1. Netcup Anycast DNS Architecture & CCP Access
Netcup provisions three Anycast authoritative nameservers with each domain: root-dns.netcup.net, second-dns.netcup.net, and third-dns.netcup.net across Frankfurt, Nuremberg, and Vienna.
2. Web Records: A, AAAA, CNAME & CAA Record Setup
Deploy dual-stack IPv4/IPv6 routing alongside CAA records to prevent unauthorized Certificate Authorities from signing rogue SSL certificates:
| Host | Type | Destination | Purpose & Rule |
|---|---|---|---|
| @ | A | 202.61.xxx.xxx | Apex IPv4 address pointing to server IP |
| @ | AAAA | 2a03:4000:xx:xx::1 | Apex IPv6 address for dual-stack accessibility |
| www | CNAME | yourdomain.com. | www alias pointing to apex (trailing dot required) |
| @ | CAA | 0 issue "letsencrypt.org" | Restricts certificate issuance exclusively to Let's Encrypt |
3. Enterprise Email Deliverability: MX, SPF, DKIM & DMARC
Google Gmail and Yahoo mandate SPF, DKIM, and DMARC enforcement. Failing to publish these records guarantees delivery rejection or spam tagging:
# 1. MX Record (Inbound mail routing)
Host: @ | Type: MX | Priority: 10 | Value: mxs.netcup.net.
# 2. SPF Policy (Sender authorization rule)
Host: @ | Type: TXT | Value: "v=spf1 mx a include:_spf.netcup.net ~all"
# 3. DKIM Public Key (Cryptographic signature verification)
Host: default._domainkey | Type: TXT | Value: "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg..."
# 4. DMARC Enforcement (Quarantine & Aggregate telemetry)
Host: _dmarc | Type: TXT | Value: "v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]"
4. Reverse DNS (rDNS / PTR) Setup in Netcup SCP
⚠️ Important: rDNS is NOT configured in CCP!
Reverse DNS (PTR) binds your public IP to your sending domain. Netcup nodes default to generic hostnames like v2202401xxxx.yourvserver.net, causing instant mail rejection. You must configure PTR in the Server Control Panel (SCP).
- Log in to servercontrolpanel.de
- Select your VPS server instance
- Click the "Network" tab
- Click edit beside the IPv4/IPv6 address, set rDNS to your FQDN (e.g., mail.yourdomain.com), and save
5. Zero-Downtime Nameserver Migration to Cloudflare
Migrating DNS authority to Cloudflare brings global Anycast caching and origin IP shielding. Follow this zero-downtime workflow:
- Step 1: Zone Import — Add your domain to Cloudflare and carefully verify auto-scanned records against Netcup CCP.
- Step 2: Switch to Custom Nameservers — In CCP -> Domainverwaltung -> Nameserver, switch radio button to "Eigene Nameserver" (Custom Nameservers).
- Step 3: Save Assigned Nameservers — Enter the 2 assigned Cloudflare nameservers and submit. Recursive resolvers transition smoothly without dropping connections.
6. Enabling DNSSEC Cryptographic Signatures & DS Records
DNSSEC signs DNS answers with cryptographic proofs against cache poisoning. Link your upstream DS record in Netcup CCP:
- Enable DNSSEC in Cloudflare DNS settings to obtain the DS parameters
- Open the "DNSSEC" tab in Netcup CCP Domainverwaltung
- Save parameters to allow Netcup to push the DS delegation signer record to the TLD registry
7. DNS CLI Verification & Diagnostics Toolbox (dig/nslookup)
Diagnose propagation delays and configuration mismatches accurately using native Linux DNS utilities:
# 1. Trace full iterative resolution path from root servers
dig +trace yourdomain.com
# 2. Query Netcup authoritative nameserver directly
dig @root-dns.netcup.net yourdomain.com A +short
# 3. Check SPF and DMARC TXT record contents
dig yourdomain.com TXT +short
dig _dmarc.yourdomain.com TXT +short
# 4. Query reverse DNS PTR record
dig -x 202.61.xxx.xxx +short
8. Frequently Asked Questions (FAQ)
Q: How long does DNS propagation take after modifying records in Netcup CCP?
Netcup Anycast nameservers push updates within 60 seconds. Global propagation to public resolvers (1.1.1.1, 8.8.8.8) typically takes between 5 to 15 minutes depending on the record TTL.
Q: Why cannot Reverse DNS (rDNS) be added in CCP domain DNS settings?
Reverse DNS (PTR) maps an IP address to a hostname, which is authoritative to the IP block allocation. Therefore, rDNS must be configured in Netcup SCP (Server Control Panel) under the VPS "Network" tab, rather than in CCP domain records.
Q: Why is a trailing dot (.) required at the end of CNAME target domains?
A trailing dot denotes a Fully Qualified Domain Name (FQDN). Without it, the DNS daemon appends the origin zone apex to the value, resulting in invalid lookups like target.com.yourdomain.com.
Q: Will Netcup hosted mailboxes continue working after delegating nameservers to Cloudflare?
Yes! Simply replicate Netcup MX, SPF, and DKIM records into Cloudflare, and ensure mail-related records (mail.yourdomain.com) have proxy mode set to "DNS Only" (grey cloud), as Cloudflare free tier does not proxy SMTP/IMAP ports.
Markus S.
Senior Cloud Infrastructure Architect & Linux Sysadmin
Markus focuses on European cloud hosting economics, server performance optimization, and KVM virtualization. All benchmarks, setup guides, and VAT exemption procedures are verified on self-funded Netcup instances hosted in the Nuremberg datacenter (AMD EPYC hardware).
📚 Recommended Reading: Essential Netcup Guides & Benchmarks
Hands-on tutorials to help you maximize savings, configure servers, and make informed choices
Netcup 0% VAT Exemption Guide: Automatic Tax Removal for Non-EU Users
Complete walkthrough on qualifying for automatic 0% German VAT, invoice updates, and billing formulas.
Netcup Registration & Order Guide: Identity Verification & Fraud Check Tips
From plan selection to CCP portal activation. Avoid order cancellations and delays.
Netcup vs Hetzner Cloud: Geekbench 6 Scores, Network Routing & Pricing Comparison
In-depth analysis of dedicated vCPU consistency, traffic quotas, and datacenter connectivity.
Netcup Custom ISO Tutorial: Install Windows & Linux via SCP Panel
Mount external ISOs with VirtIO drivers via Server Control Panel (SCP) and VNC access.
💰 Netcup Verified Coupons & Discounts
We maintain an updated collection of verified netcup discount codes, with real-time automatic synchronization. Get up to 30% off or free months on your next order.
Browse All Coupons →