I'm trying to configure bind on a VPS to make ns1.example.com and ns2.example.com point to it (already done) and make it serve example.com.

I used webmin previously on the same machine, and webmin configured bind, and it worked. After some time I have to move to another panel, and now I can't make this work.

  • On my domain panel, I have already configured ns1.example.com and ns2.example.com as "Child NS" with the IP of the VPS.

  • I'm using bind on debian.

  • The VPS name (which can't change for some reason that is not clear to me) is example.serverdomain.

  • Just tested firewall, and it's open on port 53.

  • I actually copied, 99% of the config files created by webmin, which used to work.

/etc/bind/named.conf.local file is:

zone "example.com" {
    type    master;
    file    "/etc/bind/db.example.com";
    allow-transfer {;


/etc/bind/db.example.com file is:

$ttl 1D
$ORIGIN example.com
@                       IN  SOA example.serverdomain. root.example.serverdomain.(
                            20051901    ;Serial
                            10800       ;Refresh
                            3600        ;Retry
                            604800      ;Expire
                            38400       ;Negative Cache TTL
@                       IN  NS  example.serverdomain.
example.com.            IN  NS  ns1.example.com.
example.com.            IN  NS  ns2.example.com.
example.com.            IN  A
www.example.com.        IN  A
ftp.example.com.        IN  A
localhost.example.com.  IN  A
mail.example.com.       IN  A
example.com.            IN  MX  5 mail.example.com.

I tested on intodns.com and I got this

Mismatched NS records WARNING: One or more of your nameservers did not return any of your NS records. Error

DNS servers responded ERROR: One or more of your nameservers did not respond: The ones that did not respond are:

So... What is wrong with the configuration?

  • First, it seems you are using an arbitrary domain name you don't own in your question. Either use the actual domain, when possible, or replace it with an allowed domain like example.com (RFC 6761). – Esa Jokinen May 20 at 5:57
  • @EsaJokinen Ok, I updated the question. :) Can you notice any problem in that configuration now? – Fahed May 20 at 6:30
  • Is the actual IP address of this VPS? It's not answering to DNS queries at all. Maybe the BIND isn't running. Yes, I can notice multiple problems with your configuration. There's also a reason this couldn't be solved as you wish: you need at least two name servers, and they can't both be the same VPS. – Esa Jokinen May 20 at 6:38
  • Also, the zone does not have a A records for ns1.example.com or ns2.example.com which are required. – davidgo May 20 at 7:32
  • 1
    However, we shouldn't advice against the IANA's Technical requirements for authoritative name servers. – Esa Jokinen May 20 at 8:17

It sounds to me like this has.nothing to do with your DNS server.

When you have subdomain records for a parent domain you need glue records. These are entries in the root name servers hard coding those domains to IP addresses. It sounds like these need to be updated to make your DNS work - speak to your registrar about it, as this is not done on your name servers.

| improve this answer | |
  • Sorry, but what you have written above are not words I understand. Child NS is not, AFAIK a phrase with an accepted meaning. If the domain records at the registrar were pointing to the old IP rather then the new one then yes, that is what I am talking about.Google "glue records" – davidgo May 20 at 7:30

Keep in mind that there are Technical requirements for authoritative name servers. The current configuration problem that is preventing your name service to work is mentioned there, too:

Consistency between glue and authoritative data

For name servers that have IP addresses listed as glue, the IP addresses must match the authoritative A and AAAA records for that host.

You had added the necessary glue records to the parent zone through your registrar, but didn't have the correspondind A records on the zone itself, i.e. your zone was missing:

ns1.example.com.        IN  A
ns2.example.com.        IN  A

Now, there's another problem: both are pointing to the same server. That's not OK:

Minimum number of name servers

There must be at least two NS records listed in a delegation, and the hosts must not resolve to the same IP address.

Network diversity

The name servers must be in at least two topologically separate networks. A network is defined as an origin autonomous system in the BGP routing table. The requirement is assessed through inspection of views of the BGP routing table.

Both your registrar or the VPS provider could provide secondary name servers as a service. This should have been addressed before building own name services, but as your registar already allowed you to use the same IP address for both name servers, you still have time to fix this afterwards. Some registars do perform tests before allowing changing the name servers. (Back in good old days e.g. .fi authorities were very strict with this, and wrongly configured name servers could even have led to cancelling the domain altogether.)

Lastly, your SOA record has a problem, too. It should have the valid FQDN hostname of your primary authoritative name server (MNAME) and a working email address of the administrator responsible for this zone (RNAME), e.g. with hostmaster@example.com:

example.com. IN SOA ns1.example.com. hostmaster.example.com. 2020052000 10800 3600 604800 38400
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.