Configure DNS for a new domain

Two ways to do DNS

When you add a domain to NovaPanel you have a choice:

1. NovaPanel-managed (PowerDNS). Make NovaPanel authoritative for the domain. Manage records in the panel, no registrar logins needed for ongoing changes. Required for DNSSEC.
2. Registrar-managed. Leave DNS at Cloudflare / Route 53 / your registrar. NovaPanel just hosts the site, mail, etc — DNS records live elsewhere.

Most operators pick option 2 for production (registrar DNS is robust, free, no extra moving parts) and option 1 for resold-hosting setups where the customer wants single-pane-of-glass DNS management.

Option 2 — Registrar-managed DNS (the simple path)

At your registrar, set these records:

; A record for the bare domain
@        A     203.0.113.42        ; your panel's IPv4

; AAAA if you have IPv6
@        AAAA  2001:db8::1

; www subdomain
www      A     203.0.113.42

; MX for mail (only if NovaPanel handles mail for this domain)
@        MX    10 mail.example.com.

; SPF / DKIM / DMARC — see the email-setup guide
@        TXT   "v=spf1 mx ~all"
nova._domainkey  TXT  "..."
_dmarc   TXT   "..."

Caddy on the panel will provision a Let's Encrypt cert for the domain within seconds of the first HTTPS request once DNS resolves. Mail might take 5-30 minutes to propagate; HTTP traffic arrives faster.

Option 1 — PowerDNS-managed (NovaPanel authoritative)

At the registrar

Set the domain's nameservers to point at your panel:

ns1.example.com   → A → 203.0.113.42
ns2.example.com   → A → 203.0.113.42  ; same IP is fine for now

Most registrars also need glue records — they ask "what's the IP of ns1.example.com?" so resolvers don't end up in a circular lookup. Set those at the registrar.

In NovaPanel

Admin → DNS Zones → Add zone. The panel creates a zone with the standard SOA / NS / A records pre-filled.

Then admin → DNS Zones → <domain> to add records. The UI handles A / AAAA / CNAME / MX / TXT / SRV / NS / CAA — CAA is admin-only, the customer-side DNS editor offers the other seven. Everything goes through PowerDNS's API — no zone-file editing.

DNSSEC (PowerDNS-managed only)

DNSSEC needs the panel to be authoritative — won't work if you're using registrar DNS.

Enable in the panel

DNSSEC is a single global switch, not a per-zone setting: admin → Nameservers → DNSSEC. Turn it on and the panel signs every zone it hosts, including zones created afterwards; turn it off and it unsigns all of them. There's no way to sign one zone and leave another unsigned.

Signing runs through pdnsutil secure-zone, which generates the keys and signs the existing records. There's no key rotation — the keys stay as generated until you disable and re-enable DNSSEC.

Publish the DS record at the registrar

The DS record proves the chain of trust from the parent zone (.com) down to your zone. Without it, DNSSEC is enabled but resolvers can't verify the chain.

The panel doesn't display the DS record anywhere, so you have to fetch it from the server itself:

sudo pdnsutil show-zone example.com

Copy the DS line(s) from the output into your registrar's DS / "DNSSEC keys" interface. Most major registrars (Namecheap, Gandi, Cloudflare-as-registrar, Hover) support this; some smaller ones don't.

Verify

After ~30 minutes for propagation, run dnsviz.net against your domain. You want a clean, fully-green chain. Yellow means "DNSSEC enabled but DS record missing or wrong."

Zone transfers (AXFR) & hidden-master setups

For higher availability you can run NovaPanel as a hidden master and use external secondaries (e.g., Hurricane Electric's free service). The secondaries pull the zone from your panel over AXFR, and you delegate the public-facing nameservers to them instead of to the panel — so the panel's IP isn't a single point of failure for DNS.

For all zones at once (recommended): admin → Nameservers → Secondary DNS. List your secondary nameservers (one IP or CIDR per line) and save — NovaPanel pushes that list to every zone's ALLOW-AXFR-FROM and ALSO-NOTIFY. This is the setting to use when you run a fixed set of secondaries for the whole panel.

Zones created later don't all inherit it. Admin → DNS Zones → Add zone and the zone created for a domain's first mailbox pick the saved list up automatically, but a zone created by a customer's own Add domain, or by one-step account provisioning, does not. After adding domains that way, go back to Nameservers → Secondary DNS and hit save again — that re-pushes the list to every zone, including the new ones.

For a single zone: admin → DNS Zones → click the zone → Zone Transfers. Same input (IPs/CIDRs, one per line). Use this for a per-zone exception. Note that saving the global Secondary DNS list overwrites per-zone overrides, since the global list is treated as the source of truth whenever it's saved.

Either way, then:

• Configure each secondary's "slave zone" interface pointing at your panel's IP.
• Update registrar nameservers to point at the secondaries (not at your panel).

Transfers are disabled by default — an empty list means no one can AXFR the zone, which is what you want unless you explicitly run secondaries. Only list servers you control: anyone who can transfer a zone can read every record in it. The panel accepts only literal IPs and CIDRs (no hostnames), and "allow everything" ranges like 0.0.0.0/0 are rejected. Single IPs also get an ALSO-NOTIFY so the secondary re-pulls on every change; CIDR ranges may transfer but aren't notified.

Wildcard SSL (DNS-01)

Because the panel runs its own DNS, it can issue *.example.com wildcard certificates using the ACME DNS-01 challenge — something HTTP-01 can't do. In the customer panel, on SSL Certificates, click Wildcard next to a domain. Caddy then solves the challenge by writing a temporary TXT record into PowerDNS via its API and obtains a cert covering both the apex and all subdomains.

This requires a Caddy build that includes the PowerDNS DNS module (caddy-dns/powerdns). The installer compiles it in automatically, so every new install — and any server you (re-)run the installer on — has it. If DNS-01 isn't available, the Wildcard button returns a clear error and ordinary single-host certificates keep working over HTTP-01 as before.

Upgrading an older server? Panels first installed before wildcard support shipped auto-update the panel binary on their own, but the binary update does not rebuild Caddy — so the PowerDNS module won't be present yet. Re-run the installer once to rebuild Caddy with it (it's safe to re-run and skips steps that are already done):

curl -fsSL https://license.novapanel.dev/install.sh | sudo bash

Confirm the module is present with caddy list-modules | grep powerdns — you want to see dns.providers.powerdns.

Domain aliases (parked domains)

Want a second domain to lead to the same site? Add it under Domains with the type Alias. An alias has an Alias mode setting with two choices:

• Serve content — the alias serves the same website as your primary domain (classic parked-domain behaviour). Both addresses show identical content.
• Redirect to primary — the alias issues a permanent 301 redirect to your primary domain, preserving the path (example.net/page → example.com/page). This is the better choice for SEO, since it consolidates all your ranking onto one domain instead of splitting it across duplicate content.

Common issues

"Records show in the panel but resolvers see nothing"

PowerDNS isn't being queried. Either the registrar's NS records don't point at your panel (option 1 setup incomplete), or the panel's public IP is firewalled on UDP 53. Test with: dig @your-panel-ip example.com.

"DNSSEC validation failing"

Almost always the DS record at the registrar doesn't match what the zone is actually signed with. Re-copy from pdnsutil show-zone; sometimes registrar UIs eat newlines or expect a slightly different format (algorithm number vs name).