Register Custom Nameservers with Glue Records on Namecheap

Point example.com to nameservers like ns1.example.com and ns2.example.com, and your DNS immediately crashes into a circular dependency. The resolver needs to query your nameserver to get an IP, but it can’t resolve the nameserver’s IP without querying your nameserver. Here is how I register glue records in Namecheap, configure matching zone records on the server, and verify root delegation using dig.

The Circular Dependency Trap (Why Glue Records Exist)

DNS works top-down. When a client requests your domain, its resolver queries the root servers, then the TLD registry (like .com), and finally lands on your authoritative servers.

The trap hits when your nameservers sit right under the domain they manage. The .com registry points the resolver to ns1.example.com, but the resolver has no idea what IP that hostname lives on. To fetch the IP, it has to ask ns1.example.com—which it can’t reach without the IP. That’s the classic chicken-and-egg issue documented in RFC 1034.

Glue records cut through the loop. They are raw A or AAAA records published straight to the parent registry (like Verisign for .com). When the TLD server tells a resolver where to go, it provides both the nameserver hostname and its public IP in the DNS response’s “Additional” section. Per ICANN guidelines on glue records, any nameserver subordinate to the zone it serves must have registry-level glue.

Prerequisites: What You Need Before Touching Namecheap

Don’t just plug random IPs into your registrar and expect DNS to resolve cleanly. You need a functioning environment on your side first:

• Two Static Public IPs: RFC specs demand two distinct nameservers on separate networks. You can technically bind both ns1 and ns2 to a single VPS IP in a pinch, but production environments need two separate public IPv4 addresses.
• A Running Authoritative Nameserver: BIND9, PowerDNS, Knot, or CoreDNS must be listening on port 53 (UDP and TCP) across those IPs.
• Your Namecheap Domain: You need active control over the parent domain.

If you’re migrating an existing production domain with active mailboxes, be careful with these delegation changes. Take a look at our walkthrough on how to point Namecheap DNS to Hostinger without breaking email so you don’t drop mail routing while tweaking your nameservers.

Step 1: Register Personal DNS Servers in Namecheap

Namecheap hides glue records behind an unintuitive label: Personal DNS Servers. Here’s where to find it:

1. Log into Namecheap.
2. Head to Domain List, pick your domain, and click Manage.
3. Open the Advanced DNS tab.
4. Scroll down past the Host Records table until you spot Personal DNS Servers.
5. Click Add Nameserver.

Pick Standard Nameservers or simply type ns1 in the input box. Enter your first public IP (e.g., 198.51.100.10) and hit the green checkmark.

Do the exact same thing for the secondary server: click Add Nameserver, enter ns2, add the second IP (e.g., 198.51.100.11), and save. Namecheap immediately fires off an EPP command pushing your glue IPs directly into the TLD zone files.

Step 2: Configure Authoritative Zone Records on Your DNS Server

Registering glue with Namecheap only teaches the TLD registry where to send incoming traffic. Your own authoritative daemon still needs to know it owns those hostnames. If your server gets a query for ns1.example.com and can’t find an A record in its local zone file, it will throw back a SERVFAIL.

Here’s how my BIND9 zone file looks in /etc/bind/zones/db.example.com:

$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. ( 2024031501 ; Serial (YYYYMMDDNN) 3600 ; Refresh 1800 ; Retry 604800 ; Expire 86400 ) ; Negative Cache TTL ; Authoritative Nameservers
@ IN NS ns1.example.com.
@ IN NS ns2.example.com. ; Glue / Infrastructure A Records
ns1 IN A 198.51.100.10
ns2 IN A 198.51.100.11 ; Apex and Subdomain Records
@ IN A 198.51.100.20
www IN A 198.51.100.20
api IN A 198.51.100.25

Both ns1 and ns2 require explicit A records inside the zone. If you are running dual-stack, drop your AAAA records right underneath them.

Always run a sanity check on your syntax before restarting the daemon:

named-checkzone example.com /etc/bind/zones/db.example.com
systemctl reload bind9

Once you get an OK, reload BIND so port 53 starts serving the updated zone.

Step 3: Point the Domain to Your Custom Nameservers

With the glue registered at the registry and your daemon responding locally, switch your domain’s delegation over to your new hostnames.

1. Hop back to the Domain tab in Namecheap (leaving the Advanced DNS tab).
2. Look for the Nameservers block.
3. Change the dropdown from “Namecheap BasicDNS” to Custom DNS.
4. Enter your hostnames: ns1.example.com in line 1 and ns2.example.com in line 2.
5. Click the green checkmark to commit.

That completes the delegation. Namecheap now updates the NS records at the TLD registry to pair with the glue records you saved in Step 1.

Step 4: Verify Glue Propagation with Dig

Don’t test this in a web browser or run a basic ping. Your ISP and local resolver will cache old data and paper over delegation errors. You want to bypass local caches and ask the TLD root servers directly.

Here is what I run to verify glue registration against Verisign’s .com servers:

dig +trace +nodnssec @a.gtld-servers.net example.com NS

To inspect the glue payload cleanly without a full trace, query a TLD server directly for your NS records:

dig @a.gtld-servers.net example.com A

Here’s the terminal output you want to see:

;; QUESTION SECTION:
;example.com. IN A ;; AUTHORITY SECTION:
example.com. 172800 IN NS ns1.example.com.
example.com. 172800 IN NS ns2.example.com. ;; ADDITIONAL SECTION:
ns1.example.com. 172800 IN A 198.51.100.10
ns2.example.com. 172800 IN A 198.51.100.11 ;; Query time: 24 msec
;; SERVER: 192.5.6.30#53(a.gtld-servers.net)

Look at the ADDITIONAL SECTION. If the IP addresses show up next to ns1.example.com and ns2.example.com directly from gtld-servers.net, your glue is live. If that section is missing, the registry hasn’t accepted or pushed your glue records yet.

The Gotchas That Broke My Setup

I hit three frustrating edge cases during my own migrations. Keep an eye out for them:

1. The Missing In-Zone A Record

I registered the Personal DNS servers on Namecheap, saw it succeed, and walked away. The glue got resolvers to my server, but BIND didn’t have matching A records for ns1 inside the zone itself. Lax resolvers worked fine, but strict DNSSEC-validating resolvers dropped queries mid-tree. You must mirror your glue records with explicit in-zone A/AAAA records.

2. Mixing Up Advanced DNS Host Records and Personal DNS Servers

Namecheap’s Advanced DNS page features a prominent “Host Records” table right at the top. Adding an A record for ns1 there does absolutely nothing once you switch to Custom DNS. That table only works when using Namecheap BasicDNS. Real glue records must be saved in the Personal DNS Servers section further down. Check the official Namecheap Personal DNS documentation if the UI shifts around on you.

3. Updating IPs Without Changing the Serial

When migrating a nameserver to a new box, updating the IP on Namecheap is only half the job. You have to update Namecheap Personal DNS, update your zone file’s A record, increment the SOA serial number, and reload the daemon. If you forget to bump that serial, secondary servers and recursive resolvers will happily serve stale cached records for days.

If you’re handling dynamic subdomains across multiple boxes on your new nameserver, check out our guide on wildcard subdomains with Certbot DNS challenge and Nginx to automate Let’s Encrypt validation via DNS without editing records by hand.

Frequently Asked Questions

How long do Namecheap glue records take to propagate?

Registry updates for gTLDs like .com and .net hit the TLD root servers within 15 to 45 minutes. But third-party recursive resolvers will cache the previous NS delegation until its TTL expires (often 24 to 48 hours). Expect clean global resolution to take between 2 and 24 hours.

Can I use the same IP address for both ns1 and ns2?

Namecheap will let you save the same IP for both, yes. But ccTLD registries (like .de) and strict DNS linter suites will fail your delegation. RFCs demand two separate, routable IP subnets. Use distinct IPs whenever possible.

Do I need glue records if I use third-party nameservers like Cloudflare?

No. Glue is strictly required when a nameserver’s hostname lives under the exact domain it handles (e.g., ns1.mysite.com for mysite.com). If your domain is mysite.com and your nameservers are ns1.cloudflare.com, resolvers can already look up Cloudflare’s IP elsewhere.

How do I update or delete an existing glue record on Namecheap?

Head to Advanced DNS > Personal DNS Servers. Click Edit or the three dots next to the entry to change the IP, or click the trash icon to remove it. : switch your domain back to BasicDNS before deleting active glue, or every domain query will fail immediately.

Next Steps

Once your glue resolves cleanly at the registry level, verify your apex and subdomain routing. If your DNS setup doesn’t support root CNAMEs, read our guide on how to point Namecheap apex domains to a hostname target using ALIAS records to keep your root domains routed properly without hardcoded IPs.