Domains
Glue Records and Custom Nameservers
Glue records solve one specific circular-lookup problem in DNS, and because Kapsule's nameservers live on domains of their own rather than on yours, almost nobody hosting with us ever needs one.
This article explains what a glue record is, why our setup avoids the problem entirely, how to change the nameservers on your domain, and what to do in the rare case where a registry genuinely requires glue.
What a Glue Record Is
Nameservers are named by hostname, not by address. When a registry delegates example.com, it publishes something like "the nameservers for example.com are ns1.example.com and ns2.example.com".
Read that twice and the problem appears. To find example.com, a resolver has to ask example.com's nameservers. To find those nameservers it has to look up ns1.example.com, which is inside example.com, which it cannot reach yet. The lookup chases its own tail.
A glue record breaks the loop. The parent registry publishes the IP addresses of those nameservers alongside the delegation, so a resolver gets the addresses at the same moment it is told the hostnames. The glue is held at the registry, not in your zone, which is why it has to be registered specially rather than added as an ordinary DNS record.
Glue is only needed when a domain's nameservers are named inside that same domain. If your nameservers are hostnames under some other domain, there is no loop, no glue is required, and the ordinary DNS lookup path works.
Why Kapsule Domains Do Not Need Glue
Our nameservers are:
ns1.kapsulecloud.com
ns2.kapsulecloud.com
ns3.kapsuledns.com
ns4.kapsuledns.com
None of them are inside your domain, so no circular lookup exists and no glue record is required. Whatever your domain is called, a resolver finds our nameservers through their own domains without ever needing to reach yours.
The split across two different top-level domains is deliberate. A problem affecting one top-level domain's parent zone cannot take out all four of our nameservers at once, because two of them are reached through a completely different part of the DNS tree.
Always set all four. Setting two, or setting one pair from each, works today but throws away the resilience the design exists to provide. More on this in Nameservers.
Changing the Nameservers on Your Domain
KPanel manages nameservers at the registry from the domain page.
- Sign in to KPanel and click Domains in the left sidebar.
- Click the domain.
- On the Overview tab, find the Nameservers card.
When the domain is on our four, the card carries an On Kapsule DNS pill and there is nothing to do.
To change them, click Edit and enter one hostname per line. The hint is exact: "One hostname per line. 2 to 13 nameservers. Changes apply at the registrar and can take time to propagate." Click Save nameservers.
To go back, click Use Kapsule Defaults, which resets the domain to our four-nameserver set at the registry.
Changing nameservers moves the authoritative answer for your whole domain at once. Your website, your email, your verification records and everything else follow whichever nameservers the registry points at. Before you point a domain away from Kapsule DNS, make sure the destination provider already has a complete, correct copy of your zone, including MX, SPF, DKIM and DMARC. A missing mail record here does not cause a warning, it causes silence.
The panel validates what you enter: between 2 and 13 nameservers, each a valid hostname. If a hostname is malformed it tells you which one. The change is applied at the registry, and how quickly it takes effect worldwide is up to the parent zone rather than us.
What Happens to Your Zone When You Point Away
Pointing the registry at somebody else's nameservers does not delete anything you have here. Your records remain as you left them.
What changes is which features work. The DNS management tab, domain forwarding and DNSSEC all depend on your zone being served by our nameservers. When it is not, the DNS tab shows "No DNS zone linked" with the explanation "DNS management requires a linked zone. It's auto-created when you register a domain through KPanel", and forwarding tells you it needs Kapsule nameservers first.
Point the domain back at our four and those features become available again.
If You Genuinely Need Glue
Two situations call for it:
You run your own nameservers named inside your own domain. For example you operate ns1.yourdomain.com and ns2.yourdomain.com on your own servers. That configuration requires glue at the registry for yourdomain.com.
A registry or a third party has told you to register a host. Registering a nameserver host, sometimes called creating a child nameserver or a private nameserver, is the operation that publishes the glue.
KPanel does not offer a self-service screen for this. Open a support ticket with the domain name, the exact nameserver hostnames, and the IPv4 and IPv6 addresses each should resolve to, and we will take it up with the registry for you.
Before you go down this road, ask what you actually want. If the goal is for customers to see your brand rather than ours in a public lookup, that is vanity nameservers, and it is a presentation change with real operational cost: you become responsible for the availability of the hostnames, and a mistake takes your whole domain offline rather than one record. If the goal is genuinely to run your own DNS infrastructure, glue is the right answer and the ticket above is the way to get it.
Delegating a Subdomain Is Not the Same Thing
The DNS tab offers an NS record type, and it is worth being clear about what that does. An NS record in your zone hands responsibility for a subdomain to somebody else's nameservers, for example letting a third party run status.example.com on their own DNS.
That is delegation, not glue. It happens inside your zone, you can do it yourself on the DNS tab, and it needs no registry involvement. Glue exists only at the parent registry and only for nameservers named inside the domain being delegated.
Troubleshooting
"Provide between 2 and 13 nameservers." Registries require at least two nameservers and accept no more than thirteen. Add a second, or trim the list.
"Invalid nameserver hostname." One of the lines is not a valid hostname. Common causes are a trailing dot, a stray space, an IP address entered where a hostname belongs, or a copied line that picked up a bullet character.
I changed nameservers and my site went down. The new nameservers do not have your records. Click Use Kapsule Defaults to bring the domain back to our DNS, confirm the site loads, then set up the destination zone properly before trying again.
My email stopped when I changed DNS providers. The MX, SPF and DKIM records did not come across. Recreate them at the new provider. The Deliverability tab on any mailbox at that domain shows you exactly which records should be published and what they should say.
The nameserver change has not taken effect. Registry propagation is not instant and is outside our control. Check the Nameservers card shows what you saved, then allow time. If the card is right and the public delegation is still wrong after a day, open a support ticket.
I want DNSSEC on a domain using external nameservers. DNSSEC in KPanel signs zones we serve. If your DNS is elsewhere, enable it there. See Enabling DNSSEC.
Related reading: Nameservers, DNS Basics, Subdomains and Parked Domains, and Enabling DNSSEC.