Set Up Custom Nameservers with Namecheap Glue Records

When you spin up your own BIND, PowerDNS, or cPanel box, registrar default DNS stops cutting it. If you want domains pointing to ns1.yourdomain.com and ns2.yourdomain.com, you have to register glue records directly with the top-level domain (TLD) registry through Namecheap.

Skip this step, and resolvers hit an immediate circular dependency deadlock. Here is how I set up personal DNS servers in Namecheap, wire up the matching BIND9 zone records on the server, and verify the glue responses straight from root TLD servers using dig.

How Glue Records Prevent Circular DNS Deadlocks

When a resolver looks up a hostname, it walks down the chain: root servers first, then TLD servers (like Verisign for .com), and finally your authoritative nameservers. But if your domain is example.com and its nameserver is ns1.example.com, resolvers get stuck in an infinite loop.

To find example.com, the resolver queries ns1.example.com. But to find ns1.example.com, it first has to resolve example.com. As laid out in RFC 1034, the registry breaks this loop with a glue record—an A or AAAA record tied straight to the delegation at the registry level.

When a resolver queries the .com TLD servers for example.com, the TLD returns both the NS record and the server’s IP right in the ADDITIONAL SECTION of the packet. The resolver gets the IP immediately and knows where to send the next query.

Prerequisites and Server IP Requirements

Before touching anything in Namecheap’s dashboard, make sure your server environment is actually ready:

• Two distinct public IP addresses: You can technically point both nameservers to one IP while messing around in staging, but standard DNS requires two distinct IPs on separate subnets for true fault tolerance.
• A domain registered on Namecheap: You’ll need full dashboard access to whatever domain will host your nameserver hostnames.
• A live DNS daemon: BIND9, PowerDNS, Knot, or your hosting control panel listening on UDP and TCP port 53 across both target IPs.

If you’re juggling apps across different providers, you might already be familiar with pointing Namecheap apex records to external hosting. Nameservers are a completely different animal, though—this configuration lives tucked away inside Namecheap’s Advanced DNS tab.

Register Personal DNS Servers in Namecheap

Namecheap labels glue records as “Personal DNS Servers”. Here’s where to find them:

1. Log in to Namecheap and head to your Domain List.
2. Click Manage next to your nameserver domain (e.g., example.com).
3. Select the Advanced DNS tab.
4. Scroll down past the standard host records until you see the Personal DNS Server section.
5. Click Add Nameserver.

Pick ns1 from the dropdown (or type it in), plug in the IPv4 address for your primary server, and hit save. Do the exact same thing for ns2 using your secondary server’s IP address.

If your server supports IPv6, add those AAAA glue records here too. Namecheap lets you bind both IPv4 and IPv6 addresses to each nameserver entry.

Switch the Domain to Your Custom Nameservers

Registering glue records tells the TLD registry where your nameserver IPs live, but your domain isn’t actually using them yet. You still have to switch the domain’s delegation over to those new nameservers.

Jump back to the main Domain tab in Namecheap. Look for the Nameservers section, which usually defaults to Namecheap BasicDNS.

Change that dropdown to Custom DNS and punch in your hostnames:

• Nameserver 1: ns1.yourdomain.com
• Nameserver 2: ns2.yourdomain.com

Click the green checkmark to save. Namecheap will push the delegation update up to the TLD registry.

Configure Matching Zone Records on the Hosting Server

One classic mistake is setting up glue records at the registrar while forgetting to put matching A and NS records inside the actual authoritative zone file on the server. If your authoritative server disagrees with what the registry claims, strict resolvers and DNSSEC validators will choke on your queries.

Here is how a clean zone file looks on Debian or Ubuntu running BIND9 at /etc/bind/zones/db.example.com:

$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. ( 2026033001 ; Serial (YYYYMMDDNN) 3600 ; Refresh 1800 ; Retry 604800 ; Expire 86400 ) ; Minimum TTL ; Authoritative Nameservers
@ IN NS ns1.example.com.
@ IN NS ns2.example.com. ; Glue Record Target A Records
ns1 IN A 198.51.100.10
ns2 IN A 198.51.100.11 ; Base Web Server Records
@ IN A 198.51.100.10
www IN CNAME example.com.

Whenever you edit this file, bump the serial number and run BIND’s check tools before reloading the service:

named-checkzone example.com /etc/bind/zones/db.example.com
systemctl reload bind9

If you’re setting up split-horizon or catalog zones, check out the BIND 9 documentation for advanced configs. If you also need internal sub-routing on this host, see our guide on creating subdomains on Namecheap to keep everything aligned.

Verify Glue Records with Dig and Trace Queries

Don’t trust browser caches or your local ISP’s recursive resolver to test glue records. If a resolver cached an old lookup, it will lie to you. Query the TLD servers directly using dig.

First, find the root and TLD nameservers for your extension. For a .com, ask the root servers for Verisign’s nodes:

dig +norecurse @a.gtld-servers.net. example.com NS

Pay close attention to the ADDITIONAL SECTION. If glue records are working, you’ll see your server IP paired directly with the nameserver hostname right from the TLD authority:

;; QUESTION SECTION:
;example.com. IN NS ;; AUTHORITY SECTION:
example.com. 172800 IN NS ns1.example.com.
example.com. 172800 IN NS ns2.example.com. ;; ADDITIONAL SECTION:
ns1.example.com. 172800 IN A 198.51.100.10
ns2.example.com. 172800 IN A 198.51.100.11 ;; Query time: 14 msec
;; SERVER: 192.5.6.30#53(a.gtld-servers.net)

If that ADDITIONAL SECTION is empty and your nameservers only show up in AUTHORITY SECTION, either Namecheap hasn’t pushed the glue record yet, or the registry rejected it.

Once that looks right, run a full trace query to verify the whole chain from root to host:

dig +trace +nodnssec example.com

You want to see the lookup step down cleanly from root servers to gtld-servers.net, and finally land on your IP (198.51.100.10) with an authoritative answer straight from your daemon.

Gotcha: Updating IPs on Existing Glue Records

When I migrated our internal cluster to a fresh subnet last year, I edited the Personal DNS Server IPs in Namecheap and figured normal TTL rules applied. That cost us 36 hours of intermittent downtime.

TLD registries cache glue records with TTLs often pinned between 24 and 48 hours (Verisign often uses 172,800 seconds on .com). Changing the IP in Namecheap does not wipe the TLD’s cache.

If you ever have to migrate IPs down the line, use a zero-downtime rollover instead:

1. Don’t touch your existing ns1 and ns2 records yet.
2. Register two brand-new glue records: ns3.example.com and ns4.example.com pointing to your new IPs.
3. Add ns3 and ns4 to your Custom Nameservers list so all four nameservers are active simultaneously.
4. Wait 48 hours for global resolvers to cache the new IPs.
5. Drop ns1 and ns2 from your nameserver list, then delete the old glue records under Advanced DNS.

For more edge cases on registry-level behaviors, read through the ICANN guidance on glue records.

Frequently Asked Questions

Can I use the same IP address for both ns1 and ns2?

Namecheap lets you save the same IP for both, and basic queries will resolve. But don’t do it in production. Several ccTLDs (like .de and .fr) and automated zone linters will flag or flat-out refuse delegations that don’t provide distinct subnets.

Why does Namecheap show an error when saving my nameservers?

If you switch to Custom Nameservers and type in ns1.yourdomain.com before adding the glue records under Personal DNS Server, Namecheap throws an error. The registry won’t let you delegate a domain to child hostnames that don’t exist yet.

Do glue records interfere with third-party email routing?

No. Glue records only handle resolving the nameservers themselves; they don’t touch MX or TXT records. That said, once you point delegation to your own server, your local DNS daemon is responsible for answering all MX requests. If you use external mail, check our guide on configuring Namecheap Private Email MX records so your inbox doesn’t break.

How long does it take for custom nameservers to propagate?

Namecheap applies the setting right away, but getting the TLD registry to sync usually takes anywhere from 15 minutes to 2 hours. Full global resolver propagation can take 24 to 48 hours depending on downstream ISP caching.

Next Steps for Your Server DNS

With glue records resolving cleanly, head to your VPS provider and configure reverse DNS (PTR records) to match your primary hostname. If you’re running web apps behind Nginx on that same box, take a look at our walkthrough on deploying apps on a VPS with Namecheap DNS to wire up your production web stack.