Skip to content

DNS and the DNS cluster

BHPanel runs its own nameserver, PowerDNS, and writes a zone for every website by itself. One server can also be DNS only: the nameservers for all your other servers.

Set up DNS on a hosting server

DNS › DNS zones:

  1. Set up DNS installs PowerDNS, opens port 53 and builds a zone for every site already there. Nothing else may be using port 53.
  2. Nameservers: enter NS1 and NS2 (for example ns1.example.com and ns2.example.com) and keep Create a zone with each new website ticked.
  3. Register those names at your domain registrar as glue records ("child nameservers"), pointing at this server's address.

Which address each name answers at is set on Server › Network (ns1 answers at, ns2 answers at; empty means this server). Both names on one address is fine and is the default.

Nameserver: Disabled stops answering on port 53 and creates no zones, while keeping the zones already stored — for domains whose DNS lives at a registrar, on Cloudflare or on a separate DNS cluster.

What a zone holds

A new site's zone gets, by itself: its NS records, A and AAAA for the domain and www, the panel's own names, and — when this server handles its mail — MX, mail. and webmail., SPF, DKIM and DMARC.

  • + Add record: A, AAAA, CNAME, MX, TXT, SRV and CAA, with quick fills for pointing a name at another server, Google Workspace mail, Microsoft 365 mail and site verification.
  • The SOA record is kept by the panel; its serial goes up with every change.
  • A banner says whether this server really answers for the domain right now.
  • Customers edit their own zones under DNS › DNS zones.

DNSSEC

Sign this zone, then give the DS record the panel shows to your registrar. To stop signing, take the DS record out at the registrar first, wait for it to expire, then Remove the signing keys.

The DNS cluster

A DNS-only BHPanel server answers as ns1/ns2 for every hosting server you have — BHPanel or CentOS Web Panel — and copies their zones the moment they change. Customers' sites stay reachable by name even while a hosting server is being rebooted or rebuilt, and all your domains share one pair of nameservers.

Install the DNS-only server

curl -fsSL https://releases.bhpanel.net/install.sh | sudo bash -s -- --beta --dns-only

It installs the panel, PowerDNS and the firewall — no websites, mail or databases. Then, on it, open Server › DNS cluster, set its nameservers, and note its Endpoint and Key (Show the key). It refuses hosting servers until its nameservers are set.

Connect a hosting server

Either side can start it:

  • From the hosting server: Server › DNS cluster › Send this server's zones to a DNS-only server — enter the Endpoint, the Key and the DNS server's IPv4 address, then Connect.
  • From the DNS-only server: on the hosting server make an API token with only the DNS cluster permission ticked (Accounts › API access); then on the DNS-only server Add a BHPanel hosting server with its panel hostname and that token.

Changes are sent within seconds, and both sides are compared every five minutes. On the hosting server you can Push or Remove zone by zone. On the DNS-only server, Zones lists every zone with its source and state, and Manage a hosting server to re-sync its zones or disconnect it.

CentOS Web Panel servers connect with the PowerDNS Connect module, using the same endpoint and key.

Moving from another PowerDNS server

On the DNS-only server, use Use an existing key with the key your servers already have, and upload a dump of the old server's database (mysqldump powerdns supermasters domains > pdns.sql) under Move from another PowerDNS server — Check first, then Import. Hosting servers then need no change at the switch.

Zones that move

A zone only moves to another hosting server once the server holding it deletes it (checked every five minutes), or when you press Move now. Deleting a website, subdomain or account takes its records off the cluster within seconds.

With Cloudflare

If a domain's nameservers are Cloudflare's, the panel's DNS is still where you edit it: see Cloudflare.