Summary: If ns1.yourbrand.com doesn't resolve, or client domains using your private nameservers don't load, work through these checks for glue records, typos, propagation, and DNSSEC.
Step 1: Figure out which part is failing
Run these commands in Terminal (Mac or Linux), replacing the example names with yours. Each one tests a different piece.
# 1. Does the nameserver itself resolve to your server's IP?
dig +short ns1.yourbrand.com
# 2. What nameservers does the client domain use?
dig +short NS clientdomain.com
# 3. Does your server answer for the client domain?
dig @YOUR-SERVER-IP clientdomain.com A +shortOn Windows, use Command Prompt:
nslookup ns1.yourbrand.com 8.8.8.8
nslookup -type=ns clientdomain.com 8.8.8.8
nslookup clientdomain.com YOUR-SERVER-IP| Result | Likely cause | Go to |
|---|---|---|
| Test 1 returns nothing or the wrong IP | Glue or A records are missing or wrong | Step 2 |
| Test 2 shows the old nameservers | The domain wasn't updated, or the change is still spreading | Step 3 |
| Test 3 returns nothing | There's no DNS zone for that domain on your server | Step 4 |
| All three look right, but the site still fails for some people | Caching or DNSSEC | Steps 3 and 5 |
Step 2: Check glue and A records
- Register glue at the right registrar. Child nameservers belong at the registrar for your brand domain (
yourbrand.com), not the client's domain. - Check the IP. The glue for both
ns1andns2should point to your server's dedicated IPv4 address. You'll find it in your welcome email and in the Client Area under Services. - Check the registry. For
.comand.netbrand domains, run:
Your IP should appear in the ADDITIONAL section. If it doesn't, the glue hasn't been registered or hasn't reached the registry yet.dig +norec @a.gtld-servers.net ns1.yourbrand.com A - Check the A records. The DNS zone for
yourbrand.comneeds A records forns1andns2. If that zone lives on your server, check it in WHM » DNS Functions » DNS Zone Manager.
Step 3: Look for typos and wait for propagation
- Look closely for typos like
ns1.yourbrnad.com, extra spaces, or a missingns2. The names must match exactly everywhere: at the registrar, in WHM » Server Configuration » Basic WebHost Manager Setup, and in the client domain's settings. - Nameserver changes can take 24 to 48 hours to reach everyone, because resolvers cache the old values. Glue records usually update within a few hours.
- To see what the authoritative servers say, without caching getting in the way, run:
dig +trace clientdomain.com - Your own computer may cache old answers. Flush it with
ipconfig /flushdnson Windows, orsudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderon a Mac.
Step 4: Make sure your server has the zone
Your server can only answer for domains it knows about. If Test 3 returns nothing:
- Confirm that the domain belongs to a cPanel account in WHM » Account Functions » List Accounts, or is an addon domain on one.
- Check WHM » DNS Functions » DNS Zone Manager for the domain's zone and its A record.
- Check that DNS is running in WHM » Server Status » Service Status.
Step 5: Check DNSSEC
If the client domain used DNSSEC at its old DNS host, its registrar may still have DS records for the old setup. That can make the domain fail to resolve (a SERVFAIL error) once it moves to your nameservers. Run:
dig +short DS clientdomain.comIf this returns a result and you haven't set up DNSSEC on your server, remove the DS records at the client's registrar. After that, allow time for caches to clear.
Registrar notes
- The child nameserver feature goes by different names depending on the registrar: "Child Nameservers," "Glue Records," "Register Nameservers," "Host Names," or "Personal DNS Server." Look in the domain's advanced or DNS settings, or ask your registrar's support team.
- Some registrars and country-code domain extensions won't accept two nameservers on the same IP. Your plan includes one IPv4 address, so if you run into this, open a ticket to discuss options.
- Brand domain registered with Liberation? Open a ticket and we'll help register your child nameservers.
Still stuck? Open a ticket
Our U.S.-based support team is available 24/7. Open a support ticket from the Liberation Client Area and include your brand domain, one affected client domain, and the output of the three dig or nslookup tests. Tickets are private, so they are the safe place to share server details. Never post passwords in public forums or chats.
