Plesk, cPanel, and DirectAdmin as a Hidden Primary
Keep managing DNS in your hosting panel, and let an external secondary serve your zones on its own nameservers.
What changes, and what does not
Your customers and you keep editing records in the panel as before. The panel's DNS server becomes a hidden primary: it holds the zones, allows zone transfers to the secondary, and sends a NOTIFY on every change. The secondary pulls each change and answers all public queries. Your hosting server no longer takes the DNS load, and DNS keeps working while the server is down for maintenance.
For every panel, you do three things:
- Allow zone transfers to the secondary's transfer addresses.
- Send NOTIFY to the secondary.
- Replace the panel's own nameservers in the zone template with the secondary's nameservers.
For hiddenprimary.ch, the transfer addresses are 159.69.29.118,
2a01:4f8:1c0c:63c4::118, 45.131.252.44, and 2a11:8b80:1000:1::18:
two hosts, the transfer node and the standby that takes over when the transfer node is unavailable, each with
IPv4 and IPv6. Allow all four. The notify addresses are 159.69.29.118 and
45.131.252.44. None of the panels offers TSIG for transfers in its interface, so add the zones
on hiddenprimary.ch without a TSIG key.
Plesk
1. Allow transfers
Go to Tools & Settings → DNS Settings, tab Transfer Restrictions Template. Click Add IP Address and add each of the four transfer addresses. Plesk applies this list to every zone on the server.
2. Send NOTIFY
On Linux, go to Tools & Settings → DNS Settings → Server-wide Settings and enter this in Additional DNS settings. Plesk checks the syntax and keeps the setting through later updates:
Do not edit named.conf by hand: Plesk rewrites the zone entries from its own settings.
3. Nameservers in the zone template
Go to Tools & Settings → DNS Settings → Zone Records Template. Remove the NS records that point to your own server, and add NS records for our nameservers. Then apply the template to the existing zones. Plesk raises the serial whenever a zone is changed through the interface.
Do not use the Slave DNS Manager extension for this. It controls BIND servers that you run yourself, over their control channel. A secondary provider does not give you that access, and does not need it.
cPanel / WHM
cPanel uses PowerDNS by default. You can check this in WHM → Service Configuration → Nameserver Selection. WHM has no interface for zone transfers, so you edit the configuration file.
1. Allow transfers and send NOTIFY (PowerDNS)
In /etc/pdns/pdns.conf, set or add:
PowerDNS sends NOTIFY only when it runs as a primary. Check that pdns.conf contains
primary=yes (master=yes on older versions). cPanel updates can restore parts of
pdns.conf. After each larger cPanel update, check that your lines are still there.
If you run BIND instead
In /etc/named.conf, change the allow-transfer line in the options
block and add also-notify. Then run rebuilddnsconfig as above.
2. Nameservers
New zones get their NS records from WHM → DNS Functions → Edit Zone Templates
(the variables %nameserver% to %nameserver4%). Set these to our nameservers. For
existing zones, change the NS records in WHM → DNS Functions → DNS Zone Manager.
cPanel users cannot change NS records in their own Zone Editor. cPanel raises the serial on every change.
cPanel's DNS Clustering is not the right tool here. It synchronises cPanel servers with each other through the cPanel API and does not feed a standard secondary.
DirectAdmin
1. Allow transfers and send NOTIFY
DirectAdmin uses BIND. Add both statements to the options block of named.conf
(/etc/named.conf on RHEL-based systems, /etc/bind/named.conf on Debian and Ubuntu),
then restart named. DirectAdmin writes the zone entries, but it does not rewrite the options
block. Check it after major updates anyway.
2. Nameservers
New zones take their NS records from the ns1 and ns2 settings (admin level, reseller
level, and per user). Set them to our nameservers. For existing zones, replace the old names in the zone files
and let DirectAdmin rewrite them, which also gives every zone a new serial:
For all panels
- Firewall: allow TCP and UDP port 53 from the transfer addresses. Transfers use TCP.
- Add each zone on the secondary. The secondary only pulls zones it knows. With many zones, use the bulk import in the portal, or the API or Terraform from your provisioning.
- Delegation: the NS records at each domain's registrar must also name the secondary. The migration guide explains the order.