All chapters

DNS

A domain's DNS can live at your registrar or DNS provider, as it does today, or on this server. cpleks works either way. When the records stay elsewhere, each site's DNS tab shows what they should say and checks what the internet answers. When this server answers for the domain, you edit the records in the panel and the records for mail and subdomains follow on their own.

Tell the server its public address

Every DNS check compares against the address the world reaches this server on, and on a cloud instance the machine's own interface usually carries a private one. So an administrator sets it once:

  1. Open Settings and find How the internet reaches this server.
  2. Press Set the address, type the public IPv4 address (and IPv6 if the server has one), and press Save.

Until it is set, the DNS tab says This server has not been told the address the world reaches it on instead of guessing.

Keep DNS at your provider

Open a site's DNS tab. Under Is the domain pointed here? the panel shows, record by record, what the name should point to and what the internet answers right now: Delegated to this server, Delegated somewhere else, or Could not be checked. Create the records it lists at whoever runs your DNS, then press Check again.

Run DNS on this server

  1. Install the nameserver. On Modules, under DNS server, install NSD. cpleks configures and starts it. Port 53 is already open in this server's firewall; on a cloud instance it also has to be open in the provider's firewall in front of the machine.
  2. Name the nameservers. On Settings ▸ How the internet reaches this server, press Set the nameservers and give two hostnames, for example ns1.example.com and ns2.example.com. Each needs an A record pointing at this server's public address, wherever that hostname's own domain is held; until they resolve, a registrar refuses the delegation.
  3. Switch the zone on. On the site's DNS tab, turn on serve DNS for example.com. The toast says cplex is serving this domain, and the records appear.
  4. Point the domain here. At your registrar, set the domain's nameservers to the two names the tab shows under Give your registrar these nameservers. A delegation change is the slow step: it can take up to 48 hours to spread.
A site's DNS tab with the zone switched on (SERVING), the two nameservers to give the registrar, and the table of records with their names, types, values and TTLs.
The DNS tab of example.com with the zone on. Further down, the delegation check says Delegated somewhere else: example.com is a reserved name that really is delegated to other nameservers, which is what any domain looks like before its registrar points it here.

Edit records

  1. Press Add a record.
  2. Type the Name: @ is the domain itself, www is www.example.com. Choose the Type (A, AAAA, CNAME, MX, NS or TXT), the Value, and the TTL: how long others may remember the answer, an hour being a good default. An MX record also takes a Priority.
  3. Press Add it. The record is live on this server at once; elsewhere it appears as other resolvers' caches expire.

Edit and Remove sit on each row. The panel refuses what would break the zone and says why; for example the bare domain cannot be a CNAME, because it already carries the records that make it a zone. Use an A record there, or put the CNAME on a name such as www.

The Add a record form filled in: name files, type A, TTL 3600 and the value 192.0.2.30, with an Add it button.
Adding a record, filled in and not yet added.

Records that follow on their own

  • Mail. When you choose where a domain's mail lives on the Email tab, the MX, SPF and DMARC records change to match, without you touching them (Email and webmail).
  • Subdomains. A subdomain created on the Subdomains tab gets its record in the parent domain's zone.
  • Wildcard certificates. Once this server answers a domain's DNS, its sites can ask for a *. certificate (Certificates and HTTPS).
The How the internet reaches this server panel on Settings with the public address and the two nameservers.
The public address and the nameservers, set once for the whole server.

What this server does not do

  • A second nameserver somewhere else. Registrars ask for two names and you give two, but both are this one machine: if it is off, the domain is off. That is already true of the websites on it.
  • Writing to your registrar. The panel never holds your registrar credentials. Changing the delegation is yours to do.
  • Looking up other names for anybody. The nameserver answers only for the domains you switched on, so it cannot be abused to amplify attacks.

A reseller can have customers delegate to nameserver names of their own: Settings ▸ Your nameservers ▸ Use my own names.