DNS ও SSL

Every domain that is added to an account gets a DNS zone on this server, and a certificate when Auto SSL can issue one. This chapter covers both from the Host Manager side.

How the zones work

When an account or an addon domain is created, the panel makes a zone with the usual records: two NS records for your nameservers, an A record for the domain, a www CNAME, A records for mail, ftp, hosting, manager and webmail, an MX record pointing at mail.<domain>, an SPF text record and a _dmarc record. The default TTL is 14400 seconds. A subdomain adds one A record to its parent zone. The records live in the database; the Linux driver writes them as BIND zone files and reloads named, and each change raises the zone's serial number.

Your nameservers are set in the wizard and under Server Configuration → Basic Host Manager Setup (Primary nameserver, Secondary nameserver). The names must have A records at the registrar, pointing at this server. DNS Functions → Add an A Entry for Your Hostname adds the server's own name.

DNS Zone Manager

DNS Functions → DNS Zone Manager lists the zones (a reseller sees the zones of their own accounts). Open one to get four cards.

• Zone Records - every record with its name, TTL, type and data, and a delete button on each row.
• Add a Record - name, TTL, type (A, AAAA, CNAME, MX, TXT, SRV, NS, CAA or PTR) and data. The panel checks the name, refuses a clash, such as a CNAME beside another record of the same name, and bumps the serial.
• Start of Authority (SOA) - Primary name server, Hostmaster, Serial, Refresh, Retry, Expire, Minimum (negative caching) and Default TTL.
• DNSSEC - turn signing on or off for the zone and read the DS record to give the registrar.
• Raw Zone File - the zone as text, to copy.

Customers have the same editor, the Zone Editor, in the hosting panel. See Domains and databases.

The other DNS functions

Auto SSL

SSL/TLS → Manage Auto SSL (root only) keeps every domain secured. It has three cards.

• Settings - Auto SSL Enabled or Disabled, and Provider: Let's Encrypt (free and trusted, the domain must point at this server) or self-signed (for tests).
• Accounts - a tick per account; untick an account to leave it out of Auto SSL.
• Last run - the result line, for example issued 3, skipped 12, failed 0.

The job autossl runs once a day. For each active account it looks at the main, addon and sub domains. It issues a certificate to a domain that has none, replaces one that ends within 30 days, and leaves alone a valid certificate that was installed by hand. Run all starts it now. A domain fails when its DNS does not point at the server yet; fix the A record and run again. The contact is warned some days before a certificate ends (14 by default, set under Notifications in Tweak Settings).

Install your own certificate

• SSL/TLS → Generate an SSL Certificate and Signing Request makes a private key, a CSR to send to a certificate authority, or a self-signed certificate.
• SSL/TLS → Install an SSL Certificate on a Domain takes the certificate, the private key and the CA bundle for a domain. The panel parses the certificate, checks that the key matches it and configures Apache.
• Manage SSL Hosts lists every installed certificate with issuer, domain and days left. SSL Storage Manager keeps the keys, CSRs and certificates saved for each account.
• Purchase and Install an SSL Certificate lists the providers of Market → Market Provider Manager.
• Service Configuration → Manage Service SSL Certificates sets the certificate that the mail, FTP and panel services present.

Customers see the same on Security → SSL/TLS and SSL/TLS Status in the hosting panel. See Security, software and advanced tools.

Cloudflare

If the Cloudflare plugin is on, the Zone Editor can mirror records to Cloudflare and switch the orange cloud per record. See Cloudflare.