Recommended Free Tools
To make Ubuntu authoritative for a domain with NSD, install the nsd package, declare the zone in /etc/nsd/nsd.conf, create a valid zone file, validate both files, start NSD, and query the server directly. Internet-wide authority additionally requires parent-zone delegation (and glue when the nameserver is inside the delegated domain), reachable UDP and TCP port 53, and usually more than one independent nameserver.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
NSD is authoritative-only: it answers from the zones you publish but does not provide recursive caching for clients. The commands below use Ubuntu’s packaged service and an illustrative zone named example.com; replace addresses, hostnames, and records with your own values.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What NSD does—and what it does not do
NSD (Name Server Daemon) is an authoritative DNS server. It receives queries from recursive resolvers and returns data from its configured zones, including SOA, NS, A, AAAA, MX, TXT and other records. It is not a recursive resolver or a general-purpose cache for workstation clients. Ubuntu’s current nsd.conf(5) documentation describes it as “an authoritative only DNS server.”
This distinction determines the design. If you need a machine that resolves arbitrary Internet names for a local network, deploy a recursive resolver separately. If you own example.com and want to publish its DNS data, NSD is the authoritative component. Recursive resolvers will cache the answers they receive from it according to each record’s TTL.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Plan the deployment before installing
Write down these values before editing configuration:
- The Ubuntu release (for example, Noble or Resolute), so you can record the package version actually installed.
- The server’s stable public IPv4 address and, if used, IPv6 address.
- The fully qualified names of the authoritative servers, such as
ns1.example.comandns2.example.net. - The zone name, including whether it is a forward zone such as
example.comor a reverse zone. - Whether this host is the primary (source of zone changes) or a secondary (transferred copy).
- Who controls the parent zone and registrar, because delegation is outside NSD itself.
For an Internet-facing domain, allow inbound and outbound DNS on both UDP and TCP port 53. UDP handles ordinary queries; TCP is required for some large responses, DNSSEC responses, and reliable zone transfers. Ensure the host name resolves to the intended address and that local firewall, cloud security-group, and provider firewall rules all agree.
Install NSD from Ubuntu’s package manager
NLnet Labs documents the distribution package as the easiest installation route on Debian and Ubuntu. Distribution packages can lag the upstream release, but they integrate with Ubuntu’s service manager and filesystem conventions. Building from source is appropriate when you specifically need a newer release or compile-time options.
- Refresh package metadata and install NSD:
sudo apt update sudo apt install nsd - Record the candidate and installed versions for change management:
apt-cache policy nsd nsd -v - Check that the package supplied the expected configuration and service files:
ls -l /etc/nsd/nsd.conf systemctl cat nsd
Package versions are release-specific and change over time. The Ubuntu Noble package documentation lists NSD 4.8.0-1build3, while the Ubuntu Resolute package manpage lists 4.14.0-1 (versions shown in material accessed on 2026-10-15). NLnet Labs’ installation documentation is for NSD 4.15.4. Do not pin a command to one of those numbers without checking the repository for your own release.
Understand nsd.conf and protect it
The main file is /etc/nsd/nsd.conf. It uses attribute: value syntax and supports top-level clauses such as server:, zone:, pattern:, key: and verify:. The file specifies options for the NSD server, zone files, primaries and secondaries.
Keep the configuration and zone files in version control, but do not expose TSIG secrets. A practical baseline is root ownership, a group-readable configuration only when required by your deployment, and read access for the account under which NSD runs. Check the package’s service unit to confirm the runtime user rather than assuming its name.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo chown root:root /etc/nsd/nsd.conf
sudo chmod 0644 /etc/nsd/nsd.conf
sudo install -o root -g root -m 0644 /etc/nsd/example.com.zoneIf a zone file contains operationally sensitive TXT data or transfer keys are stored alongside configuration, tighten permissions further and keep secrets in a separately managed file. Never commit a real TSIG secret to a public repository.
A minimal server stanza
Ubuntu’s package defaults may already provide a usable server: section. Add only settings you understand and need. A simple explicit listener configuration is:
server:
ip-address: 0.0.0.0
ip-address: ::Binding both addresses makes NSD listen on all IPv4 and IPv6 interfaces. On a multi-homed host, replace these with the specific service addresses. If another daemon already occupies port 53, NSD will fail to bind; identify the conflict with ss -lntup before changing services.
Create an authoritative zone file
Every authoritative zone needs at least an SOA record and NS records. Add the address and mail records your application requires. The following is a complete example, not a template for your actual mail or web infrastructure:
$TTL 3600
@ IN SOA ns1.example.com. hostmaster.example.com. (
2026101501 ; serial: YYYYMMDDnn, increment every publication
3600 ; refresh
900 ; retry
1209600 ; expire
300 ; negative caching TTL
)
@ IN NS ns1.example.com.
@ IN NS ns2.example.net.
ns1 IN A 192.0.2.10
ns1 IN AAAA 2001:db8:10::10
www IN A 192.0.2.80
www IN AAAA 2001:db8:80::80
mail IN A 192.0.2.25
@ IN MX 10 mail.example.com.Save it at the path used in the configuration, for example /etc/nsd/example.com.zone. The trailing dots on fully qualified names are significant: without them, a name can be interpreted relative to the zone and become incorrect.
Use the SOA serial deliberately
Secondaries decide whether to transfer a newer zone by comparing the SOA serial. Increment it for every published change, including a record deletion. A date-based value such as 2026101501 is convenient: use the next sequence number for a second change on the same day, and never move the serial backwards. If you use a simple integer instead, continue increasing it monotonically.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Reverse zones and special records
Reverse DNS uses a separate zone name, such as 2.0.192.in-addr.arpa for a suitably sized IPv4 block, with PTR records. IPv6 reverse zones use the nibble-reversed ip6.arpa name. The address block holder must delegate that reverse zone to your nameservers; adding a PTR record locally is not enough.
Declare the zone in nsd.conf
Add a zone: stanza that maps the DNS name to the file:
zone:
name: example.com
zonefile: /etc/nsd/example.com.zoneThe name and zonefile pair is the essential declaration shown in Ubuntu’s NSD references. Keep one clear stanza per zone. For many zones, NSD patterns can reduce repetition, but start with explicit declarations until a single zone works.
Configure primary and secondary transfers
Authority is more resilient when at least two independent nameservers serve the zone. One can be the primary and another a secondary. Transfers should be restricted to known addresses and authenticated with TSIG; do not use broad, unauthenticated transfer permissions on a public server.
Primary configuration
On the primary, notify tells listed secondaries to check for a new serial, and provide-xfr permits the transfer. A representative configuration is:
key:
name: transfer-key
algorithm: hmac-sha256
secret: BASE64_SECRET_HERE
zone:
name: example.com
zonefile: /etc/nsd/example.com.zone
notify: 198.51.100.20 transfer-key
provide-xfr: 198.51.100.20 transfer-keyReplace the example address and secret with your secondary’s address and a key generated and stored securely. The exact accepted key algorithms and optional transfer parameters are shown by the nsd.conf(5) manpage installed with your package.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Secondary configuration
On the secondary, allow-notify identifies the primary allowed to signal changes and request-xfr identifies where to obtain the zone:
key:
name: transfer-key
algorithm: hmac-sha256
secret: BASE64_SECRET_HERE
zone:
name: example.com
zonefile: /var/lib/nsd/secondary/example.com.zone
allow-notify: 192.0.2.10 transfer-key
request-xfr: 192.0.2.10 transfer-keyUse the same key material on both servers, limit each rule to the other server’s address, and permit TCP 53 between them. A secondary’s zone file is normally maintained by NSD after a successful transfer; do not edit it manually while transfers are enabled.
Validate before starting or reloading
Validation catches syntax errors, missing files, malformed records and many delegation mistakes before they become an outage. Run the checks as the account that can read the configuration and zone:
- Check the complete configuration:
sudo nsd-checkconf /etc/nsd/nsd.confA successful check produces no diagnostic output and returns exit status zero. An error includes the file and line; fix that line and rerun the command.
- Check the zone file independently:
sudo nsd-checkzone example.com /etc/nsd/example.com.zoneUse the exact zone name and path from your stanza. Correct missing SOA/NS records, bad owner names, invalid TTLs and syntax errors before proceeding.
- Confirm that the NSD process can read every referenced file. A validation command run as root can pass even when a confined service user lacks permission, so inspect ownership and the service logs if startup still fails.
Some Ubuntu package revisions add or adjust validation options. If a command is rejected, read the installed utility’s usage output and the local nsd-checkconf(8)/nsd-checkzone(8) manpages rather than copying options from a different NSD release.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Start NSD and verify listeners
- Enable NSD at boot and start it now:
sudo systemctl enable --now nsd - Inspect status and recent logs:
systemctl status nsd --no-pager sudo journalctl -u nsd -b --no-pager - Confirm UDP and TCP listeners on port 53:
sudo ss -lntup | grep ':53'
If startup fails, common causes are a syntax error, an unreadable zone file, a duplicate port-53 listener, an address that is not assigned to the host, or an invalid transfer-key declaration. The journal normally identifies the first failing file or directive. Fix that root error, rerun both validation checks, and restart or reload only after they pass.
Reload a changed zone safely
After editing a zone and incrementing its SOA serial, validate first, then ask NSD to reread configuration:
sudo nsd-checkconf /etc/nsd/nsd.conf
sudo nsd-checkzone example.com /etc/nsd/example.com.zone
sudo systemctl reload nsdIf the service unit does not provide a reload action on your Ubuntu release, use NSD’s control utility as documented locally, for example sudo nsd-control reconfig. Check the journal and query the new serial; never assume a reload succeeded because the command returned immediately.
Query NSD directly
Test the server itself before changing delegation. Replace 192.0.2.10 with the server address:
dig @192.0.2.10 example.com SOA +norecurse
dig @192.0.2.10 example.com NS +norecurse
dig @192.0.2.10 www.example.com A +norecurse
dig @192.0.2.10 www.example.com AAAA +norecurse
dig @192.0.2.10 example.com MX +norecurseIn each response, look for the aa (authoritative answer) flag. Confirm that the SOA serial is the value you published, the NS names are correct, and address records match the intended service. An answer without aa, a timeout, or an unexpected serial indicates a listener, firewall, zone-loading or query-path problem.
Force TCP as a separate test:
dig +tcp @192.0.2.10 example.com SOA +norecurseRepeat from another network when possible. A local query proves that NSD works on the host; it does not prove that packets can reach the public address or that parent delegation points to it.
Publish delegation for an Internet-facing domain
Authoritative answers become public only after the parent zone delegates your domain. At the registrar or registry, set the domain’s nameservers to the hostnames you configured. If a nameserver hostname is inside the same domain—for example, ns1.example.com for example.com—the parent also needs glue records containing its IP addresses. Otherwise resolvers can face a circular dependency while trying to discover the nameserver address.
Registry policies differ: some require a minimum number of independent nameservers, geographic or network diversity, IPv6 checks, or DNSSEC-related records. Those requirements are not defined by NSD and must be confirmed with the relevant registry. After delegation propagates, query through unrelated recursive resolvers and use external DNS testing vantage points to confirm that the parent returns your NS set and that each listed server answers authoritatively.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsDNSSEC considerations
NSD supports authoritative DNSSEC service, but signing and key management are an operational workflow separate from the basic unsigned zone shown here. Decide where keys are generated and stored, how signatures are refreshed before expiry, and how the DS record is submitted to the parent. Test signatures and expiry monitoring before enabling validation for production traffic. Do not publish a DS record for a zone whose signed data is not consistently available from every authoritative server.
NSD compared with BIND9 for this job
| Decision point | NSD | BIND9 |
|---|---|---|
| Primary role | Authoritative-only service | Can provide authoritative service and also act as a recursive resolver/cache |
| Ubuntu packaging | Use the release package; versions vary by Ubuntu release and can lag upstream | Also packaged by Ubuntu; choose a release and update policy appropriate to your environment |
| Configuration model | nsd.conf with server, zone, pattern and transfer clauses |
Different configuration files and syntax, with broader resolver functionality |
| Transfers | Explicit notify/provide-xfr and allow-notify/request-xfr rules, preferably TSIG-authenticated | Supports restricted and authenticated transfers through its own configuration model |
| DNSSEC | Can serve signed authoritative data; signing and key operations must be planned | Can serve signed data and offers a different signing/tooling workflow |
| Operational footprint | Focused authoritative feature set; no recursive cache to secure | More roles and features, which can mean more configuration and a larger attack surface when recursion is enabled |
Choose NSD when the requirement is a focused authoritative service and recursion will be handled elsewhere. Choose a resolver-capable server when the same daemon must intentionally provide recursive service, and firewall recursion so it is never open to the Internet by accident.
Troubleshooting by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
nsd-checkconf reports an error |
Invalid attribute, indentation, duplicate or unknown clause | Read the reported line, compare its spelling and nesting with the installed nsd.conf(5), then rerun the check. |
| Zone check fails | Malformed record, missing SOA/NS, bad owner name or wrong file path | Run nsd-checkzone with the exact zone name and inspect the indicated record. |
| Service will not start | Port 53 conflict, unavailable bind address, permissions or unreadable zone | Use systemctl status nsd, journalctl -u nsd and ss -lntup; verify addresses exist on the host. |
| Query times out | Firewall, security group, routing or NSD not listening on that address | Check UDP and TCP 53 locally and from another network; inspect host and provider firewall rules. |
Answer lacks the aa flag |
Query reached a recursive resolver or a server that is not authoritative for the name | Query the NSD address directly and verify the zone name and delegation. |
| Secondary remains on an old serial | Serial was not incremented, notify/transfer is blocked, or TSIG does not match | Compare SOA serials, test TCP 53 between servers, inspect both journals, and verify identical key name, algorithm and secret. |
| Public resolvers return old data | Normal recursive-cache TTL, incomplete delegation propagation or an unchanged serial | Query the parent NS set, check the published SOA serial and wait for the prior TTL to expire before diagnosing a server failure. |
Production checklist
- Ubuntu release and installed NSD version recorded with
apt-cache policy nsd. - Stable IPv4/IPv6 addresses, hostnames and primary/secondary roles documented.
/etc/nsd/nsd.confand all zone files protected and backed up.- SOA, NS and required application records present; serial increments on every change.
- Configuration and every zone pass the installed validation utilities.
- NSD is enabled, running and listening on intended UDP and TCP port-53 addresses.
- Direct
digtests show the authoritative flag, expected serial and correct records. - Transfers use restricted addresses and TSIG rather than open transfer access.
- Host, cloud and upstream firewalls allow DNS traffic.
- Parent delegation, glue and registry-specific nameserver requirements are complete.
- Monitoring checks SOA serials, authority, reachability over UDP/TCP, and (if used) DNSSEC validity.
NSD does not publish a setup-time, throughput, uptime or failure-rate guarantee for this procedure. Reliability comes from correct zone data, deliberate serial management, secured transfers, redundant authoritative servers, reachable networking and continuous checks after each change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
