DNS

Reqad manages DNS through an external provider of your choice: Cloudflare, cPanel or PowerDNS. Pick one in Settings → DNS, then Reqad can create zones and records for you.

Choose a provider

Go to Settings → DNS.
Select Cloudflare, cPanel or PowerDNS.
Enter the provider's API token / server details.

Providers

Provider	Notes
Cloudflare	API token; supports the proxied toggle and wildcard records.
cPanel / WHM	Reseller API token with DNS & nameserver permissions.
PowerDNS	Self-hosted authoritative DNS via the PowerDNS API. Runs either as your public nameserver or as a hidden master that pushes zones to a cPanel DNS server.

Records

When you create an account with Add DNS ticked, Reqad creates the zone and the A/MX/TXT records needed for web and mail. You can manage records from the panel afterwards.

PowerDNS: direct or hidden master

PowerDNS can run in two modes, chosen under Settings → DNS → PowerDNS → Mode:

Mode	How it works
Direct (local authoritative)	The PowerDNS on your Reqad VPS answers public queries. Your registrar's nameservers point at this server.
Hidden master	The local PowerDNS is the source of truth but is never queried by the public. Every change is pushed to a cPanel/WHM DNS server, which serves the zones from its own nameserver pair.

Hidden master with a cPanel DNS server

Hidden master lets you keep an existing cPanel nameserver pair as the public face of your DNS while Reqad manages the records. The Reqad VPS holds the authoritative copy in its local PowerDNS; a small service on the cPanel server — the Reqad DNS Agent — applies each change through whmapi1.

Reqad VPS                          cPanel DNS server
┌──────────────────┐               ┌──────────────────────────┐
│ panel            │  HTTPS :2089  │ reqad-agent (systemd)    │
│   ↓              │ ─────────────▶│   ↓ sudo whmapi1         │
│ local PowerDNS   │  token + IP   │ cPanel zones → ns1 / ns2 │
│ (hidden master)  │               │            (public)      │
└──────────────────┘               └──────────────────────────┘

Zone transfers are not used. cPanel ships with AXFR disabled and its BIND backend cannot write to the cPanel-owned named.conf, and the WHM reseller route does not expose the DNS ACL endpoints in the API — so the agent applies changes through the supported WHM API instead.

How it is secured

Each Reqad VPS gets its own bearer token, and requests must also come from that server's registered IP address.
The agent keeps a per-server domain allowlist: it will only touch zones that this VPS created through it. It never lists, dumps or claims zones belonging to another server or WHM account.
It runs as an unprivileged reqad-agent user, with sudo limited to the specific whmapi1 subcommands it needs.
TLS uses the cPanel server's own certificate; port 2089 is opened in CSF, with a per-IP allow rule for each registered Reqad server.

Set up the agent (cPanel server, as root)

Copy the deployment folder from your Reqad server to the cPanel server:

scp -r /usr/local/reqad/scripts/deploy-cpanel/ root@cpanel.example.com:/root/reqad-agent-setup/

Run the setup script. It creates the reqad-agent user, deploys the agent, writes the sudoers rules, opens port 2089 in CSF and starts the service:
```
chmod +x /root/reqad-agent-setup/setup-agent.sh
/root/reqad-agent-setup/setup-agent.sh
```
Register your Reqad VPS with a fresh token (name, IP, token):
```
TOKEN=$(openssl rand -hex 20)
/home/reqad-agent/add-server.sh myvps 203.0.113.10 $TOKEN
echo $TOKEN
```
Repeat this step for every Reqad server that should sync to this cPanel box.

Point Reqad at it

In the panel, go to Settings → DNS, select PowerDNS, set Mode to Hidden master and fill in:

Field	Value
NS1 / NS2	The public nameservers on the cPanel server, e.g. ns1.example.com and ns2.example.com. These are written into every zone Reqad creates.
Agent URL	https://cpanel.example.com:2089
Agent token	The token generated in step 3 above.

Tick Test PowerDNS API connection when saving to confirm the local API is reachable.

What happens after that

Account created — the zone is created locally and pushed to cPanel, and the domain is added to the agent's allowlist.
Record added, edited or deleted — the local zone is updated, then the full record set is re-applied on the cPanel side, so the two copies cannot drift.
Account deleted — the zone is removed on both sides and dropped from the allowlist.
Sync to local — the button on the DNS page pulls the cPanel copy of your zones back into local PowerDNS. Useful when records were changed in WHM directly, or when rebuilding a Reqad server. It only covers zones already registered to this server.

Checking and maintaining it

systemctl status reqad-agent
journalctl -u reqad-agent -f
tail -f /home/reqad-agent/agent.log

The agent uses the cPanel server's certificate, so restart it after a certificate renewal with systemctl restart reqad-agent. If the certificate path changes, update /home/reqad-agent/agent.conf first.

Point your domains' nameservers at the cPanel pair (NS1 / NS2), not at the Reqad VPS. In hidden-master mode the VPS is never queried by resolvers - if the registrar still points to it, DNS will stop resolving.

Verify your nameservers point to the chosen provider before relying on automatic record creation.

Need a hand? Register for early access or contact us.