How to Create Custom Nameservers and Glue Records in Namecheap

When you point your domain to nameservers hosted under that exact same domain, DNS resolvers hit a chicken-and-egg problem. If example.com delegates its DNS to ns1.example.com, a resolver can’t look up ns1.example.com without first querying example.com.

To break this infinite loop, you need glue records. Here is how to create custom nameservers (glue records) inside Namecheap, configure your authoritative zone file, and verify the delegation with raw dig queries.

The Circular DNS Trap: Why Glue Records Exist

A glue record is simply an A (or AAAA) record sitting directly at the Top-Level Domain (TLD) registry alongside your domain’s NS delegation. Without it, standard recursive DNS lookups break when nameservers share the parent zone’s suffix.

Here is what happens during a query for app.example.com:

1. The resolver queries the root DNS servers for .com.
2. The root server returns the .com TLD nameservers.
3. The resolver asks the .com TLD server for example.com.
4. The TLD server replies: “The authoritative nameserver is ns1.example.com.”

If the TLD server only returns the hostname ns1.example.com without an IP, the resolver has to resolve ns1.example.com first. But to do that, it has to ask ns1.example.com. Infinite loop. As defined in IETF RFC 1034, the parent zone must supply the nameserver’s IP inside the DNS response’s “Additional Section”. That IP is your glue record.

Prerequisites for Custom Nameservers

Before touching your registrar dashboard, make sure your nameserver infrastructure is actually listening:

• Two Static Public IPs: RFC specs require at least two nameservers for redundancy (like ns1.example.com and ns2.example.com), ideally on separate subnets or VPS instances.
• Active Authoritative DNS Service: BIND9, PowerDNS, Knot DNS, or a control panel (cPanel, CyberPanel) listening on port 53 (UDP and TCP) on those IPs.
• Domain at Namecheap: Access to manage the root domain.

If you plan to route traffic across distinct environments later, check how to route subdomains to different servers in Namecheap DNS or deploy a Docker Compose app on VPS with DNS and SSL.

Step 1: Register Glue Records in Namecheap (Personal DNS Server)

Namecheap doesn’t label this feature “Glue Records” anywhere in the UI. Instead, it lives under Advanced DNS labeled as Personal DNS Server.

Here is how to register the records at the registry level:

1. Log in to Namecheap and head to your Domain List.
2. Click Manage next to your root domain.
3. Open the Advanced DNS tab.
4. Scroll down to Personal DNS Server.
5. Click Add Nameserver.
6. In the Nameserver dropdown, pick ns1 (or enter your custom prefix).
7. Enter the public IPv4 address of your primary nameserver in the IP Address field.
8. Click Done (the green checkmark) to save.
9. Repeat for ns2 using your secondary nameserver IP.

Namecheap lets you register standard IPv4 addresses here. Depending on the TLD registry backend, adding IPv6 (AAAA) glue records sometimes requires opening a support ticket.

Step 2: Configure Zone Records on Your Authoritative Server

Registering glue records pushes your nameserver IPs to the TLD registry (like Verisign for .com). However, your authoritative server must also declare matching NS and A records in its own zone file. If the zone file and glue records don’t match, resolvers can drop queries or fail unpredictably.

Here is a working BIND9 zone file (/etc/bind/zones/db.example.com):

Define your SOA, NS, and host records:

$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. ( 2026033001 ; Serial 3600 ; Refresh (1 hour) 1800 ; Retry (30 mins) 1209600 ; Expire (2 weeks) 86400 ) ; Minimum TTL (1 day) ; Define Authoritative Nameservers
@ IN NS ns1.example.com.
@ IN NS ns2.example.com. ; Glue / Host A Records for Nameservers
ns1 IN A 198.51.100.10
ns2 IN A 198.51.100.11 ; Apex and Web Hosts
@ IN A 203.0.113.50
www IN CNAME example.com.

Increment your serial number whenever you touch this zone file, then reload BIND:

sudo named-checkzone example.com /etc/bind/zones/db.example.com
sudo systemctl reload bind9

If you’re using PowerDNS with MySQL or PostgreSQL, insert the corresponding rows into the records table for both NS entries and the A records for ns1 and ns2.

Step 3: Switch Domain Nameservers to Custom DNS

Once your glue records are saved and your DNS daemon is answering queries, point the domain itself to your new nameservers.

1. In Namecheap, switch back to the main Domain tab.
2. Find the Nameservers section.
3. Change the dropdown from Namecheap BasicDNS to Custom DNS.
4. Enter ns1.example.com under Nameserver 1.
5. Enter ns2.example.com under Nameserver 2.
6. Click the green checkmark to save.

If you run email on this domain, verify your MX setup with our guide on how to configure Namecheap Private Email DNS on custom nameservers. For root domain routing rules, check our A record vs CNAME guide.

Step 4: Verify Delegation and Glue Records with Dig

Don’t rely on a browser to verify nameserver changes. OS-level resolvers cache heavily. Query the TLD root servers directly with dig instead.

To inspect the glue record returned by the TLD servers for a .com domain, query one of Verisign’s root TLD servers (like a.gtld-servers.net):

dig @a.gtld-servers.net example.com NS +norecurse

Look at the output structure. You should see your custom nameservers in the AUTHORITY SECTION and their raw IPs in the ADDITIONAL SECTION:

;; AUTHORITY SECTION:
example.com. 172800 IN NS ns1.example.com.
example.com. 172800 IN NS ns2.example.com. ;; ADDITIONAL SECTION:
ns1.example.com. 172800 IN A 198.51.100.10
ns2.example.com. 172800 IN A 198.51.100.11 ;; Query time: 14 msec
;; SERVER: 192.5.6.30#53(a.gtld-servers.net)

Those A records in the ADDITIONAL SECTION confirm your glue records are live at the registry. Resolvers can now bootstrap the nameserver lookup without getting stuck in a loop.

Next, trace resolution from the root servers down to your authoritative host:

dig +trace +nodnssec example.com

If the final answer comes straight from your server’s IP with the aa (authoritative answer) flag set, your custom nameservers are working.

Troubleshooting Glue Record Misconfigurations

1. The “Glue Mismatch” Error

A common headache: you change your VPS IP address in your server zone files but forget to update the Personal DNS Server section in Namecheap. When that happens:

• The TLD server serves the old, dead IP in the ADDITIONAL SECTION.
• Resolvers attempt the old IP first and time out.
• Queries stall or intermittently fail, spiking DNS latency over 2000ms.

Fix it by updating the IP under Advanced DNS > Personal DNS Server in Namecheap, waiting ~15 minutes for the registry update, and verifying with dig @a.gtld-servers.net.

2. Port 53 Blocked by Firewall

DNS needs UDP port 53 for standard queries and TCP port 53 for payloads over 512 bytes (plus DNSSEC). Test connectivity from an external machine:

# Test UDP lookup
dig @198.51.100.10 example.com A # Test TCP lookup
dig @198.51.100.10 example.com A +tcp

If queries hang or time out, open the ports on your server firewall:

sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw reload

3. “Nameserver does not exist” Error During Delegation

If you try setting Custom DNS to ns1.example.com and Namecheap throws an error claiming the nameserver is invalid or unregistered, you skipped Step 1. You cannot assign child nameservers under the Domain tab until you register them as Personal DNS Servers first.

Frequently Asked Questions

Can I create glue records for a domain registered elsewhere?

No. Glue records must always be created at the registrar where the domain is registered. If example.com is registered at Namecheap, create the personal DNS server records inside Namecheap. Once created, other domains anywhere on the internet can use ns1.example.com as their nameserver.

How long does it take for Namecheap glue records to propagate?

Namecheap pushes Personal DNS Server updates to the TLD registry (like Verisign or PIR) within 15 to 45 minutes. Full worldwide propagation across recursive resolvers usually settles within a few hours, though standard TTL caches can take up to 24-48 hours to fully clear.

Do I need separate IP addresses for ns1 and ns2?

Technically, most registrars let you assign the same IP to both hostnames, but it creates a single point of failure and violates RFC standards. Some strict registries (like .de or .fr) run pre-delegation checks and outright reject glue records if both hostnames point to the same subnet.

What is the difference between an A record and a glue record?

A standard A record lives inside your zone file on your authoritative nameserver. A glue record is an A record stored upstream at the TLD root registry to resolve the circular dependency of in-bailiwick nameservers.

Official resources

• OpenAI API documentation