? DNS Configuration and Management
Creating DNS Zone
- Navigate to DNS tab
- Click "Add new DNS Zone"
- Use DNS Wizard (recommended):
- Template: Default template
- Domain: yourdomain.com
- IP Address: Your server IP
- NS1: ns1.yourdomain.com
- NS2: ns2.yourdomain.com
- Email: admin@yourdomain.com
- Click "Create DNS-Record"
DNS Record Types
| Type | Purpose | Example |
|---|---|---|
| A | Points domain to IPv4 address | example.com → 192.168.1.1 |
| AAAA | Points domain to IPv6 address | example.com → 2001:db8::1 |
| CNAME | Alias for another domain | www → example.com |
| MX | Mail server for domain | Priority 10: mail.example.com |
| TXT | Text records (SPF, DKIM, etc) | v=spf1 mx ~all |
| NS | Nameserver for zone | ns1.example.com |
| PTR | Reverse DNS lookup | 1.1.168.192.in-addr.arpa |
| SRV | Service records | _service._protocol.name |
| CAA | Certificate Authority Authorization | 0 issue "letsencrypt.org" |
Adding DNS Records
- Go to DNS → DNS Zones
- Click on zone name
- Click "Records" tab
- Add new record:
- Hostname: Subdomain or @ for root
- Type: Select record type
- Data: IP address or value
- TTL: Time to live (3600 default)
- Save record
Email DNS Records
MX Records
Priority 10: mail.yourdomain.comSPF Record (TXT)
v=spf1 mx a ip4:YOUR_SERVER_IP ~allDKIM Record (TXT)
default._domainkey IN TXT "v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY"DMARC Record (TXT)
_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:admin@yourdomain.com"DNS Templates
ISPConfig includes DNS templates for quick setup:
- Default template: Standard DNS records
- Google Apps: MX records for Google Workspace
- Office 365: MX records for Microsoft 365
- Custom templates: Create your own
Secondary DNS (Slave Zones)
- Add secondary DNS server in System → Server Services
- Create zone on master server
- Enable "Allow zone transfers" to secondary server IP
- Secondary server automatically syncs zone
DNS Propagation
DNS changes take time to propagate:
- TTL determines cache duration
- Typical propagation: 4-48 hours
- Lower TTL before making changes
- Test with: dig, nslookup, or online tools
DNSSEC Setup
- Enable DNSSEC in DNS zone settings
- ISPConfig generates DNSSEC keys
- Add DS records at domain registrar
- Verify DNSSEC validation
Common DNS Issues
- NXDOMAIN: Domain doesn't exist - check zone creation
- SERVFAIL: DNS server error - check BIND logs
- Timeout: Server not responding - check firewall port 53
- Wrong IP: Cached old records - wait for TTL expiry
DNS Testing Commands
# Check A record
dig yourdomain.com
# Check specific record type
dig MX yourdomain.com
# Check using specific nameserver
dig @8.8.8.8 yourdomain.com
# Trace DNS resolution
dig +trace yourdomain.com
# Reverse DNS lookup
dig -x IP_ADDRESS
