{"id":4433,"date":"2026-09-12T17:04:53","date_gmt":"2026-09-12T11:34:53","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-setup-custom-nameservers-whm-cpanel\/"},"modified":"2026-09-12T17:06:50","modified_gmt":"2026-09-12T11:36:50","slug":"how-to-setup-custom-nameservers-whm-cpanel","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-setup-custom-nameservers-whm-cpanel\/","title":{"rendered":"How to Set Up White-Label Custom Nameservers for Your Hosting Agency (ns1\/ns2)"},"content":{"rendered":"<p>When running an independent web hosting company or offering managed web services through a digital agency, professional brand presentation is non-negotiable. If your clients inspect their domain DNS settings and see generic nameservers belonging to an upstream wholesale hosting provider, your agency looks like an unverified middleman rather than a reliable cloud infrastructure partner.<\/p>\n<p>Setting up <strong>White-Label Custom Nameservers<\/strong> (such as <code>ns1.youragency.com<\/code> and <code>ns2.youragency.com<\/code>) reinforces your brand authority, conceals your upstream hosting provider, and allows you to migrate server hardware in the future without forcing clients to update their individual domain registrar configurations on a <a href=\"https:\/\/cpanelfree.com\/\">Linux VPS<\/a>. In this tutorial, you will learn how to register GLUE records, configure nameservers in WHM, and update DNS zone templates.<\/p>\n<h2>1. Understanding GLUE Records: The Foundation of Custom DNS<\/h2>\n<p>When you assign nameservers located under your own root domain (e.g., <code>youragency.com<\/code> using <code>ns1.youragency.com<\/code>), a circular resolution dependency occurs:<\/p>\n<ul>\n<li>A browser requests <code>clientdomain.com<\/code>. The root DNS server directs the browser to query <code>ns1.youragency.com<\/code>.<\/li>\n<li>To query <code>ns1.youragency.com<\/code>, the browser must first resolve the IP address of <code>youragency.com<\/code>.<\/li>\n<li>To resolve <code>youragency.com<\/code>, the browser must query <code>ns1.youragency.com<\/code>\u2014resulting in an infinite resolution deadlock.<\/li>\n<\/ul>\n<p>To break this loop, you must register <strong>GLUE Records<\/strong> (Child Nameservers) directly with the Top-Level Domain (TLD) registry through your domain registrar. A GLUE record explicitly ties your nameserver hostname directly to a static public IPv4 address at the root registry level.<\/p>\n<h2>2. Step-by-Step GLUE Record Registration<\/h2>\n<p>Log in to the domain registrar where you purchased your primary agency domain (e.g., Namecheap, GoDaddy, Cloudflare, or Porkbun):<\/p>\n<ol>\n<li>Navigate to the <strong>Advanced DNS<\/strong> or <strong>Custom Nameservers \/ GLUE Records<\/strong> management section.<\/li>\n<li>Create two child host records:\n<ul>\n<li><strong>Host 1:<\/strong> <code>ns1.youragency.com<\/code> &rarr; Point to your assigned Primary WHM Nameserver IP (e.g., <code>192.0.2.10<\/code>).<\/li>\n<li><strong>Host 2:<\/strong> <code>ns2.youragency.com<\/code> &rarr; Point to your assigned Secondary WHM Nameserver IP (e.g., <code>192.0.2.11<\/code>).<\/li>\n<\/ul>\n<\/li>\n<li>Save changes. TLD registries typically propagate GLUE records globally within 2 to 4 hours.<\/li>\n<\/ol>\n<h2>3. Configuring Nameservers in WebHost Manager (WHM)<\/h2>\n<p>Once GLUE records are registered, log in to <strong>WHM as root or reseller administrator<\/strong>:<\/p>\n<ol>\n<li>Navigate to <strong>Server Configuration &gt; Basic WebHost Manager Setup<\/strong>.<\/li>\n<li>Scroll down to the <strong>Nameservers<\/strong> section.<\/li>\n<li>In the input fields, enter your custom nameservers:\n<pre><code>Nameserver 1: ns1.youragency.com\nNameserver 2: ns2.youragency.com<\/code><\/pre>\n<\/li>\n<li>Click <strong>Assign IP Address<\/strong> next to each nameserver to bind them to your server\u2019s public IPs.<\/li>\n<li>Click <strong>Add an A Entry for this nameserver<\/strong> to ensure WHM generates corresponding authoritative DNS A records in your primary domain zone file.<\/li>\n<\/ol>\n<h2>4. Updating the Standard DNS Zone Template<\/h2>\n<p>To guarantee that every newly created cPanel account automatically uses your custom nameservers in its default zone file:<\/p>\n<ol>\n<li>In WHM, navigate to <strong>DNS Functions &gt; Edit Zone Templates<\/strong>.<\/li>\n<li>Select the <strong>Standard Virtual Hosting Template<\/strong>.<\/li>\n<li>Verify that the NS records point to your custom hostnames:\n<pre><code>%domain%.   IN  SOA  ns1.youragency.com.  admin.youragency.com. (\n            %serial%\n            3600\n            1800\n            1209600\n            86400 )\n%domain%.   IN  NS   ns1.youragency.com.\n%domain%.   IN  NS   ns2.youragency.com.<\/code><\/pre>\n<\/li>\n<li>Save the template. All future accounts provisioned via WHM or billing modules will inherit your branded DNS structure automatically.<\/li>\n<\/ol>\n<h2>5. Testing DNS Resolution &amp; Propagation via Terminal<\/h2>\n<p>Verify that your custom nameservers respond authoritatively using terminal DNS diagnostic utilities:<\/p>\n<pre><code># Query nameserver directly using dig\ndig @ns1.youragency.com youragency.com A +short\n\n# Verify authoritative NS records\ndig youragency.com NS +short\n# Expected output:\n# ns1.youragency.com.\n# ns2.youragency.com.<\/code><\/pre>\n<p>If <code>dig<\/code> returns your server\u2019s public IP cleanly, your white-label nameserver cluster is fully operational and ready to serve customer traffic.<\/p>\n<h2>Troubleshooting Custom DNS Propagation &amp; RFC 2182 Compliance<\/h2>\n<p>To ensure global email deliverability and uninterrupted web resolution, custom nameserver deployments must satisfy strict Internet Engineering Task Force (IETF) DNS standards:<\/p>\n<ul>\n<li><strong>Geographic Diversity &amp; Subnet Isolation (RFC 2182):<\/strong> The IETF mandates that authoritative nameservers should reside on distinct physical subnets (e.g., <code>192.0.2.x<\/code> and <code>198.51.100.x<\/code>). Binding both <code>ns1<\/code> and <code>ns2<\/code> to the exact same physical IP address or datacenter rack creates a single point of failure (SPOF) if the primary host loses upstream connectivity.<\/li>\n<li><strong>Deploying a Free Secondary cPanel DNS Only Cluster:<\/strong> Rather than running standalone DNS, deploy <strong>cPanel DNS Only<\/strong> (a free, lightweight distribution of cPanel) on two separate low-cost VPS nodes in different continents. Link your primary WHM server to the DNS cluster using <strong>Cluster Configuration<\/strong> in WHM:\n<pre><code>WHM &gt; DNS Functions &gt; Cluster Configuration &gt; Add Cluster Member<\/code><\/pre>\n<p>    Whenever you add or delete a domain in WHM, zone files sync instantaneously across your global DNS cluster in sub-second intervals.<\/li>\n<li><strong>Validating Nameserver Health with DNSViz:<\/strong> Paste your domain into <a href=\"https:\/\/dnsviz.net\/\" target=\"_blank\" rel=\"noopener\">DNSViz<\/a> to analyze your delegation path, verify glue records, check for lame delegations, and confirm DNSSEC cryptographic signatures.<\/li>\n<\/ul>\n<h2>Enterprise Custom Nameserver Health Check &amp; Redundancy Protocol<\/h2>\n<p>Ensure your custom nameservers remain 100% resilient during upstream network disruptions:<\/p>\n<ul>\n<li><strong>Configuring Multi-Datacenter Anycast Routing:<\/strong> For high-volume agencies managing hundreds of customer domains, standard unicast DNS can become a bottleneck during regional fiber cuts. Transition nameserver IPs to an Anycast network routing profile (via Cloudflare or dedicated DNS providers) so queries are answered by the geographically closest edge server.<\/li>\n<li><strong>Setting Up Secondary Nameserver Synchronization with BIND:<\/strong> If you prefer to manage your own nameserver cluster on Linux VPS, configure authoritative zone transfers via AXFR\/IXFR using TSIG cryptographic authentication keys in <code>named.conf<\/code>:\n<pre><code>key \"transfer-key\" {\n    algorithm hmac-sha256;\n    secret \"GeneratedBase64SecretKeyHere=\";\n};<\/code><\/pre>\n<p>    This ensures that when a client adds a DNS record in cPanel, the update synchronizes across all secondary nameserver nodes in milliseconds.<\/li>\n<li><strong>DNSSEC Zone Signing in WHM:<\/strong> Activate Domain Name System Security Extensions (DNSSEC) in WHM <strong>DNS Functions &gt; Manage DNSSEC Keys<\/strong> to cryptographically sign your zone files, permanently preventing DNS cache poisoning and man-in-the-middle spoofing attacks.<\/li>\n<\/ul>\n<div style=\"background: linear-gradient(135deg, #0f172a 0%, #1e293b 100%);border: 1px solid #334155;border-radius: 12px;padding: 28px;margin: 36px 0;text-align: center\">\n<h3 style=\"color: #38bdf8;margin-top: 0;font-size: 22px\">White-Label Hosting Power on CpanelFree<\/h3>\n<p style=\"color: #cbd5e1;font-size: 16px;line-height: 1.6;max-width: 680px;margin: 12px auto 24px auto\">Build your brand on rock-solid cloud infrastructure. Enjoy free private nameserver support, high-speed NVMe storage, and dedicated IP addresses on CpanelFree.<\/p>\n<p>    <a href=\"https:\/\/cpanelfree.com\/\" style=\"background: #38bdf8;color: #0f172a;font-weight: 700;padding: 12px 28px;border-radius: 6px;text-decoration: none;display: inline-block;font-size: 15px\">Explore Reseller Hosting &rarr;<\/a>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>When running an independent web hosting company or offering managed web services through a digital agency, professional brand presentation is non-negotiable. If your clients inspect their domain DNS settings and see generic nameservers belonging to an upstream wholesale hosting provider, your agency looks like an unverified middleman rather than a reliable cloud infrastructure partner. Setting &#8230; <a title=\"How to Set Up White-Label Custom Nameservers for Your Hosting Agency (ns1\/ns2)\" class=\"read-more\" href=\"https:\/\/cpanelfree.com\/blog\/how-to-setup-custom-nameservers-whm-cpanel\/\" aria-label=\"Read more about How to Set Up White-Label Custom Nameservers for Your Hosting Agency (ns1\/ns2)\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":4432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4433","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web-hosting-news"],"_links":{"self":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/comments?post=4433"}],"version-history":[{"count":2,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4433\/revisions"}],"predecessor-version":[{"id":4459,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4433\/revisions\/4459"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/media\/4432"}],"wp:attachment":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/media?parent=4433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/categories?post=4433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/tags?post=4433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}