Managing DNS records

DNS is the address book of the internet: it tells the rest of the world where yoursite.com lives, where your post should go and who may send on your behalf. This page shows how to look at those entries and change them.

Screenshot — Panel → Hosting → Accounts → your account → DNS. At the top is the DNS for picker, which switches between the domains of your account. Screenshots are captured with openwolf designqc into .wolf/designqc-captures/.

Looking at the zone

The top of the page carries what you need to know about the zone:

• Zone — its name.
• Backend — where the zone actually lives. That is this server's PowerDNS, or an outside party such as Cloudflare.
• Kind and Serial — the sequence number that goes up on every change. A secondary nameserver that sees a higher number fetches the zone.
• DNSSEC — signed, or off. See below.

Under that is the table of every record: Name, Type, Value, TTL.

corectl dns zone list
corectl dns zone show yoursite.com
corectl dns record list yoursite.com

Adding a record

1. Click Add record.
2. Name — empty or @ means the domain itself. www means www.yoursite.com.
3. Type — see the table below.
4. Value — whatever belongs to that type.
5. Under Advanced are the TTL and, on backends that have one, the proxy switch. The defaults are nearly always right.
6. Click Add.

corectl dns record add yoursite.com www A 203.0.113.10
corectl dns record add yoursite.com @ MX "10 mail.yoursite.com."
corectl dns record add yoursite.com @ TXT "v=spf1 a mx ~all" --ttl 3600

Changing a record is adding the same one with --replace, which replaces every value of that name and type in one go:

corectl dns record add yoursite.com www A 203.0.113.55 --replace
corectl dns record remove yoursite.com www A

In the panel you click a row to change or remove it. A removal can be undone straight away from the message that appears.

The types you need

Three things that often go wrong:

• A CNAME on the domain itself (@) is not allowed. The domain also needs an MX and an SOA, and a CNAME excludes everything beside it. Use an A record there.
• A name that points at a name ends in a dot. yoursite.com. is absolute; yoursite.com without the dot reads as yoursite.com.yoursite.com.
• The TTL is a memory, not a setting. Set a TTL of 24 hours, then change the address, and some visitors keep seeing the old one for a day. If you are moving soon, lower the TTL to 300 first and change the record after.

Records for a subdomain

A subdomain website (staging.yoursite.com, shop.yoursite.com) deliberately has no DNS zone of its own. Its records belong in the zone of the main domain — otherwise you would have two zones drifting quietly apart, and you would need delegation records at the registrar for something that simply sits next to your site.

So to give shop.yoursite.com an address, you add a record in the yoursite.com zone with Name shop:

corectl dns record add yoursite.com shop A 203.0.113.10
corectl dns record add yoursite.com staging CNAME yoursite.com.

The same rule holds for text records of a subdomain:

corectl dns record add yoursite.com _acme-challenge.shop TXT "…"

If you do want a subdomain as a zone of its own — because a customer manages it themselves, say — that is a separate zone with delegation; ask your administrator for it.

There is no zone yet

If the page says No DNS zone yet, this server does not manage the DNS of this domain. Two possibilities:

• The zone belongs here — click Create zone. The server fills it immediately with the records that follow from your website and mail configuration.
• The zone belongs at your registrar or at Cloudflare — leave it there and change it there. A zone that lives in two places drifts apart quietly.

corectl dns zone add yoursite.com --from-domain
corectl dns zone export yoursite.com        # the whole zone, as text
corectl dns zone remove yoursite.com

Do not forget that the nameservers at your registrar have to point at this server; without that nobody ever asks this zone anything. Which names those are:

corectl dns nameserver show

DNSSEC — and why it is off by default

DNSSEC puts a signature under your DNS answers so nobody can substitute a different address along the way. Good idea — but it only works once the last step is taken too: the DS record at your registrar. Without that step your zone is signing into thin air.

That is why DNSSEC is off by default here. Switching it on is a deliberate act in two steps:

1. In the panel, turn on Sign this zone with DNSSEC. The backend makes the keys and publishes the DS record.
2. Copy the DS record for the registrar that is shown into the control panel of your domain name.

corectl dns dnssec enable yoursite.com     # signs, and prints the DS record
corectl dns dnssec show yoursite.com
corectl dns dnssec disable yoursite.com

Switching it off goes in the opposite order: remove the DS record at your registrar first, wait until that has expired everywhere, and only then stop signing. A DS pointing at keys that no longer exist makes your whole domain unreachable — the classic way to remove yourself from the internet.

Secondary nameservers

One nameserver is one outage. A second server serving the same zone keeps your domain up while the first is under maintenance. In CoreCP you register it on the primary, after which zones are transferred automatically and every change is announced with a NOTIFY.

# on the primary
corectl dns secondary add ns2.yoursite.com --ip 203.0.113.20,2001:db8::20
corectl dns secondary list
corectl dns secondary join-command          # the line to run on the secondary
corectl dns notify yoursite.com             # transfer now instead of later

Then register both names at your registrar. Before publishing a zone the primary asks every registered secondary whether it knows the domain yet — which catches the failure where the second nameserver is listed in DNS but serves nothing.

When something is not right

Always check at the source:

dig +short A     www.yoursite.com
dig +short MX    yoursite.com
dig +short NS    yoursite.com @1.1.1.1
dig +short TXT   _dmarc.yoursite.com

A subdomain has no DNS zone of its own

If you have a website on, say, staging.test300.nl, you will look for its DNS settings under that subdomain in vain: those records belong in the zone of test300.nl. That is deliberate. Two zones for one domain is a delegation, and a delegation nobody asked for is an outage waiting on a TTL.

The panel now says so. Open the DNS page of such a subdomain and you get the explanation plus a button, Open the zone of test300.nl. There you add a record named after the subdomain:

From the server it is one line:

ssh root@stck1.corecp.dev \
  'corectl dns record add test300.nl --name staging --type A --content 185.117.226.123'
ssh root@stck1.corecp.dev 'corectl dns zone show test300.nl | grep staging'

Until round 2's final pass a technical error appeared here instead (no such endpoint). It was not about subdomains: the page asked its question before it knew which domain you were looking at. It waits properly now.

See also

• Making sure your email arrives — the four mail records, explained.
• SSL and certificates — wildcard certificates need your DNS zone.
• Making a test environment — why a staging subdomain lives in the parent zone.