Free tools Windows power users keep installed
One-click scans. No signup required.
To run custom name servers, your VPS must answer authoritatively on UDP and TCP port 53, your domain must have a correctly configured DNS zone, and your registrar must create glue (host) records for names such as ns1.example.com and ns2.example.com. You then delegate the domain to those nameservers and verify the parent and child responses agree. Keep the old DNS service online while caches update; worldwide visibility can take up to two days.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What custom nameservers are and why glue is required
A custom, private, or white-label nameserver is a hostname under the domain it serves. For example, ns1.example.com and ns2.example.com can be authoritative for example.com and for other domains you host.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →This creates a bootstrap problem. To find the address of ns1.example.com, a recursive resolver must first ask the parent zone for the nameservers of example.com. The parent points to ns1.example.com, but that hostname is inside the same domain and its address would normally be obtained from the nameserver that has not yet been reached. The parent therefore publishes a glue record: an address supplied with the delegation so the resolver can reach the server initially.
Glue is not a replacement for normal DNS records. The registrar or parent zone stores the host object and its IPv4 and, where applicable, IPv6 addresses. Your authoritative zone must also return matching A and AAAA records for each nameserver hostname. The parent delegation, glue addresses and child-zone answers must agree.
#1 Best Overall
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Requirements before you begin
- A registered domain: You need access to the registrar account that controls its nameserver delegation.
- Stable public addresses: Use static addresses assigned to the VPS. Record whether each nameserver has IPv4, IPv6, or both.
- Authoritative DNS software: BIND 9 is a common choice; a hosting control panel can perform the same role if it supports authoritative zones.
- Reachability: Permit inbound and outbound DNS on both UDP port 53 and TCP port 53 in the VPS firewall, cloud firewall and any provider-level security group.
- Two reachable nameservers: Register at least
ns1andns2. Two addresses on one VPS satisfy the delegation format but do not provide fault isolation; separate machines, networks or locations are more resilient. - Administrative access: You need root or equivalent privileges to install the daemon, edit zones and reload configuration.
Do not assign a dynamic residential address or an address that the provider may reclaim. If an address changes, the registrar glue, the zone records and every dependent delegation must be updated.
Plan the nameserver names and addresses
Choose in-bailiwick hostnames
The usual convention is ns1.example.com and ns2.example.com. The numbers are a convention, not a protocol requirement; any valid hostnames under your domain work. Keep the names short and document the exact spelling because the registrar, parent delegation and zone file are case-insensitive but operationally easy to mistype.
Map each name to an address
| Nameserver | IPv4 example | IPv6 | Where it must appear |
|---|---|---|---|
ns1.example.com |
192.0.2.10 |
If assigned, its stable global IPv6 address | Registrar host/glue record and zone A/AAAA record |
ns2.example.com |
192.0.2.11 |
If assigned, its stable global IPv6 address | Registrar host/glue record and zone A/AAAA record |
If both names resolve to one machine, a single outage still takes down authoritative DNS. For production use, place the second server on independent infrastructure and test that its zone data stays synchronized.
Install and configure authoritative DNS on the VPS
Install the daemon
Install BIND 9 (package names vary by distribution) or enable authoritative DNS in your control panel. Disable any pre-existing service that competes for port 53, and check which process is listening before proceeding:
sudo ss -luntp | grep ':53'Configure the daemon to listen on the VPS’s public addresses. An authoritative-only server should not provide open recursive service to the internet. Set recursion off, restrict zone transfers to explicitly authorised secondary servers, and apply your distribution’s recommended response-rate and abuse protections.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Open both DNS transports
Permit UDP and TCP 53. UDP handles most ordinary queries; TCP is required for truncated responses, larger DNSSEC answers and reliable zone transfers. Opening only UDP produces intermittent failures that can look like propagation problems.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCreate the authoritative zone
The exact file paths differ by operating system, but the zone must contain an SOA record, both NS records and address records for the nameserver hostnames. A minimal BIND-style example for example.com is:
$TTL 3600
@ IN SOA ns1.example.com. hostmaster.example.com. (
2026101501 ; serial: increase for every change
3600 ; refresh
900 ; retry
1209600 ; expire
300 ; negative cache TTL
)
IN NS ns1.example.com.
IN NS ns2.example.com.
ns1 IN A 192.0.2.10
ns2 IN A 192.0.2.11
@ IN A 192.0.2.10
www IN A 192.0.2.10Add AAAA records when you will serve DNS over IPv6, and make the same IPv6 addresses available as registrar glue. A trailing dot on fully qualified names in a zone file matters: without it, the name can be interpreted as relative to the zone.
Validate and reload
Use the distribution’s BIND checks before reloading. Typical commands are:
sudo named-checkconf
sudo named-checkzone example.com /path/to/db.example.com
sudo rndc reload example.comReplace the file path and reload command with those used by your operating system or panel. Every edit requires a higher SOA serial; otherwise secondaries and caches may continue using the previous zone.
Rank #3
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Register glue (child nameservers) at the registrar
Open the registrar’s domain-management area and look for labels such as Register nameserver, Child nameservers, Private nameservers, Host records or Glue records. This is separate from the screen where you select the domain’s authoritative nameserver list.
- Create a host object for
ns1.example.comand enter the VPS’s public IPv4 address. Add its IPv6 address if you will publish and serve one. - Create a second host object for
ns2.example.comwith its assigned address or addresses. - Save the host records and confirm the registrar displays the exact names and addresses. Correct a typo before changing delegation.
A glue record is parent-side data. Adding only ns1 and ns2 as ordinary records inside your zone does not solve the bootstrap problem, and creating glue without a working authoritative server causes timeouts.
Delegate the domain to your custom nameservers
After the host objects exist, edit the domain’s authoritative nameserver list and replace the previous entries with:
ns1.example.comns2.example.com
Save the delegation only after both nameservers answer for the zone. The parent must publish the two NS names, and for in-bailiwick names it must publish usable glue addresses. A parent NS set that names a server you did not register, or glue that points to an old address, can make the entire domain unavailable.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Verify the setup from outside the VPS
Run these checks from a separate network or an external monitoring host, not only from the VPS itself.
Rank #4
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Inspect the delegation and glue
dig +trace NS example.comFollow the trace from the root and TLD to the parent response. Confirm that the parent lists both custom nameservers and supplies the expected addresses for in-bailiwick hosts. You can also query the relevant parent server directly when you know its address.
Query each server directly
dig @192.0.2.10 example.com SOA +norecurse
dig @192.0.2.10 example.com NS +norecurse
dig @192.0.2.11 example.com SOA +norecurse
dig @192.0.2.11 example.com NS +norecurseEach response should have the authoritative (aa) flag, the intended SOA serial and both NS records. Query the nameserver hostnames too:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchdig @192.0.2.10 ns1.example.com A +norecurse
dig @192.0.2.11 ns2.example.com A +norecurseWhen IPv6 is enabled, repeat with AAAA and test from an IPv6-capable network.
Test TCP as well as UDP
dig +tcp @192.0.2.10 example.com SOA +norecurse
dig +tcp @192.0.2.11 example.com SOA +norecurseSuccessful UDP queries do not prove TCP is open. Check the VPS firewall, provider firewall and daemon listener if TCP fails.
Check the real recursive view
Once direct tests pass, query through a recursive resolver from more than one location. Different answers during the first hours are normally cached data, not proof that the zone is randomly switching. Keep the previous DNS service active until the old delegation and records have expired from caches.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Propagation, TTLs and safe migration
Changing delegation does not instantly replace every cached parent response. Recursive resolvers commonly cache nameserver information for up to two days. The actual interval depends on the previous TTL, resolver behavior and regional caching.
- Lower record TTLs on the old service before a planned migration, while leaving enough time for the lower value to be cached.
- Build and test the new authoritative service while the old service remains live.
- Create glue and verify direct answers before changing delegation.
- Change the parent NS set and monitor from multiple networks.
- Keep the old service online for at least the expected cache period, and longer if important resolvers still show the previous delegation.
Do not repeatedly switch nameserver lists while troubleshooting; each change creates another cache lifetime and makes diagnosis harder.
Troubleshoot custom nameserver failures
SERVFAIL, timeouts or intermittent resolution
- Confirm the daemon is running and listening on the public IPv4 and IPv6 addresses.
- Allow both UDP and TCP 53 through every firewall layer.
- Query each nameserver directly. If both fail, inspect the zone and listener; if one fails, repair that server or remove it only after a tested replacement is available.
- Check that the VPS provider is not filtering DNS traffic or blocking outbound replies.
“Nameserver not found” or a missing host
Verify that the registrar host/glue object exists under the parent domain and that its address is current. A glue typo can keep a domain unreachable until caches holding the incorrect address expire.
Parent and child data disagree
Compare three values: the parent NS response, the parent glue addresses and the A/AAAA answers returned by each authoritative server. They should identify the same hosts and addresses. Correct the registrar object or zone record, then increment the SOA serial and reload.
Only some locations resolve
This usually indicates caching during a delegation change. Compare responses with dig +trace and several recursive resolvers, leave the old service online, and allow the documented cache period to pass. If one region still fails afterward, investigate its resolver path and IPv6 connectivity.
One nameserver works while the other does not
Test each address independently for authoritative SOA, NS and application records over both transports. Synchronize the zone, correct the failed server’s firewall or configuration, and do not assume the working server makes the broken delegation harmless; recursive resolvers may select either address.
Zone edits appear to have no effect
Check that the SOA serial increased, the edited file is the one loaded by the daemon, and the reload completed without errors. A stale serial or a syntax error leaves the previous data active.
Operational and security practices
- Disable open recursion: An authoritative-only VPS should not resolve arbitrary internet names for strangers.
- Restrict transfers: Permit AXFR/IXFR only to known secondary addresses and use authenticated transfers where supported.
- Monitor both servers: Alert on SOA availability, NS consistency, UDP/TCP reachability and expiration of the zone.
- Back up configuration: Store zone files, daemon configuration and registrar host-record details outside the VPS.
- Plan DNSSEC separately: DNSSEC adds signing keys, DS records at the parent and rollover procedures. Do not publish a DS record until the signed zone and key-management process are operational.
- Use independent infrastructure: Separate networks, power domains or providers reduce the chance that one incident removes every authoritative server.
Self-hosted VPS DNS versus managed DNS
| Consideration | Self-hosted on your VPS | Managed DNS service |
|---|---|---|
| Operational responsibility | You patch the daemon, maintain zones, secure recursion and handle outages. | The service operator maintains the DNS platform; you manage records and account access. |
| Redundancy | You must provide independent servers or locations. | Usually distributed by the provider; confirm the actual locations and service-level commitments. |
| Registrar and glue control | You create in-bailiwick host records and control the addresses. | The provider supplies nameservers; glue requirements depend on whether they are in-bailiwick. |
| IPv4/IPv6 | You configure listeners, firewall rules and matching glue for each protocol. | Availability and address support depend on the service. |
| DNSSEC and automation | Flexible but requires your own signing, key rotation and API automation. | May include managed signing, APIs and monitoring; verify features before switching. |
| Outage impact | A VPS, network or configuration failure can affect every delegated domain. | Risk is shifted to the provider and your account or integration. |
| Cost | Uses VPS resources and your administration time. | Pricing and limits vary by provider and plan. |
Choose self-hosting when you need control, custom automation or an existing operations team. Choose managed DNS when independent geographic redundancy and reduced maintenance matter more than running the authoritative stack yourself.
Quick Recap
Final pre-cutover checklist
- Both nameserver hostnames are registered as glue at the registrar.
- Glue IPv4 and IPv6 addresses match the addresses served by the VPS.
- The zone contains matching NS and A/AAAA records.
- Each server returns an authoritative SOA and NS response.
- UDP and TCP port 53 work from outside the VPS.
- Recursion is disabled or restricted, and transfers are protected.
- The parent delegation lists both intended nameservers.
- The old DNS service will remain online through the cache period.
- Monitoring and a rollback plan are ready before changing delegation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
