that the server does not actually serve. An incorrect AAAA record can direct IPv6 clients to a dead endpoint even when IPv4 appears healthy.
Rank #2
- Linux
- Linux DNS
Validate syntax and reload safely
Check the global configuration and the zone before reloading:
sudo named-checkconf
sudo named-checkzone example.com /etc/bind/db.example.comA successful zone check reports the zone name, the number of loaded records, and an OK result. If either command reports an error, correct it before restarting BIND. Inspect the service journal for additional detail:
sudo journalctl -u bind9 -n 50 --no-pagerAfter validation, reload the configuration without interrupting the service:
sudo rndc reloadWhen you change a record later, increase the SOA serial first, run the same checks, and reload again. A secondary server will not know that a zone changed if the serial remains the same.
Create nameserver hostnames and glue records
Why glue is necessary
Suppose the parent zone delegates example.com to ns1.example.com. To find the address of that nameserver, a resolver would need to ask the example.com zone, but it cannot reach that zone until it knows the nameserver address. Glue breaks this circular dependency.
At your registrar, create host records for ns1.example.com and ns2.example.com, assigning the same A and, where applicable, AAAA addresses that appear in your authoritative zone. IANA’s technical requirements state that glue addresses must match the authoritative A and AAAA records for the host.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Registrar interfaces use different labels, including Register nameserver, Child hosts, Host records, or Glue records. Add the hostnames first; merely adding ordinary A records inside your zone does not create parent glue.
Delegate the domain at the registrar
After registering the hostnames, replace the domain’s current nameserver set with:
ns1.example.com
ns2.example.comThe registrar submits this change to the parent zone. The parent NS set and the NS set served by your child zone must agree. If the parent still lists an old provider, public resolvers will continue querying that provider even when BIND on your VPS has the correct records.
Do not remove the old delegation until the new servers answer correctly when queried directly. Caches retain old NS and record data until their TTLs expire, so a transition can temporarily show different answers to different users.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsVerify the complete DNS chain
Query BIND directly
Use the server’s public address to bypass recursive-resolver caches:
dig @203.0.113.10 example.com SOA
dig @203.0.113.10 example.com NS
dig @203.0.113.10 ns1.example.com A
dig @203.0.113.10 ns2.example.com AReplace 203.0.113.10 with the actual VPS address. The responses should include the SOA, both NS records, and the expected nameserver addresses with an authoritative answer flag.
Check each authoritative server separately
For a two-server design, query both addresses and compare their NS sets and SOA serials:
dig @203.0.113.10 example.com SOA +noall +answer
dig @198.51.100.20 example.com SOA +noall +answer
dig @203.0.113.10 example.com NS +noall +answer
dig @198.51.100.20 example.com NS +noall +answerBoth servers should return the same NS set and matching SOA serial. If the secondary has an older serial, investigate zone transfer or reload behavior before relying on it.
Trace from the root
Once the registrar delegation is submitted, ask dig to follow the chain:
dig +trace example.comThe trace should move from the root to the top-level domain, then to the parent’s delegation and finally to your VPS. You can also query a public recursive resolver to see what ordinary users receive:
dig example.com SOA
dig example.com NSIf the direct query works but the trace does not reach your VPS, the problem is normally at the parent delegation, glue, routing, or firewall layer rather than in the zone file itself.
Recommended Free Tools
Set up a secondary server for resilience
A secondary server serves a replicated copy and reduces dependence on one host. Put it on a different network, provider, or region; two VPSes in the same failed network do not provide meaningful fault tolerance.
The primary must permit a zone transfer to the secondary, and the secondary must be configured to request the zone. The exact access-control and transfer statements depend on the addresses you choose, but the operational requirements are constant:
- Allow TCP port 53 between the primary and secondary. Zone transfers use TCP.
- Restrict transfers to the secondary’s address rather than allowing arbitrary clients.
- Configure the secondary for the same zone name and point it at the primary.
- Publish the secondary’s hostname and address in the zone, create matching glue, and include it in the parent delegation.
- After every primary change, increase the SOA serial and verify that the secondary obtains that serial.
Do not list a secondary in the parent until it can answer authoritatively. A delegated server that is unreachable or serving an incomplete zone creates intermittent failures.
Decide whether to enable DNSSEC
DNSSEC is a separate project layered on top of working authoritative DNS. Signing adds DNSKEY and RRSIG records to the zone, and the parent normally publishes a DS record that identifies the active signing key.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enable it only when you can manage the keys deliberately:
- Back up the keys securely and restrict their permissions.
- Plan key rollover before the current key approaches its replacement date.
- Confirm that your registrar accepts DS records and understand its exact submission format.
- Keep system time accurate; invalid time can make otherwise valid signatures fail validation.
- Test DNSKEY and RRSIG coverage before submitting a DS record to the parent.
A DS record that does not match the active DNSKEY can make validating resolvers return SERVFAIL. If you are learning BIND9, get unsigned delegation stable first, then add DNSSEC with a documented backup and rollover procedure.
Troubleshoot common failures
SERVFAIL after changing nameservers
- Query each nameserver IP directly with
digto distinguish a server problem from a delegation problem. - Check that glue addresses exactly match the authoritative A and AAAA records.
- Confirm UDP and TCP port 53 in both the VPS firewall and the provider’s security rules.
- Verify that the parent NS set lists the intended hostnames and that the child zone lists the same set.
Public answers still show the old provider
Inspect the registrar’s delegation and allow cached data to expire according to the old records’ TTLs. A direct query to your VPS proves only that your server is configured; it does not change the parent zone or invalidate caches.
Best Value
- Standard size: 6 pink server note pads, Each Book Comes with 50 bound order slips - that's 300 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, feel free to contact us, we'll appreciate it to learn from your experience, and we'll make it better
One nameserver works while the other fails
Query both IP addresses separately. Compare their SOA serials, NS records, firewall exposure, and address records. A stale secondary usually indicates a failed transfer, an unchanged serial, or a transfer rule that blocks the primary-to-secondary connection.
BIND refuses to start or reload
Run named-checkconf and named-checkzone, then inspect journalctl -u bind9. Typical causes include a missing semicolon, an incorrectly quoted zone name, a malformed SOA record, a file path that does not exist, or permissions that prevent BIND from reading the zone file. Correct the error and reload only after both checks pass.
DNSSEC validation fails
Check that every required record is signed, the system clock is correct, the active key has not been retired, and the parent DS record corresponds to that key. A mismatch between DS and DNSKEY is sufficient to break validation even when ordinary unsigned queries appear correct.
Operate the nameserver safely
- Keep the operating system and BIND9 packages updated through the distribution’s normal security process.
- Limit administrative access to SSH and use key-based authentication where possible.
- Permit recursion only if you intentionally operate a recursive resolver. An authoritative public server should not become an open resolver.
- Back up zone files, configuration, and DNSSEC keys separately from the VPS.
- Monitor both authoritative addresses from outside the hosting network, testing UDP and TCP reachability.
- Record every zone change and increase the SOA serial for each published revision.
- Review glue, parent delegation, and expiration dates whenever an IP address or VPS provider changes.
When self-hosting is the right choice
Self-hosted BIND9 is appropriate when you need control over the software and zone data, want to learn authoritative DNS, or can operate redundant servers and monitor them. Managed DNS is usually simpler when you need distributed infrastructure but do not want to maintain operating systems, firewalls, transfers, backups, and DNSSEC keys yourself. The decisive factors are uptime requirements, operational capacity, and whether running the service is itself the goal.
Frequently Asked Questions
Do I need two nameservers for one domain?
A single VPS can answer authoritatively, but two servers on different networks are the safer production design because one host or network failure can otherwise make the domain unavailable.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can an NS record point to a CNAME?
No. An NS target must resolve through address records, normally A and optionally AAAA records. Use a hostname with direct address records instead.
Why do I need glue if the nameserver already has an A record?
An A record inside the child zone cannot be read until the resolver reaches that zone. Parent glue supplies the nameserver address first and breaks that circular dependency.
How long does a nameserver change take to appear?
Resolvers cache parent delegation and DNS records for their published TTLs. Direct queries may show the new server immediately, while public users can continue receiving old answers until cached data expires.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
