A BIND zone becomes publicly useful when the domain delegation leads to nameservers that actually serve it. Creating a zone in Virtualmin is one part of that chain, not a change to the domain registrar by itself.
IN THIS ARTICLE
What you need before you begin
Use authorized DNS and registrar access. Inventory the complete current zone, including mail, verification and application records. Choose a reliable primary and secondary DNS design, and check whether the parent domain uses DNSSEC before a nameserver change.
01 Make a Virtualmin BIND zone authoritative
- Enable and configure the domain DNS feature in Virtualmin only if this server participates in its authoritative DNS service. Inspect the generated zone and replace example or incorrect addresses.
- Create the intended nameserver host records and register necessary glue with the registrar when the nameserver names are inside the delegated domain. The glue and actual nameserver address records must agree.
- Configure a real secondary DNS service if the design uses one. Two names pointing to one machine do not provide independent failure protection.
- Permit authoritative DNS queries over both UDP and TCP port 53 at the intended interfaces and network firewalls. Do not expose unrestricted recursive resolution to the internet.
- Query each proposed nameserver directly for the domain SOA and key records before changing delegation. Confirm consistent answers and the expected authority.
- Change the registrar nameservers only after the new zone is complete. Handle any parent DS record through a coordinated DNSSEC transition rather than leaving a stale trust chain.
Can I keep DNS with an external provider?
Yes. Publish records there and keep the Virtualmin DNS design consistent with that choice. Public delegation determines which provider answers, even if a separate local zone also exists.
Confirm the expected result
Inspect the public delegation and query each authoritative server from an external network. Test website and mail resolution, not only the apex A record. Keep the old DNS service available for the required cached-delegation overlap.
Troubleshoot unexpected results
If the zone resolves locally but not publicly, check registrar delegation, glue, firewall and the BIND listener. If validating resolvers return SERVFAIL after a move, investigate DNSSEC and stale DS records. Restore the prior working delegation when appropriate, accounting for cache lifetimes.