Installing and configuring the DNS server is a server-wide operation and requires administrator access to the panel. If your account does not have it, open a ticket and tell us what you need.
The panel works with two DNS server implementations, and acts as the primary (master) server for your zones.
- BIND — the reference implementation, keeping zone information in files. A sensible default choice.
- PowerDNS — keeps zone information in a database and is faster. Worth choosing if you expect to serve a large number of zones and addresses.
Installing the DNS server
- Go to Settings → Software configuration.
- Select Name server (DNS) and open its context menu, then Edit.
- Choose the DNS server you want.
- Click Save. Installation runs in the background.
Configuring the defaults
These settings are applied to every new zone, so it is worth getting them right before you add domains. Go to Domain names (DNS) and click Default Settings.
- Name servers — the servers that will be listed in the NS records of new zones.
- Administrator email — used in the SOA record of new zones.
- Mail servers — go into the MX records. A full external name must end with a dot (mail1.example.com.); a name inside the same zone does not need one.
- Subdomains — subdomains created automatically with each new domain, as A records.
- IP addresses for name servers — used to create the A and AAAA records for the NS servers. If you leave this empty and secondary servers are not configured, zone creation fails with an error.
- SPF record and DMARC record — templates from which the corresponding TXT records are generated. Both are worth setting up: without them, mail from your domains is far more likely to be treated as spam.
- Server name for SOA records — leave blank unless you specifically need the SOA to name a different host.
- Apply to existing — tick this to apply the changes to zones that already exist. Without it, the settings affect only zones created from now on.
Apply to existing rewrites the NS records, administrator email, SPF and DMARC of every existing zone. If any of your domains has hand-made records, check them afterwards — this option does not ask twice.
DNSSEC
Tick DNSSEC support to enable it. Two further sections then appear, for the key signing key (KSK) and the zone signing key (ZSK), where you set the algorithm, the key length and how often keys are renewed. The current implementation requires the same algorithm for both key types.
DNSSEC only takes effect once the corresponding DS record has been published at the registrar of each domain. Enabling it in the panel alone changes nothing outside the server — and a DS record that does not match the key in use makes the domain unresolvable for validating resolvers, so make the change deliberately rather than by trial and error.
After the server is running
Creating zones and editing individual records is a separate matter — the records themselves are managed per domain under Domain names (DNS).
Remember that any of this only matters if the domains are actually delegated to these name servers at their registrars. Until the registrar's name server entries point here, the zones on this server are not used by anyone.
If something does not resolve as expected, open a ticket from your client area with the domain name — DNS problems are much easier to diagnose from the outside than from the panel.
