PremiumComes with the add-on reqad-hosting-pro. Installing add-ons

IP addresses

Your server has one main IP address, set up by your provider. With extra IPv4 or IPv6 addresses, a hosting account can have an address of its own for all its domains, as on a dedicated server.

Before you add an address

1. Get the address from your provider and have it routed to this server. Reqad cannot request addresses; it uses the ones your provider gives the server.
2. Set its reverse DNS (PTR) in your provider's control panel to a name such as mail2.example.com, and create the matching A (or AAAA) record. Mail sent from the address introduces itself with that name, and mail servers check that both point at each other. See Reverse DNS.

Adding an address

Add address asks for:

Adding or removing an address changes the server's network, so the panel asks for your password again. The address is on the network at once, and nothing else changes until you give it to an account.

Giving an address to an account

In Accounts > Manage, choose the account's IPv4 address (and IPv6 address, when you have extra IPv6 ones), then Save changes. An account can have one of each, and an address belongs to one account. The accounts list shows the address after the account's name, and the IP addresses page shows which account uses each one.

• Sites: every site of the account (its main domain, aliases and addon domains) answers on its address. They keep answering on the shared address too, so nothing breaks while DNS moves over, and Let's Encrypt can still reach them. Sites added to the account later get the address within the hour.
• Outgoing mail: once the address's reverse DNS matches, mail sent from the account's domains goes out from its address and introduces itself (HELO) with the reverse DNS name. Until then it goes out from the main address, and the dashboard says so. Forwarded mail stays on the main address.
• Back to shared: choose Shared. The sites and the mail go back to the main address; the address is free for another account. Deleting the account frees it too.

DNS

When the account's domains are in a zone at the DNS provider of Settings > DNS (Cloudflare, cPanel or PowerDNS), Reqad updates them as soon as you give the account an address, and again when you put it back on the shared address:

• A and AAAA records of each domain, its www. and mail. names and its aliases move to the account's address (behind NAT: its public address). Only records that point at this server change. A name that points somewhere else, or a CNAME such as www pointing at the domain, is left as it is. An IPv6 address gets an AAAA record next to each A record it takes over.
• SPF records of its mail domains get ip4: (or ip6:) for the address. The main address is added too, because forwarded mail, and mail sent before the reverse DNS matches, still goes out from it. A domain without an SPF record does not get one.
• An alias added to the account later, with its DNS record, points to the account's address.
• Back on the shared address: the records return to the main address, the extra AAAA records are removed, and the address leaves SPF.

With Cloudflare, records that go through Cloudflare's proxy stay proxied; Cloudflare then sends visitors to the new address. reqad account ip <account> --dns sets the records again, for example after you moved a zone to the provider.

Without a DNS provider in Reqad, or for a domain whose DNS is somewhere else, change the records yourself in the same way. Until the main domain resolves to the account's address, the dashboard's Needs attention card says so. Nothing breaks in the meantime, since the sites answer on both addresses.

Mail from an address, without moving the sites

A domain can send its mail from an extra address without its account getting that address: its sites and DNS records stay on the shared address. Under Accounts > IP addresses > Outgoing mail, click Add rule, enter the domain (the main domain, an addon domain or an alias of an account) and choose its IPv4 and/or IPv6 address.

• The rule wins over the account's own address for that domain, so one domain of an account can send from a different address than the rest.
• As with an account's address, mail only goes out from the address while its reverse DNS matches, and introduces itself (HELO) with the reverse DNS name. Until then the domain's mail goes out as it would without the rule, and the table shows waiting for reverse DNS.
• Reqad does not change the domain's DNS for a rule: add the address to its SPF record yourself (ip4: or ip6:), keeping the main address in it for forwarded mail.
• Several domains can share an address. An address with rules cannot be removed until its rules are. Removing the domain or deleting its account removes its rule.

How Reqad adds the addresses

Reqad never touches the main address or the files your provider's setup writes (cloud-init, DHCP or a static network file), so a change your provider makes to the main address keeps working. The extra addresses go on a network connection of Reqad's own: a dummy interface, reqad0, in the NetworkManager connection reqad-ips. NetworkManager brings it up at every boot. The same works on EL8, EL9 and EL10.

• Each address is added on its own (/32 or /128), so the subnet routes of the main interface stay as they are.
• For extra IPv6 addresses inside the /64 your provider announces, Reqad also answers neighbor discovery for them on the main interface. Some providers only let the server use the address its network card built for itself, and drop other addresses from the same /64; then ask them to route extra addresses to the server.
• The panel (port 2087) is not offered on the extra addresses, so a customer's own address never shows your admin login.
• Every hour Reqad checks that the addresses are still on the network and puts back any that went missing. The dashboard's Needs attention card shows an address that is not on the network, and a reverse DNS that does not match.

An address that an account or an outgoing mail rule uses cannot be removed. Removing the last address takes Reqad's network connection away completely.

On the command line

reqad ip list                                    # the main and the extra addresses
reqad ip add 203.0.113.10 --rdns=mail2.example.com
reqad ip add 10.0.0.50 --public=198.51.100.7     # behind NAT
reqad ip add 2001:db8::10
reqad ip edit 203.0.113.10 --note="for shop"
reqad ip check                                   # reverse DNS of each address
reqad ip delete 203.0.113.10
reqad ip sync                                    # put missing addresses back now

reqad account ip shop --ipv4=203.0.113.10 --ipv6=2001:db8::10
reqad account ip shop                            # show its addresses
reqad account ip shop --ipv4=shared              # back to the shared address
reqad account ip shop --dns                       # set its DNS records again

reqad ip mail                                    # outgoing mail rules
reqad ip mail set example.com --ipv4=203.0.113.10
reqad ip mail remove example.com

API and AI assistants

With a whole-server token: GET /api/v1/ips lists the addresses with their reverse DNS check, POST /api/v1/ips adds one (address, public, rdns, note), PATCH /api/v1/ips/<address> changes the public address, reverse DNS name or note, and DELETE /api/v1/ips/<address> removes one. POST /api/v1/accounts/<user>/ip with {"ipv4": "203.0.113.10"} (or "shared", and/or ipv6) gives an account its address (the answer's data.dns lists the DNS records it changed), and GET /api/v1/accounts/<user> shows it. GET /api/v1/ip-mail lists the outgoing mail rules, PUT /api/v1/ip-mail/<domain> with {"ipv4": "203.0.113.10"} (and/or ipv6) sets a domain's rule, and DELETE /api/v1/ip-mail/<domain> removes it. AI assistants can read the list with the ips_list tool, the rules with ip_mail_rules, and give an account an address with account_ip_set; adding and removing addresses changes the network, so it stays in the panel and the API.

Need a hand? Create a free account or contact us.