DNS management

#How zones are created

When a main, addon or alias domain is added to an account, the panel creates a zone for it; subdomains do not get their own zone but are added as records to the parent domain's zone. Removing a domain removes its zone (or the subdomain's records), and suspending an account takes its zones offline.

A new zone's records come from a template. If no template is defined, the built-in records are used:

The default nameservers are derived from the registered domain of the server hostname (for panel.example.com: ns1.example.com and ns2.example.com). Under Server Admin → DNS Zones you can set up to six custom nameservers and the default TTL (60–604800 s, default 14400), and apply a nameserver change to the root NS records of every zone with one button. In the Pro edition, resellers define their own nameservers on My Nameservers, and their customers' zones are created with those names.

#Zone Editor

In the user panel, Domains → Zone Editor lists the account's own zones. Supported record types: A, AAAA, CNAME, MX, TXT, SRV, CAA and NS.

• Every record is validated before it is saved; an SRV value is entered as "weight port target", a CAA value as 0 issue "letsencrypt.org".
• A CNAME cannot share its name with any other record, and the root must keep at least one NS record.
• Each change bumps the serial, validates the zone file and reloads the zone on the nameserver.
• A zone can be exported in standard zone file format or reset to the template's default records.

Admins and resellers use the same editor from Server Admin → DNS Zones; a reseller only sees the zones of accounts in their own tree. Creating and deleting zones by hand is limited to the server administrator.

#Zone templates and maintenance

Server Admin → Zone Templates holds a separate template for main, addon, alias and subdomains. The server template applies to the admin's accounts, a reseller template to that reseller's accounts. Templates use placeholders: %domain%, %zone%, %sub%, %ip%, %ipv6%, %ns1%–%ns6%, %hostname%, %mail% and %user%. At least one NS record for the root is required. From the Zone Editor a template can be applied to an existing zone, either merged in or replacing its records.

DNS Maintenance (in both panels) scans zones and suggests safe fixes: addresses that do not belong to the server or sit on a private network, CNAME targets that do not resolve, duplicate records, CNAME conflicts, MX targets without an address, multiple or malformed SPF records, zones of domains that are no longer in the panel, and temporary TXT records left over from finished certificate validations. The same page changes the TTL of selected zones in bulk; if a zone fails validation its change is rolled back and the other zones are unaffected.

#Nameserver: BIND or PowerDNS

A server installation installs BIND by default and opens ports 53/tcp and 53/udp in the firewall; the --without-dns option skips the DNS server (see Installation). PowerDNS is an optional component, installed from Server Admin → Components. Both read the same zone files the panel writes, so switching needs no data migration.

Server Admin → DNS Server shows the active software, listening addresses, zone counts and the last reload. From there you can reload all zones, check that every zone answers from the local server as authoritative with the current serial, and query the local server or a resolver with the built-in lookup tool.

#Switching between BIND and PowerDNS

A switch runs as a job, and you can run just the pre-check first:

1. Pre-check: is the target installed, does every zone file parse, is the target ready for DNSSEC zones.
2. Switch: the configuration is regenerated for the target, DNSSEC keys are carried over, the old server is stopped and the new one started.
3. Verification: every zone's SOA must come back authoritative with the current serial from the local server, and the new server must be listening on port 53.
4. If any step fails, the panel automatically returns to the previous server.

PowerDNS cannot be removed while it is the active nameserver.

#External DNS providers

In the user panel, Domains → DNS Providers chooses where each domain's DNS is hosted: on the bipanel nameservers or at an external provider. Records are still edited in the panel; every change is pushed to the provider, manual edits made at the provider show up as differences, and you can import them or overwrite them.

Credentials are verified with a connection test before they are saved. Server Admin → DNS Providers adds server-wide accounts, lets you share them with accounts and sets the default hosting for new domains. Every 30 minutes the panel retries failed pushes, and by default it checks for differences every 6 hours. Pro providers need a license for new connections; existing connections keep working if the license lapses. For domains hosted at an external provider, DNS-validated certificates (wildcards, for example) write their TXT record straight to the provider (see SSL certificates).

#Dynamic DNS

Domains → Dynamic DNS keeps a name in one of your zones pointed at a device with a changing IP address (a home connection, NAS or camera). Each entry updates A, AAAA or both; its token is shown only once, when it is created, and can be regenerated.

If the address has not changed, the record is left alone. Two changes of the same type are at least one minute apart, the TTL is 60, 120, 300 or 600 s, and an account can have up to 50 entries. Repeated wrong tokens and request floods temporarily block the client address.

#DNS cluster (Pro)

In the Pro edition, when several bipanel servers are joined into a cluster, each server's zones are served authoritatively on every member with the DNS role. By default the records are pushed over the API; if the receiving server runs BIND with the cluster DNS component, zones can also be transferred as secondaries over TSIG-protected AXFR/NOTIFY. A zone copy received from another server is read-only and is edited on its source server; if two servers claim the same zone, the receiver leaves it unchanged and reports a conflict. Details: Cluster and cloud.

#DNSSEC (Pro)

In the Pro edition, the DNSSEC page in the user panel turns signing on or off per zone. With BIND (9.16 or later) the server generates the key and signs the zone inline (ECDSAP256SHA256); with PowerDNS answers are signed as they are served. The page shows the DS records to enter at your domain registrar and whether the DS record in the parent zone matches. DNSSEC cannot be turned off while a DS record is still published in the parent zone; remove it at the registrar first. Admins see the signing status of every zone under Server Admin → DNSSEC.

#Container and Railway installations

The local DNS server only runs on a server (native) installation. On Docker or Railway, zones and records are kept in the panel but not served; sync your domains' DNS with Cloudflare or manage it at your domain registrar. The DNS Server page, switching, the zone check, DNSSEC and cluster DNS are not available there. See Docker and Railway.