Troubleshooting Private Nameserver Propagation Issues

Private nameservers involve more moving parts than a standard nameserver change, which means more places for something to go wrong. Here’s how to isolate the actual cause when a domain using them won’t resolve.

Check the glue record first, independently of everything else

Use dig ns1.yourdomain.com (or an online DNS lookup tool) from an external network. If this doesn’t return the expected IP at all, the problem is the glue record itself — either it was never registered at the registry, or it hasn’t propagated yet. Nothing downstream will work until this resolves correctly.

Confirm the nameserver is actually answering DNS queries

A glue record resolving to the right IP only tells you the address is correct — it doesn’t confirm a DNS server is actually listening and answering there. Test directly: dig @ns1-ip-address yourdomain.com. If this times out or refuses, the DNS service on that server isn’t configured or running correctly, independent of any glue record or propagation issue.

Check the domain’s own NS records match

A domain using your private nameservers needs its own NS records (set at ITS registrar) actually listing ns1.yourdomain.com / ns2.yourdomain.com. A common mistake is registering the glue records correctly but forgetting to actually switch a given domain’s nameservers to use them.

Give it real time

Glue record changes, like any DNS change, follow normal propagation timing — but because resolvers may have cached the OLD state of a nameserver lookup for its full TTL, propagation for glue record changes can occasionally feel slower than a typical DNS record update. Allow up to 24-48 hours before treating it as a genuine problem rather than normal propagation delay.

A systematic order to check things in

1. Does the glue record resolve to the right IP? (registry-level)
2. Does that IP actually answer DNS queries? (server-level)
3. Does the specific domain’s NS records point at your nameservers? (domain-level)
4. Has enough time passed for propagation?

Working through these in order, rather than jumping between them, is the fastest way to isolate which specific layer is actually broken.