How do I create private nameservers for a domain

Two places are involved and both are needed: the registrar, where you declare that the nameserver names exist and which addresses they live at, and the control panel, where the server is told to answer for them. Doing one without the other is the usual reason a new pair does not resolve.

The sequence

1. Pick two addresses from your allocation. Two different ones. Putting both nameservers on a single address defeats part of the point.
2. Register the host records at the registrar. This is the step people miss. Most registrars call it registering a host, a child nameserver or a glue record. You are declaring that ns1.yourdomain and ns2.yourdomain exist and giving the address for each.
3. Create the nameservers in the control panel so the server answers authoritatively for those names.
4. Set the domain's delegation at the registrar to your new pair, replacing whatever it used before.
5. Wait, then verify. Query the domain from outside and confirm the answer comes from your pair.

Why the glue record is the step that breaks

There is a circularity in step two that explains why it exists. To reach ns1.yourdomain, a resolver must first find out where it is, and that information is held by yourdomain itself, which it cannot reach without the nameserver. The glue record breaks the loop by publishing the address at the registry level, outside the zone.

Skip it and the symptom is distinctive: everything looks correct in the control panel, and the domain does not resolve for anyone. The guidance for operating nameservers, including why more than one is expected, is set out in the RFC on secondary nameserver selection.

Doing it across an estate

Every domain on the account can have its own pair at no extra cost, so on a large estate this is repetition rather than expense. Two habits keep it manageable:

• Vary the addresses. If every private pair points at the same two addresses, the estate shares a DNS answer again in a slightly disguised form.
• Record which pair uses which addresses. Reconstructing that later from a registrar interface, forty domains in, is unpleasant work.

Verifying rather than assuming

Check from outside your own network, because a local resolver may hold a cached answer that flatters you. Confirm that the pair answering is yours, that both members respond rather than only the first, and that the addresses are the ones you intended. Certificates are issued automatically once the domain resolves, so a delegation still half-finished is also a certificate that has not been issued.

Why shared pairs undermine the rest of the work is covered in Nameservers and DNS, and address selection in IP Diversity.