Open sourceIn the free reqad package (GPL-3.0).

DNS

Reqad creates the DNS zones and records your sites and mail need, at the DNS provider you choose: PowerDNS on your own server (or on another Reqad server), Cloudflare or a cPanel/WHM server. With PowerDNS you get a full zone editor, a DNS cluster with secondary name servers, and you can keep the DNS of your other Reqad servers in one place.

Choose a provider

Go to Settings → DNS Settings, tab Provider, and pick one:

For PowerDNS the page shows a Connection line: the PowerDNS version and how many zones it holds, or why it does not answer (Test again checks once more). When the server address has a port of its own, such as :2087, saving the settings opens that outgoing port in the csf firewall, so the connection is not blocked.

When you create an account with Add DNS ticked, Reqad makes its zone with the records for the site and its mail. Addon domains, subdomains and aliases get their records too.

DNS Zones

DNS Zones (the button on the DNS Settings page, or /dns/) lists every zone at the provider, with the account it belongs to, the number of records, a check of the zone, its serial and its PowerDNS kind. Type in the filter to find a zone or an account, or show only Zones of an account, Zones of no account or With problems.

• Add a zone makes a new zone with starting records pointing at the site's address.
• Import zone makes a new zone from a zone file, pasted or chosen (a BIND-style example.com.db works as it is). A preview lists every record, so you choose what comes in; names without a final dot are relative to the zone, as in BIND.
• Remove asks you to type the zone's name, and warns when it belongs to a hosting account.

Editing a zone

Open a zone to edit its records: search, filter by type, add, change and remove records, or Select several and delete them together. While you type, Reqad points out the usual mistakes: a missing final dot, an IP address in a CNAME or MX, a record of the wrong type, an SPF, DKIM or DMARC record in the wrong place. Add a record has ready-made SPF, DKIM and DMARC records to fill in.

The zone check lists errors and warnings (missing mail records, name servers that are not the ones in DNS Settings, more than 10 SPF lookups...) and most come with a Fix button. For a zone of a hosting account, the account's mail provider, SPF and DMARC helpers are on the same page.

With PowerDNS the admin can also change NS and PTR records and names under the server's own host name. A zone's last NS record cannot be removed. The SOA card shows the zone's SOA: Raise serial makes the secondaries fetch the zone again, and Edit changes the primary server, the contact address and the timers (the serial only goes up). Export downloads the zone as a zone file.

Hosting accounts edit the zones of their own domains in the account panel, see Domains & SSL. They never change NS or SOA records, or names that belong to the server or to another account.

DNS cluster

A DNS cluster gives your zones a second name server: the PowerDNS on your Reqad server is the primary, and one or more small machines running plain PowerDNS are secondaries that copy every zone. Nothing of Reqad runs on a secondary; it uses PowerDNS's own replication (NOTIFY and zone transfers) and a catalog zone, so new and removed zones reach the secondaries by themselves, usually within seconds.

Add a secondary

1. Make a small Linux machine (Rocky, Alma or RHEL 8 to 10, Debian or Ubuntu; 1 GB of memory is enough) with its own public address, and give it a name such as ns2.example.com.
2. On the Cluster tab, press Add a secondary and enter its name and address. This server's PowerDNS is set to notify it and to allow it zone transfers.
3. The page then shows one command. Run it as root on the secondary: it installs PowerDNS (4.7 or newer), sets this server as its only primary, gives zone transfers to nobody, adds a swap file on machines with little memory, and opens port 53 in firewalld. With csf, open TCP and UDP port 53 there yourself.
4. Use the cluster's name servers as This server's name servers on the Provider tab, and at your registrar.

Every zone becomes a primary zone (kind Master) and a member of the cluster's catalog. Remove on a secondary stops sending zones there.

Cluster health

Every 5 minutes, and when you press Check now, Reqad checks the cluster and keeps the results for 7 days:

• each zone's serial on each secondary, so a secondary that falls behind is seen;
• answers over UDP and TCP, and how long they take;
• a test change: a hidden test zone gets a new record and each secondary is asked until it has it, which measures how long a change takes to arrive;
• that the secondaries refuse zone transfers and recursive queries from others;
• once an hour, which name servers each domain uses at its registry.

The Cluster tab shows a green or red dot in its title, a tile per secondary with a bar of the last 24 hours, where your domains point and a list of events. A secondary that stops answering or falls behind appears in Needs attention.

Keep other servers' DNS here (DNS API keys)

Your other Reqad servers can keep their zones on this server's PowerDNS, and so in its DNS cluster. They talk to a PowerDNS-compatible API at https://<this server>:2087/pdns, each with its own key, and each sees and changes only its own zones.

1. On this server, Settings → DNS Settings → API keys: switch the DNS API on.
2. Press New key: a name (the server that uses it), Allowed from (that server's addresses, recommended), the permissions, an optional Zone limit (the most zones the key may hold; empty = no limit), when it expires, and optionally Zones already here for it. The key is shown once: copy it.
3. On the other Reqad server, Settings → DNS Settings → Provider → PowerDNS: Server address https://<this server>:2087/pdns, API Key the key, and the same name servers as this server. Saving opens the outgoing port 2087 in its firewall.

From then on that server's new zones and records are made here, and its DNS Zones page shows only its own zones.

Moving the zones a server already has

On the other server, before you switch its provider, list the zones its sites need and save them as zone files:

reqad dns zones --export=/root/zones

It shows every zone of its main, addon and alias domains, says whether each is at its DNS provider now, and writes /root/zones/<zone>.db for each one. Import the files on this server (DNS Zones → Import zone). Then get the names alone with reqad dns zones --plain and paste them into Zones already here when you make the key, or later with Zones on the key.

What a key can and cannot do

• Read its zones, make zones, change their records, and remove them (each a permission of its own).
• Never: this server's own name, the domains of hosting accounts on this server, or another key's zones. In the other direction, a domain whose zone a key holds cannot become a hosting account or site here until you take the zone away from the key.
• Never the SOA, the zone's NS records (its zones always name this server's name servers), zone settings or DNSSEC.
• A wrong key counts as a failed login and leads to the same bans as the panel. Every call is listed under Latest calls for 30 days.

Revoking a key keeps its zones, so you can give them to a new key.

Command line

Hidden master (earlier setups)

Servers set up earlier with PowerDNS in Hidden master mode keep it: the local PowerDNS holds the zones, and the Reqad DNS Agent on a cPanel/WHM DNS server applies each change there through whmapi1, so that server's name servers answer for the zones. New setups use a DNS cluster or another Reqad server's DNS instead, and the mode is no longer offered on servers that do not use it.

• Each Reqad server has its own token for the agent, accepted only from that server's address, and the agent changes only the zones that server created through it.
• Check the agent on the cPanel server with systemctl status reqad-agent and journalctl -u reqad-agent -f; restart it after its certificate is renewed.
• The domains' name servers must point at the cPanel server's pair: in this mode the Reqad server itself is never asked by resolvers.

Need a hand? Create a free account or contact us.