Set up your nameservers
Step by step — buy a nameserver domain, enroll two cheap VPS in different locations as nameserver nodes, let SpipCP install PowerDNS, then run the one-time glue wizard at your registrar and verify it.
This is the one-time setup for self-hosted DNS: stand up the two boxes that will answer for your domains. You do it once; after that you just delegate domains to them. Everything here lives under Networking → Nameservers in the panel — a page titled DNS Servers with a Nameserver boxes tab and a Self-hosted zones tab, separate from Settings (managed providers) and from the generic Add-Node flow. (The old DNS → DNS Servers link still works.)
Two VPS — ideally on two different providers
Before you start, have two cheap VPS ready, plus one domain to host the nameservers on. The two boxes are your failover, so what matters is that they fail independently:
ns1+ns2on a single box — pointless; one reboot takes out all your DNS.- Two boxes, same provider, same region — weak; they can land on the same physical host, and they share the provider's network, power, and account.
- Two boxes, two different providers (and regions) — best. Separate companies means separate hardware, separate upstream networks (ASNs), separate power, and separate control planes, so no single outage, BGP incident, or account suspension can dark both nameservers at once.
SpipCP writes to each box independently (no link between them — see How it works),
so splitting ns1 and ns2 across two providers is the natural setup, not a special case.
VPS specs
A nameserver is light — PowerDNS answers queries and holds a small zone file; it's not a busy web server. The cost driver is two boxes in two locations, not the size of each box. The smallest tier at most providers is plenty to start.
| Resource | Minimum | Recommended | Why |
|---|---|---|---|
| vCPU | 1 | 1–2 | DNSSEC signing and query load are tiny; 1 core serves a small fleet. A 2nd core only helps with many busy zones. |
| RAM | 512 MB | 1 GB | PowerDNS fits in a few hundred MB; 1 GB leaves headroom for the OS, updates, and key ops. |
| Disk | 10 GB | 20 GB SSD | The OS, PowerDNS, and the zone data are small; the room is for logs and updates. SSD keeps signing snappy. |
| Network | 1 public IPv4 (static) | 1 IPv4 + 1 IPv6, static | Each box needs a stable public IP — it's the glue record. IPv6 lets v6-only resolvers reach you directly. |
| Bandwidth | whatever the tier includes | — | A non-issue for DNS. Queries are tiny UDP packets (tens to a few hundred bytes); even a busy fleet uses a sliver of a 1 TB/mo allowance. Don't pay for bandwidth here. |
| OS | Ubuntu 24.04 LTS | Ubuntu 24.04 LTS | What the enroll flow hardens and installs PowerDNS on. |
| Locations | 2 boxes, 2 regions | 2 boxes, 2 providers + 2 regions | See the callout above — separate providers give independent hardware, network, power, and control planes. |
Why so small?
A nameserver does only DNS — SpipCP won't run instances or sites on it — so you're sizing for DNS alone, which is cheap. The typical $4–6/mo "nano"/"micro" tier at Hetzner, Bunny, OVH, Vultr, etc. is enough for each box. Spend the budget on the second location, not on bigger boxes.
1. Buy a nameserver domain
Register one domain whose only job is to host your nameserver hostnames — for example
spipdns.com. You'll create two hostnames under it, ns1.spipdns.com and ns2.spipdns.com, and
every domain you self-host will be delegated to that pair.
It can be at any registrar; it doesn't have to be the same one as the domains you'll serve. Keep it cheap and boring — it's plumbing, not a brand.
Some ccTLDs won't register glue — name your nameservers under a gTLD
This is why you buy a separate domain for the nameservers rather than naming them inside a domain
you serve. Registrars can create glue (host records) for generic TLDs like .com/.net, but some
ccTLDs — .eu (EURid) is the notable one — do not permit registrar-created in-domain glue; the
registrar's glue / "Hosts" screen is simply disabled for them ("feature not supported for this
extension"). So if the domain you want to serve is a .eu (or similar), you cannot name your
nameservers inside it (ns1.example.eu is a dead end).
Instead, name them under a glue-friendly domain you own — a .com like spipdns.com — register the
glue once there, then delegate your .eu (and every other) domain to ns1/ns2.spipdns.com with no
glue needed at the served domain. This is the generally-recommended pattern anyway (a dedicated
nameserver domain); the .eu restriction just makes it mandatory. The nameserver domain itself stays on
its own registrar's DNS — you're only adding the ns names + glue to it, not delegating it.
2. Enroll two VPS as nameserver nodes
In the panel, go to Networking → Nameservers → Nameserver boxes tab → Add a nameserver. This is its own flow, not the generic Add-Node wizard — a nameserver node is a distinct kind that won't host instances or sites. Run it twice, once per VPS:
For your first VPS (location A), give the flow the SSH connection details (host, user, private key) plus
the nameserver hostname (ns1.spipdns.com) and the box's public IP. You don't type a PowerDNS API
key — the panel generates it for you. You can also tag the box with a Provider label (free text — e.g.
Hetzner, OVH) and an expiry date for the box's domain or VPS; both then show on the nameserver card
so you can see at a glance where each box lives and when it renews. It enrolls and hardens like any node,
just tagged nameserver. This becomes ns1.
Repeat for your second VPS in a different location (location B), as ns2.spipdns.com. This becomes
ns2.
The public IPs you entered become the glue records at your registrar (step 4).
3. SpipCP installs PowerDNS
When a nameserver box enrolls, the panel installs PowerDNS on it (the authoritative server plus its API, kept private to the box, with rate-limiting on port 53 to blunt abuse). You don't configure PowerDNS by hand or paste an API key — the panel generates the key, stores it encrypted, and writes it onto that box during the install. The key never returns to your browser and never leaves the panel except onto its own box.
The PowerDNS API is bound to localhost on the box — it is never exposed to the network. The panel
drives it through the node's agent (the same authenticated agent WebSocket used for everything else),
so the only thing listening publicly is port 53. On a real Ubuntu 24.04 box, systemd-resolved's stub
listener normally holds port 53; the nameserver recipe frees it (it sets DNSStubListener=no and restarts
resolved) before PowerDNS starts, so PowerDNS can bind :53 — the panel handles this for you, there's
nothing to do by hand.
4. The one-time glue wizard
This is the part the panel cannot do for you — it's Layer 1 at your registrar — so the
panel guides and verifies it instead. "Glue" tells the world the IP addresses of your nameserver
hostnames, breaking the chicken-and-egg where ns1.spipdns.com is itself inside spipdns.com.
The wizard shows you exactly what to enter at the registrar of your nameserver domain (spipdns.com):
| Register as a "host" / "private nameserver" | IP |
|---|---|
ns1.spipdns.com | your first VPS's public IP |
ns2.spipdns.com | your second VPS's public IP |
At your nameserver domain's registrar, find "register a host", "private nameservers", or
"glue records" (the name varies). Create ns1.spipdns.com → IP A and ns2.spipdns.com → IP B,
using the exact values the wizard shows.
Back in the panel, click Verify glue. SpipCP resolves the two hostnames from outside and confirms they return the right IPs. Glue can take a little while to propagate at the registrar — re-run Verify until it's green.
Glue is registered once, for the nameserver domain only
You do this once, for spipdns.com (the nameserver domain) — not per domain you serve. After it's
verified, every domain you self-host just delegates to ns1/ns2.spipdns.com
(delegate a domain) with no further glue work.
5. The NS-health dashboard
The Nameserver boxes tab under Networking → Nameservers lists your nameserver boxes with a live health check for each: whether the box is reachable, whether PowerDNS is answering on port 53, and whether its glue verifies. Each card also shows the box's provider label and expiry badge. A green pair means you're ready to serve zones; an unreachable box shows here so you can fix it before the second one also fails.
Next steps
- Delegate a domain — put your first real domain on your nameservers.
- Failover — what the two boxes buy you and what the dashboard watches.
- DNSSEC — sign your zones.
Run your own nameservers
Own your DNS end to end by running PowerDNS on cheap VPS as nameserver nodes. The trade-offs (two boxes, the upkeep, no anycast), how it works, and why it's worth it for data ownership.
Delegate a domain
Per owned domain — create the zone in the panel, add records and the wildcard, then change the registrar's nameservers to ns1/ns2.spipdns.com and verify it propagated. Layer 1 made concrete.