Guide: How to setup NSD as a secondary nameserver for Mail-in-a-Box

If you for whatever reason don’t want to use a secondary name server provider, but still want to have a secondary name server for your Mail-in-a-Box instance, it’s relatively easy to set up NSD as a secondary nameserver yourself on a second VPS. I installed it on a Debian 11 VPS but this should work exactly the same on Ubuntu.

1. Preparations

1.1 Spin up a VPS:

Spin up a VPS with Debian 11 or Ubuntu 20.04. The cheapest plan with 1 core and 512MB of RAM should be more than enough. But make sure they offer you a “real” virtual machine e.g. KVM and not something like an OpenVZ container…

1.2 Create an A Record:

Go to the “Custom DNS” section of the Mail-in-a-Box admin interface and create an A record for your secondary nameserver and point it to the IP address of the VPS.

Important! You cannot use ns2.box.yourdomain.tld. Other than that you can use whatever subdomain you want. In this example we keep it simple and use ns3.box.yourdomain.tld .

ns3.box.yourdomain.tld    IN    A    22.22.22.22  # IP address of the second VPS

1.3 Change the Glue records and nameserver settings at your registrar:

Login to the DNS-Settings-Panel of your registrar and change the second glue record for the domain name you’re hosting your Mail-in-a-Box instance on:

ns1.box.yourdomain.tld 11.11.11.11  # IP address of your MiaB (stays as is)
ns3.box.yourdomain.tld 22.22.22.22  # name and IP address of the 2ndry server / new VPS`

Then change the secondary nameserver entries for all the domain names you’re hosting on your Mail-in-a-Box instance:

Nameserver 1: ns1.box.yourdomain.tld  # name of your MiaB instance (stays as is)
Nameserver 2: ns3.box.yourdomain.tld  # name of the 2ndry server / new VPS

1.4 Prepare your VPS

Log into your newly created VPS via SSH and change to a root shell:

sudo -i

Upgrade all packages:

apt update && apt dist-upgrade -y

Set the correct timezone:

timedatectl set-timezone "Europe/Zurich"

Install nsd and additional tools

apt install -y nsd dnsutils lnav

Create the directory for the zone files (Probably not needed but I wanted it to be identical to MiaB)

mkdir /etc/nsd/zones

2. Setup NSD

Edit the file /etc/nsd/nsd.conf as in the example below:

server:
        ip-address: 22.22.22.22 #IP address of the 2ndry server (this server)
        hide-version: yes
        verbosity: 2
        server-count: 1
        zonesdir: "/etc/nsd/zones" # probably not needed but I wanted it to be identical to MiaB

zone:
        name: yourdomain.tld
        zonefile: yourdomain.tld.zone
        allow-notify: 11.11.11.11 NOKEY # IP address of your MiaB server 
        request-xfr: 11.11.11.11 NOKEY  # IP address of your MiaB server

# If you are hosting more than one domain on your MiaB instance add them like this...

zone:
        name: yourotherdomain.tld
        zonefile: yourotherdomain.tld.zone
        allow-notify: 11.11.11.11 NOKEY # IP address of your MiaB server 
        request-xfr: 11.11.11.11 NOKEY  # IP address of your MiaB server

After you’re done you can use nsd-control to reconfigure NSD…

nsd-control reconfig

or simply restart the service:

systemctl restart nsd

3. Using the secondary nameserver with Mail-in-a-Box

Enter the name e.g. ns3.box.yourdomain.tld of your newly created secondary
nameserver to the “Using a secondary nameserver” field in the “Custom DNS” section of the Mail-in-a-Box admin interface. The zone information should get automatically transfred to your secondary server.

4. Check if your setup is working

Check the syslog…

lnav /var/log/syslog

If the zone transfer was successful, you should see a line similiar to that in the syslog:

Apr 19 13:56:06 ns3 nsd[21052]: [2022-04-19 13:56:06.755] nsd[21052]: info: notify for yourdomian.tld from 11.11.11.11

Of course you can also check with the dig command from another server or from your PC…

dig NS yourdomain.tld @ns3.box.yourdomain.tld

…or you could use one of the many online tools like DNS Check and DNS Report Tools - Comprehensive DNS Tests - MxToolBox or https://dnschecker.org etc…

Hope this helps somebody
Cheers :slight_smile:

3 Likes

I don’t use MiaB’s DNS and choose to use external DNS. However if I was using MiaB’s DNS I would definitely set this up.

Thanks for the guide.

1 Like

Thanks for sharing your set up. Useful information.