CNX Documentation

Using your own nameserver names

By default, zones hosted by CNX use the shared nameserver names:

ns01.cnx.net.kh.
ns02.cnx.net.kh.

You can instead use nameservers under your own domain, for example:

ns01.example.com.
ns02.example.com.

These are in-bailiwick nameservers because the nameservers are inside the zone they serve.

They still point to CNX's authoritative anycast infrastructure. Only the names presented in your delegation change.

An in-bailiwick setup requires the nameserver addresses to exist in two places:

  1. as normal A and AAAA records inside your CNX-hosted zone; and
  2. as glue records in the parent zone through your registrar or registry.

See In-bailiwick nameservers for why the glue records are required.

1. Add the nameservers to your zone

Add address records for the nameserver names, pointing to CNX's anycast addresses:

ns01  IN A     103.237.52.10
ns01  IN AAAA  2001:df6:1440::10

ns02  IN A     103.237.52.11
ns02  IN AAAA  2001:df6:1440::11

For example.com., these create:

ns01.example.com.    A       103.237.52.10
ns01.example.com.    AAAA    2001:df6:1440::10

ns02.example.com.    A       103.237.52.11
ns02.example.com.    AAAA    2001:df6:1440::11

2. Register the glue records

At your registrar, register the same names and addresses as host records, child nameservers, or glue records:

ns01.example.com.    103.237.52.10
                     2001:df6:1440::10

ns02.example.com.    103.237.52.11
                     2001:df6:1440::11

This step happens outside CNX because the glue is published by the parent zone, not by example.com. itself.

The addresses registered at the parent must match the addresses configured for the nameservers in your CNX zone.

3. Change the delegation

Once the host/glue records exist, change the domain's authoritative nameservers at your registrar to:

ns01.example.com.
ns02.example.com.

The parent zone can now return both the delegation and the addresses required to reach those nameservers.

4. Verify the delegation

After the registrar or registry has published the change, verify the complete delegation path:

dig +trace example.com

The referral from the parent should contain your nameserver names together with their glue addresses.

You can also inspect the delegation directly:

dig NS example.com

and verify the nameserver addresses:

dig A ns01.example.com
dig AAAA ns01.example.com

The addresses should match the CNX anycast addresses configured above.

Registrar and registry limitations

Registrar terminology and capabilities vary. Glue records may appear as host records, registered hosts, or child nameservers.

Some registrars or ccTLD registries may not support IPv6 glue. If only IPv4 glue can be registered, the delegation can still operate using the IPv4 glue, while the AAAA records remain published inside the child zone.

Do not change the glue addresses independently of the corresponding CNX nameserver records. If CNX provides new nameserver addresses in the future, both the zone records and the parent glue must be updated.