I'm running Hestia Control Panel on an Ubuntu 24.04 VPS hosted by Contabo. My domain is registered with Namecheap, where I created glue records for ns1.example.com and ns2.example.com pointing to the VPS IP address. I also configured the domain to use those custom nameservers, with Hestia acting as the authoritative DNS server.
The subdomains, mail records, and other DNS entries appear to work, but the root domain itself does not resolve. Hestia reports that the DNS records are missing when I try to issue an SSL certificate. The Hestia DNS zone contains an apex A record and the expected NS, MX, TXT, CNAME, and SRV records, but querying the domain with nslookup from multiple networks returns no answer.
The zone includes NS records for ns1.example.com and ns2.example.com, an A record for the root domain pointing to 192.0.2.1, and related records such as www, mail, webmail, MX, SPF, DMARC, DKIM, and mail-service SRV records. What could be wrong with the delegation or DNS configuration?
2 Answers
The zone is missing A records for ns1.example.com and ns2.example.com. Those hostnames need matching glue records at the registrar, and matching A records inside the DNS zone served by Hestia. For example, add ns1 and ns2 A records pointing to the VPS IP, then verify that the registrar delegation uses those exact nameservers. This fixed the issue here.
Troubleshoot this from outside the control panel. Run `dig +trace example.com A` to follow the delegation, then query the VPS directly with `dig @192.0.2.1 example.com SOA`. If the VPS responds but public resolvers do not, check the registrar delegation, glue records, UDP and TCP port 53 in the firewall, and any stale DNSSEC DS records. The SSL error is likely just reporting the DNS failure; the apex A record should be enough for the domain to resolve.
That was the missing piece and solved the problem. Thanks!