Base de connaissances

Running your own authoritative DNS server gives you full control over DNS records without relying on a third-party DNS provider — useful for specific hosting setups, internal networks, or learning how DNS infrastructure actually works.

When to Self-Host DNS

• You want complete control and don't want dependency on a third-party DNS provider
• Internal/private DNS resolution needs within your own infrastructure
• Educational purposes — understanding DNS infrastructure hands-on

For most production websites, a managed DNS provider offers better reliability (global anycast infrastructure) than a single self-hosted server — weigh this trade-off before committing to self-hosting for a public-facing domain.

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• A registered domain where you can update nameserver records

Step 1 — Install BIND9

sudo apt update
sudo apt install bind9 bind9utils -y

Step 2 — Configure the Zone

sudo nano /etc/bind/named.conf.local

zone "yourdomain.com" {
    type master;
    file "/etc/bind/zones/db.yourdomain.com";
};

Step 3 — Create the Zone File

sudo mkdir -p /etc/bind/zones
sudo nano /etc/bind/zones/db.yourdomain.com

$TTL 3600
@   IN  SOA ns1.yourdomain.com. admin.yourdomain.com. (
        2024010101  ; Serial
        3600        ; Refresh
        1800        ; Retry
        604800      ; Expire
        3600 )      ; Minimum TTL

    IN  NS  ns1.yourdomain.com.
    IN  NS  ns2.yourdomain.com.

ns1 IN  A   YOUR_SERVER_IP
ns2 IN  A   YOUR_SECOND_SERVER_IP
@   IN  A   YOUR_SERVER_IP
www IN  CNAME   yourdomain.com.

Increment the Serial value on every change to signal to secondary/caching servers that the zone was updated.

Step 4 — Check the Configuration for Errors

sudo named-checkconf
sudo named-checkzone yourdomain.com /etc/bind/zones/db.yourdomain.com

Step 5 — Restart BIND9

sudo systemctl restart bind9

Step 6 — Allow DNS Traffic Through the Firewall

sudo ufw allow 53/tcp
sudo ufw allow 53/udp

Step 7 — Register as a Nameserver (Glue Records)

With your domain registrar, register ns1.yourdomain.com and ns2.yourdomain.com as glue records pointing to your server IPs — a chicken-and-egg requirement since these nameservers are for the domain that also needs to resolve them.

Step 8 — Update Your Domain's Nameservers

At your registrar, set your domain's nameservers to ns1.yourdomain.com and ns2.yourdomain.com.

Setting Up a Secondary DNS Server (Strongly Recommended)

Running only one authoritative DNS server is a single point of failure for your entire domain — configure at least one secondary server as a slave, replicating from your master:

# On the secondary server
zone "yourdomain.com" {
    type slave;
    file "/var/cache/bind/db.yourdomain.com";
    masters { YOUR_MASTER_SERVER_IP; };
};

Testing DNS Resolution

dig @ns1.yourdomain.com yourdomain.com

Common Errors

Zone fails to load — run named-checkzone to catch syntax errors before restarting; a single missing period or misformatted record can invalidate the entire zone file.

Domain doesn't resolve after nameserver change — DNS propagation can take up to 48 hours; verify glue records were correctly configured with your registrar.

Best Practices

• Always run at least two authoritative nameservers, ideally on separate infrastructure, for redundancy
• Increment the zone serial number on every change
• Consider whether a managed DNS provider's reliability outweighs the control of full self-hosting for critical production domains

Continue Reading

• DNS Records Explained: A, AAAA, CNAME, MX, TXT & More
• How to Point a Domain to Your VPS (A/AAAA Records)
• How to Diagnose and Fix DNS Propagation Issues

Browse more articles in Advanced Networking & VPN.