Choose and configure the nameserver service in WHM (PowerDNS or BIND)

cPanel can answer DNS queries for your hosted domains itself, using PowerDNS or BIND, or it can leave DNS to someone else. The choice is made in one WHM screen, but it affects every domain on the server. This guide explains the options, when each one fits and how to switch without taking sites offline.

Before you start

• Root access to WHM on a cPanel server running on a Linux VPS.
• Know how your domains get DNS today: from your own nameservers on this server, or from an external DNS provider.
• A recent backup of your zone files. They live in /var/named/ on cPanel servers.

tar czf /root/zones-$(date +%F).tar.gz /var/named/*.db

The options

Go to Home » Service Configuration » Nameserver Selection. You will see:

• PowerDNS. The default on current cPanel versions. It reads the same zone files cPanel manages and is light on memory. cPanel notes it does not work as a recursive nameserver, which is fine, because an authoritative server should not be a public resolver anyway.
• BIND. The traditional choice. It is not available on Ubuntu servers, where PowerDNS is the only supported option.
• Disabled. No DNS service runs on the server. cPanel still keeps zone files, so you can copy records to an external provider or to a DNS cluster.

cPanel recommends not running a nameserver at all unless you plan to use it.

When to use external DNS instead

Running DNS on a single VPS means DNS goes down whenever the server does. Choose Disabled and host DNS elsewhere if:

• your domains already use a DNS provider such as a registrar's DNS or a CDN;
• you want DNS to keep answering during server maintenance;
• you only host a few domains and do not need branded nameservers.

In that case, you add the records (A, MX, TXT and so on) at the external provider and keep cPanel's zone files as a reference.

Keep a local DNS service if:

• you offer hosting to customers who point their domains at your ns1 and ns2;
• you want AutoSSL and new accounts to work without editing DNS somewhere else.

Switch the nameserver service safely

1. Back up the zones as shown above.
2. In Nameserver Selection, choose the new option and click Save.
3. WHM installs or enables the selected service and stops the old one. Wait for the confirmation output to finish.
4. Check the service is running:

systemctl status pdns --no-pager

On a BIND server, the service is named:

systemctl status named --no-pager

If you chose Disabled, confirm that nothing listens on port 53:

ss -lntup | grep ':53 '

Check zones still resolve

Pick two or three hosted domains and query the server directly:

dig @203.0.113.10 example.com A +short
dig @203.0.113.10 example.com MX +short
dig @203.0.113.10 example.com SOA +short

Each should return the records you expect. Then check from outside:

dig example.com A +short

If you disabled local DNS, the public answer must now come from your external provider. Check with dig example.com NS +short.

Troubleshooting

• PowerDNS fails to start: another program, often a local resolver such as systemd-resolved on some systems, holds port 53 on all addresses. Check with ss -lntup | grep:53 and stop the conflict.
• Some zones return SERVFAIL after switching: a zone file has a syntax error the old server tolerated. Look at the service log with journalctl -u pdns and fix the zone in Home » DNS Functions » Zone Editor.
• Domains stop resolving after choosing Disabled: their NS records still point at this server. Move them to the external provider at the registrar first.
• BIND is greyed out: the server runs Ubuntu. Use PowerDNS.

Next steps

• Brand your DNS: set up private nameservers with cPanel & WHM.
• Add redundancy: set up a WHM DNS cluster.
• Learn the record types: DNS records explained.