Recommended Free Tools
To run branded nameservers such as ns1.example.com and ns2.example.com from a Virtualmin VPS, you must complete two separate configurations: register both hostnames (glue or child nameservers) at your domain registrar, then create matching DNS records and defaults in Virtualmin. The registrar delegation, glue IPs, zone NS records and A records must agree.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Virtualmin cannot create registrar glue records. You perform that part in the registrar account, while Virtualmin and its local BIND server answer DNS queries for hosted zones. The procedure below also shows how to verify the setup, diagnose SERVFAIL, and add an actually independent secondary DNS server.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What the finished setup looks like
Assume your domain is example.com and the VPS has a public address such as 203.0.113.10. The intended arrangement is:
ns1.example.comis registered at the registrar as a child host and points to the nameserver IP.ns2.example.comis registered in the same way. It may use a second address if you have one, or the same VPS address when both services are on one machine.- The
example.comzone hosted by Virtualmin publishes NS records for both names. - That zone also publishes A records mapping each nameserver hostname to its registered address.
- The domain’s registrar delegation lists the same two nameservers.
When a resolver asks for example.com, the parent zone uses the registered glue addresses to find your servers. BIND on the Virtualmin machine then returns the zone’s NS, A and other records. A hostname on the same VPS can provide a second label, but it does not create a second failure domain; a power, network or operating-system failure still removes both nameservers.
#1 Best Overall
Prerequisites before changing DNS
Start with a clean, supported operating system and a VPS with a stable public IP. Virtualmin’s installation documentation covers supported operating systems and the expected installation process in Downloading and Installing and Automated Installation.
Server and domain requirements
- Give the VPS a fully qualified hostname that resolves consistently to its public address.
- Know the public IP address or addresses that will be used for
ns1andns2. - Own the domain and have access to the registrar account that controls its delegation.
- Ensure the domain’s existing DNS records can be changed to point services at the VPS.
- Install Virtualmin with BIND as the local DNS server component if this machine will be authoritative for the zones.
Do not delegate the domain to nameserver hostnames that have not yet been registered at the registrar. The parent zone needs glue to resolve a nameserver located inside the domain being delegated.
Step 1: Register ns1 and ns2 as child nameservers
Open the registrar’s host, nameserver or advanced DNS area. Labels differ by registrar; the feature is commonly called glue records, registered hosts or child nameservers.
- Create a host named
ns1.example.comand enter the public IP address of the VPS (or the first intended nameserver address). - Create
ns2.example.comand enter its intended public IP address. If both names are on one VPS, this can be the same address, but the arrangement remains vulnerable to one-server failure. - Save the host registrations and wait for the registrar to accept them.
- Change the domain’s delegation so its authoritative nameserver list contains
ns1.example.comandns2.example.com.
These registrations are parent-zone data. Virtualmin cannot edit them; the registrar account is the only place to create or correct the glue. Virtualmin’s Troubleshooting DNS documentation specifically separates this registrar task from the records in your hosted zone.
Why the order matters
A normal A lookup can find a hostname by first consulting its parent zone. A nameserver such as ns1.example.com is different: the resolver may need that address before it can ask example.com for anything. The registrar’s glue supplies that bootstrap address. Without it, or with an incorrect address, recursive resolvers can reach the wrong machine or fail before Virtualmin is queried.
Rank #2
Step 2: Add matching records in Virtualmin
After registering the hosts, create the corresponding records in the DNS zone managed by Virtualmin.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Sign in to Virtualmin and select the primary domain,
example.comin this example. - Open DNS Settings → DNS Records.
- Add an A record for
ns1.example.compointing to the exact IP entered at the registrar. - Add an A record for
ns2.example.compointing to its exact registered IP. - Save the zone and allow Virtualmin/BIND to reload it.
The names and addresses must be identical character-for-character and digit-for-digit across the registrar’s glue and these A records. If the registrar has ns2.example.com at one address while the Virtualmin zone publishes another, different resolvers can receive different answers and report intermittent failures.
Set the nameserver defaults for new domains
Virtualmin’s server template determines which NS records are written when you create additional hosted domains. Configure the default template so future zones do not revert to provider nameservers:
- Go to System Settings → Server Templates.
- Open Default Settings.
- Select DNS domain.
- Set Primary DNS server hostname to
ns1.example.com. - In Additional manually configured nameservers, enter
ns2.example.com. - Save the template.
This template controls the nameserver set written for newly created domains. It does not retroactively rewrite every existing zone; inspect and edit an older domain’s DNS records when necessary.
Check the zone’s NS records
The zone itself must advertise the same pair that the registrar delegates. In the primary domain’s DNS records, confirm that the NS set names ns1.example.com and ns2.example.com, and that the A records for those names point to the registered addresses. Virtualmin’s documentation summarizes the requirement as: “NS (Name Server) records on your Virtualmin server should align with your glue records.”
Rank #3
Step 3: Verify delegation from outside the VPS
Test from a workstation or another network, not only from the VPS itself. Local caching can hide a bad delegation.
Inspect registrar-side data
whois example.comReview the domain’s delegated nameservers and, where the registrar displays them, the registered host addresses. The exact WHOIS fields vary by registry and registrar, so use the result to confirm names and compare the IP values rather than expecting one fixed layout.
Ask a resolver for the delegated NS set
host -t NS example.comThe answer should list the same two hostnames configured in the registrar account and the Virtualmin zone. An unexpected provider hostname, a spelling difference, or only one of the two names indicates that delegation has not been updated correctly.
Resolve the domain and each nameserver
host example.comhost example.com ns1.example.com
The first command checks normal resolution. The second explicitly asks ns1.example.com to answer, which helps distinguish a parent-delegation problem from a problem serving the zone on the VPS. Repeat the explicit query with ns2.example.com when testing the second server.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse the four-way consistency check
| Layer | What must be present | Where to inspect it |
|---|---|---|
| Registered hosts (glue) | ns1.example.com and ns2.example.com with their public IPs |
Registrar host/child-nameserver panel or WHOIS output |
| Delegation | The domain delegates to those same two hostnames | Registrar delegation settings and host -t NS example.com |
| Zone NS records | The authoritative zone publishes the same two names | Virtualmin DNS Records and an NS query |
| Zone A records | Each nameserver hostname maps to its registered IP | Virtualmin DNS Records and direct host queries |
All four layers have to agree. A correct record at only one layer cannot repair a mismatch at another.
Step 4: Allow for DNS propagation
Virtualmin says DNS changes can take from a few hours up to 48 hours to propagate. That is vendor guidance, not a universal deadline: recursive resolvers retain cached NS and address data for the published TTL, and registries and registrars can apply updates on different schedules.
During that window, one resolver may use the old delegation while another uses the new one. Test from more than one network and avoid repeatedly changing names and addresses, because each change can extend the period in which caches disagree. If failures continue after the old data should have expired, return to the four-way consistency check rather than waiting indefinitely.
Free tools Windows power users keep installed
One-click scans. No signup required.
Diagnosing SERVFAIL and intermittent answers
SERVFAIL means the resolver could not obtain a usable authoritative answer; it does not identify one specific Virtualmin setting. Use the symptom to choose the comparison below.
The domain returns SERVFAIL immediately after switching nameservers
- Run
host -t NS example.com. If it still shows the previous provider, the registrar delegation change has not taken effect or was saved for a different domain. - Check the registrar’s child-host entries. A missing
ns1orns2registration leaves the parent without the glue needed to reach an in-domain nameserver. - Compare every glue IP with the A records in Virtualmin. Correct the side that differs, then query again after the relevant caches expire.
One nameserver works and the other fails
- Query each hostname explicitly with
host example.com ns1.example.comand the equivalent command forns2.example.com. - Inspect the failing hostname’s registrar host record and Virtualmin A record for a typo or stale address.
- Confirm that the zone’s NS record does not contain a spelling variant such as a missing label or an unintended trailing name.
Answers alternate between success and failure
Mixed results usually mean different resolvers have cached different delegations or that the glue and zone data disagree. Check the exact IP at the registrar and in Virtualmin, then check that the delegated NS set and the zone NS set are identical. Virtualmin identifies a glue/NS mismatch as a cause of intermittent resolution failure; changing only a local hosts file or testing from one cached resolver will not fix it.
The nameservers resolve, but the hosted zone is wrong
If the nameserver hostnames have the right addresses yet host example.com ns1.example.com returns missing or unexpected records, inspect the selected domain’s DNS Records page. You may have edited a different Virtualmin virtual server, or the zone may still publish provider NS records. The server template affects new domains, so an existing zone can require a direct correction.
Both nameservers disappear during a VPS outage
Two labels pointing to one VPS are not independent DNS. They share the same host, network path and BIND process. This arrangement can be adequate for a small installation when its failure risk is acceptable, but it cannot provide availability during a VPS failure.
Adding an independent secondary DNS server
For resilience, place a secondary DNS service on another server or network. Virtualmin documents a Webmin/BIND workflow in How to Configure Secondary DNS.
- Prepare the separate server and ensure it can receive DNS data from the Virtualmin primary.
- In Webmin, open Servers → BIND DNS Server → Cluster Secondary Servers.
- Enable creation of secondary zones.
- Configure the primary server’s external IP in the BIND module configuration, so the secondary workflow knows which address supplies the zones.
- Set the secondary server’s hostname as an additional nameserver where appropriate, and verify that the resulting zone and delegation contain the intended set.
The exact hostnames and addresses still have to be registered as child nameservers at the registrar when they are inside your domain. The secondary server must be operationally separate from the VPS to provide a separate failure domain; putting another nameserver hostname on the same machine adds a label, not redundancy.
Single VPS versus an independent secondary
| Consideration | Both nameservers on one VPS | Separate secondary server |
|---|---|---|
| Failure independence | None: one VPS, network or BIND outage affects both names | Can continue answering when the primary VPS is unavailable, provided the secondary is separately hosted |
| Operational complexity | Lowest; create glue, zone records and template defaults | Higher; configure secondary-zone creation and the primary external IP in Webmin/BIND |
| Branded nameservers | Use ns1.example.com and ns2.example.com directly |
Can retain branded names while assigning one name to the independent server |
| Cost | No additional secondary service cost is established by Virtualmin’s documentation; you still pay for the VPS | Additional hosting or DNS-service cost is not stated by Virtualmin and depends on the separate provider |
| Best fit | Development, low-risk sites, or installations that accept a single failure domain | Production domains where DNS availability must survive a primary-server outage |
Keeping future Virtualmin domains consistent
Once the default DNS domain template contains the primary and additional nameserver hostnames, use it as the starting point for new virtual servers. For each new domain, verify the generated NS records and confirm that the nameserver A records are available in the authoritative zone. A template is a defaulting mechanism, not a substitute for checking the registrar delegation of a newly registered domain.
Change management checklist
- Record the current registrar glue hostnames and IP addresses before making an edit.
- Make the registrar change and the Virtualmin zone change agree before testing.
- Check both the delegated NS response and direct answers from each nameserver.
- Test from an external network to avoid relying on the VPS’s local cache.
- Note the time of the change and allow the documented propagation window before judging a cache-related failure.
- When moving to a new VPS, update glue and zone A records deliberately; leaving one layer on the old IP creates a split-brain delegation.
Quick reference: the complete setup
- Install Virtualmin on a supported operating system and assign the VPS a proper hostname.
- Choose the public IP for each nameserver.
- Register
ns1.example.comandns2.example.comas child hosts at the registrar. - Delegate
example.comto those names. - In Virtualmin, add matching A records under DNS Settings → DNS Records.
- In System Settings → Server Templates → Default Settings → DNS domain, set the primary hostname and additional nameserver.
- Verify glue, delegation, NS and A records with WHOIS and
host. - Allow the registrar and recursive-resolver caches to update, using the documented few-hours-to-48-hours window as guidance.
- Add a secondary server through Servers → BIND DNS Server → Cluster Secondary Servers when one-VPS availability is insufficient.
The Bottom Line
Custom Virtualmin nameservers work when registrar glue, delegation, zone NS records and nameserver A records all match. Virtualmin controls the authoritative zone and defaults for new domains; the registrar controls child-host registration. For real redundancy, place the secondary DNS server outside the primary VPS.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
