A DNS server answers questions like "what is the IP address of example.com?". BIND and PowerDNS are the two DNS server programs you are most likely to meet on hosting servers. This guide explains the types of DNS server, compares BIND vs PowerDNS, and shows how to test any nameserver.
Before you start
It helps to understand records and nameservers first; see DNS record types explained. On MdmHost hosting, DNS for your domains is managed in cPanel's Zone Editor – you do not need to run your own DNS server.
Authoritative vs recursive DNS servers
- Authoritative server – holds the official zone for a domain and answers for it. Your domain's nameservers (for example ns1 and ns2) are authoritative servers.
- Recursive resolver – used by clients; it asks root, TLD and authoritative servers on the client's behalf and caches results. Your ISP, 1.1.1.1 and 8.8.8.8 are resolvers.
Never run an open recursive resolver on a public server: attackers abuse them for DNS amplification attacks.
BIND
BIND (named) from ISC is the oldest and most widely deployed DNS server. It can act as authoritative server, resolver, or both. Zones live in plain-text zone files and the main config is named.conf. It supports DNSSEC, zone transfers (AXFR/IXFR), views and dynamic updates.
PowerDNS
PowerDNS separates roles into two products: the Authoritative Server and the Recursor. The authoritative server reads zones from backends such as a database (MySQL, PostgreSQL), LMDB or BIND-style zone files, and offers an HTTP API. That makes it popular with providers that manage many zones automatically.
BIND vs PowerDNS compared
| BIND | PowerDNS | |
|---|---|---|
| Roles | Authoritative and recursive in one daemon | Separate authoritative server and recursor |
| Zone storage | Zone files | Database, LMDB or zone-file backends |
| Changes | Edit file, increase serial, reload | Database row or API call |
| API | rndc control channel | Built-in REST API |
| DNSSEC | Yes | Yes, with simple automatic signing |
| cPanel | Supported | Default on current versions |
On cPanel servers you choose the nameserver in WHM → Service Configuration → Nameserver Selection; PowerDNS is the default on recent versions and supports DNSSEC there.
Test a DNS server with dig
- Ask a specific server for a record, bypassing caches:
dig @ns1.example.com example.com A +norecurseThe
aaflag in the answer means the reply is authoritative. - Check which nameservers the parent zone lists:
dig example.com NS +short - Compare the SOA serial on each nameserver; they should match:
dig @ns2.example.com example.com SOA +short - Confirm the server is not an open resolver (should be refused):
dig @your-server-ip google.com
Troubleshooting
- SERVFAIL: zone syntax errors or broken DNSSEC. For BIND check with
named-checkzone example.com /path/to/zonefile. - Old records still returned: secondary servers did not update because the serial was not increased, or resolvers still cache the old TTL.
- REFUSED: the server is not authoritative for the zone you asked about.
FAQ: BIND vs PowerDNS
Which is faster, BIND or PowerDNS?
Both handle large query volumes. PowerDNS often scales management better for many zones thanks to database backends and its API.
Do I need two DNS servers?
Yes. Registries expect at least two nameservers, ideally on different networks, so your domain resolves if one fails.
Can I switch cPanel from BIND to PowerDNS?
Yes, through Nameserver Selection in WHM. Existing zones are kept.