Configuring authoritative Domain Name System (DNS) records and glue nameservers ensures your websites, API gateways, and transactional mail servers resolve with sub-millisecond reliability across global recursive resolvers. This guide covers both the 5-step visual walkthrough inside the WinWinHost control panel and the production BIND9 zone architecture (SOA serials, A/CNAME/MX/CAA records, and SPF/DKIM/DMARC/PTR mail deliverability alignment).
Part 1: Visual Control Panel DNS & Nameserver Setup
Whether you are managing a single business domain on Unlimited Web Hosting or white-labeling custom glue nameservers (ns1.yourdomain.com and ns2.yourdomain.com) on a WinWinHost Reseller Account, follow these five steps to configure your global DNS settings:
1. Access Global Account Settings
From the primary control panel navigation menu, click on Account Settings and select Global Settings:
2. Define Primary & Secondary Nameserver Hostnames
Enter the primary and secondary authoritative nameserver hostnames (for example, ns1.winwinhost.com and ns2.winwinhost.com) for your hosting cluster, along with your custom control panel header and footer branding:
Confirm that Online Help is enabled, verify your default SOA contact address, and click Save:
3. Open Global DNS Settings
Return to the Account Settings menu and select Global DNS Settings to manage default zone records applied to newly provisioned domains:
4. Add a New DNS Zone Template Record
Click the Add New button to define default A, CNAME, MX, and TXT resource records:
5. Assign Authoritative Nameserver IPv4 Addresses & Save
Enter the authoritative IPv4 addresses for your nameservers (NS1 and NS2) and click Save to increment the zone serial and broadcast your records across the DNS cluster:
Part 2: Essential DNS Resource Record Reference Table
Every authoritative domain zone relies on standardized IETF resource records to route HTTP/HTTPS web traffic, validate SSL/TLS certificates, and authenticate outbound email:
| Record Type | RFC Standard | Host / Name | Example Value / Target | Recommended TTL | Operational Purpose |
|---|---|---|---|---|---|
SOA |
RFC 1035 | @ |
ns1.winwinhost.com. hostmaster.winwinhost.com. 2026101801 3600 1800 604800 86400 |
86400s (24h) |
Defines primary nameserver, zone serial (YYYYMMDDNN), refresh/retry intervals, and negative cache TTL |
NS |
RFC 1035 | @ |
ns1.winwinhost.com. / ns2.winwinhost.com. |
86400s (24h) |
Delegates authoritative zone resolution to designated nameservers |
A / AAAA |
RFC 1035 / 3596 | @, www, mx |
76.86.208.178 (IPv4) |
3600s (1h) or 300s pre-cutover |
Maps hostname directly to an IPv4 (A) or IPv6 (AAAA) address |
CNAME |
RFC 1035 | mail, cdn |
send.forge.rmta.net. |
3600s (1h) |
Aliases a subdomain to another canonical hostname (never place a CNAME on the zone apex @) |
MX |
RFC 5321 | @ |
10 mx.winwinhost.com. |
3600s (1h) |
Directs inbound SMTP mail to an explicit A/AAAA host (never point an MX record to a CNAME alias) |
CAA |
RFC 8659 | @ |
0 issue "letsencrypt.org" |
3600s (1h) |
Restricts which Certificate Authorities are permitted to issue TLS certificates for the domain |
TXT (SPF/DMARC) |
RFC 7208 / 7489 | @, _dmarc |
"v=spf1 a mx include:mail.winwinhost.com ~all" |
3600s (1h) |
Authorizes outbound SMTP senders (SPF), publishes DKIM RSA keys, and enforces DMARC alignment |
Part 3: Production BIND9 Zone File Template & Email Deliverability Alignment
When managing authoritative zones directly in BIND9 (/var/lib/bind/*.hosts) on a Dedicated KVM Slice, enforce three strict hygiene rules so your domain passes automated DNS linters and enterprise spam filters (Gmail, Outlook, Yahoo):
- Increment the 10-Digit
SOASerial (YYYYMMDDNN) on Every Edit: Secondary nameservers rely on the SOA serial increasing monotonically to triggerIXFR/AXFRzone transfers. - Separate Inbound
MXHosts from Outbound ESPCNAMEAliases: Ifmail.example.comis configured as aCNAMEto an outbound transactional relay (such as Resendsend.forge.rmta.net.), RFC 2181 §10.3 forbids pointing yourMXrecord tomail.example.com. Instead, create a dedicatedArecordmx.example.compointing to your static server IP (e.g.,76.86.208.178), pointIN MX 10 mx.example.com., and align your ISP Reverse DNS (PTR) record for that static IP tomx.example.comso forward-confirmed reverse DNS (FCrDNS) matches your Postfixmyhostnamebanner. - Publish Complete
SPF,DKIM, andDMARCRecords: Combine an apexv=spf1record, a 2048-bit RSA_domainkeypublic key, and a_dmarcpolicy record.
$TTL 3600
@ IN SOA ns1.winwinhost.com. hostmaster.winwinhost.com. (
2026101801 ; Serial (YYYYMMDDNN)
3600 ; Refresh (1 hour)
1800 ; Retry (30 minutes)
604800 ; Expire (1 week)
86400 ) ; Minimum negative cache TTL (24 hours)
; Authoritative Nameservers
@ IN NS ns1.winwinhost.com.
@ IN NS ns2.winwinhost.com.
; Web Ingress & Dedicated Inbound Mail Host (A Records)
@ IN A 76.86.208.178
www IN A 76.86.208.178
mx IN A 76.86.208.178
; Inbound Mail Exchange (Must target an canonical A/AAAA host, never a CNAME)
@ IN MX 10 mx.winwinhost.com.
; Outbound Transactional Relay Return-Path CNAME
mail IN CNAME send.forge.rmta.net.
; Certificate Authority Authorization (RFC 8659)
@ IN CAA 0 issue "letsencrypt.org"
; SPF (RFC 7208) & DMARC (RFC 7489) Policies
@ IN TXT "v=spf1 a mx include:mail.winwinhost.com ~all"
_dmarc IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@winwinhost.com"Part 4: Validating Zones with named-checkzone & dig
Before reloading BIND9 in production, always run named-checkzone and named-checkconf -z to catch missing trailing dots, unquoted TXT strings, or CNAME-and-other-data collisions before they affect live traffic:
# 1. Validate individual zone file syntax and SOA serial
named-checkzone winwinhost.com /var/lib/bind/winwinhost.com.hosts
# Output: zone winwinhost.com/IN: loaded serial 2026101801 / OK
# 2. Validate all zones referenced in named.conf.local and reload BIND9
sudo named-checkconf -z /etc/bind/named.conf.local && sudo rndc reload
# 3. Verify live A, MX, SPF, DMARC, and Reverse PTR resolution
dig +short A winwinhost.com
dig +short MX winwinhost.com
dig +short TXT winwinhost.com
dig +short TXT _dmarc.winwinhost.com
dig +short -x 76.86.208.178Frequently Asked Questions (DNS & Nameservers)
How long does DNS propagation take after changing nameservers or A records?
Authoritative zone reloads via rndc reload take effect instantaneously on WinWinHost nameservers. Global recursive resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, ISP caches) refresh records according to the previous record's TTL—typically within 5 to 60 minutes for A/MX records and up to 24 hours for registrar glue NS changes.
Why can't I place a CNAME record on my root domain (@)?
RFC 1034 and RFC 2181 prohibit placing a CNAME record at the zone apex (@) because a CNAME cannot coexist with any other record types on the same node, which would break the mandatory apex SOA and NS records. Always use an A record at the zone apex.
What is the next step after my DNS records resolve?
Once your A and www records resolve to your WinWinHost server IP, follow our How to Install an SSL/TLS Certificate guide to activate HTTPS, and our How to Add a MySQL Database tutorial to provision your application storage. Explore all guides in the WinWinHost Knowledge Base.