Create and use your own NSServer

Managed DNS Hosting
1

I am on “desec.io” because I would like to set up my own name servers.
e.g. ns1.domainname.com and ns2.domainname.com
So that I can then use these for other domains.

1: I was able to register successfully with “desec.io”.
2: I was also able to enter the ns of “desec.io” at my registry.
3: I then also created NS entries at desec.io and entered the host name (NSServer) of my storage provider.

Now, however, when I enter my created NS " ns1.domainname.com" at my registry for another domain, I receive an error message “An unexpected error occurred”.

What have I done wrong?

2

Hi @silhub,

I believe you desire to do
DNS zone transfer - Wikipedia.

I also believe that deSEC doesn’t support AXFR.

That being said, please wait for more knowledgeable community members responses.

Also take a look at

Try searching AXFR and also DNS Zone Transfer within this community forum.

:slightly_smiling_face:

3

@peter did get anything wrong or from an angle not in alignment with deSEC?

4

I’m not sure I understand what you are trying to tell us here?

I understood that you have a domain (domainname.com) that is set up to use deSEC name servers, correct?

Then you created ns1 and ns2 NS records in this domain like this?

  • ns1.domainame.com NS ns1.desec.io.
  • ns2.domainame.com NS ns2.desec.org.

And then you tried to use these NS records as authoritative NS for another domain? Presumably a domain for which no zone exists at deSEC?

If this is what you did, then that is not going to work. If not please explain in more detail what you did.

I can’t see what you are actually trying to achieve. Please explain what your goal is.

Some general notes on how DNS works:

The parent zone for a domain name contains the NS glue records. E.g. for the domain domainname.com. these NS glue records would be in the zone for the com. domain. The NS glue records need to resolve to the IPs for the authoritative name servers for the domain. These name servers need to actually answer queries for the domain, i.e. they need a zone (file or database) containing the DNS records.

At least 2 authoritative NS are required and they need to be in separate networks. (So you can’t just add 2 NS records that resolve to the same IP.)

NS records point to a hostname. That hostname must resolve to one or more IPs using A/AAAA records.

HTH
fiwswe

PS. I don’t think AXFR has any bearing on this issue. But maybe I am misunderstanding what @silhub is trying to do?

1 Like
5

@Peter pointed out to me that my terminology was somewhat wrong:
Please replace “NS glue” with “NS delegation” in my previous reply.

Thanks @Peter :slight_smile: I’m always happy to learn.

fiwswe

2 Likes
6

I’m not sure I completely understood this discussion. Is it possible to use custom nameservers?

Reason for asking: I’m considering migrating from Bunny DNS to deSEC and I am currently using custom nameservers.

Unfortunately, I failed to replicate that using the information in this topic. This is what I tried:

  • at deSEC for zone example.org:
    • remove existing NS records (ns1.desec.io and ns2.desec.org)
    • add NS records ns1.example.org and ns2.example.org
    • add CNAME record ns1 with target ns1.desec.io.
    • add CNAME record ns2 with target ns2.desec.org.
  • at registrar (Porkbun) for domain example.org:
    • set up nameservers ns1.example.org and ns2.example.org
    • set up glue records:
      • host name ns1.example.org to IP addresses 45.54.76.1 and
        2607:f740:e633:deec::2
      • host name ns2.example.org to IP addresses 157.53.224.1 and
        2607:f740:e00a:deec::2

However, now (only) ns1.example.org and ns2.example.org resolve, but example.org (a HTTPS record with priority 0 and target example.com.) not :cry: (example.com does)

What did I do wrong? (Or can’t this work?)

7

I think the problem is this:

You need to setup A/AAAA records. CNAME won’t work. I’m using the same setup as you plan on using without issues, using A/AAAA records for ns1/ns2.

2 Likes
8

Thank you!

Will give that a try. Does the TTL of 3600 mean that I need to wait 1 hour for the previous CNAMEentry to expire, before testing the newA/AAAArecords?

And is 3600 the minimum TTL at deSEC?

(I could use 60 or 300 at Bunny)

9

It works indeed with A/AAAA records instead of CNAME :tada:

Thanks again!

2 Likes
10

Glad that I could help!

Yes it is. For me the 3600 was never an issue, DNS changes still propagated within 5-10 minutes in my case at least.

NB: for dyndns, TTL is set to 60 automatically.

1 Like