DNS is managed for you
Open DNS Records and you'll find a zone full of records you never wrote. That's by design: in Elpan, DNS is mostly an output of your configuration, not something you maintain by hand.
Generated records
Each service publishes the records it needs:
| Source | Publishes |
|---|---|
| The zone itself | NS and SOA. |
| A Website service | The addresses that point its domain to this server. |
| A Mail service | MX, SPF, DKIM, and DMARC, plus the autodiscovery records mail apps use to set themselves up (_submission, _imaps, _autodiscover, calendar and contacts discovery). |
The records follow your settings. Change your DMARC policy or rotate a DKIM key and the records change too, along with the zone serial so other resolvers pick it up.
Generated records can't be edited or deleted. If one looks wrong, change the setting it comes from, e.g. the DMARC policy in the Mail service's authentication settings. Each generated record names the service it belongs to.
Your records
Your own records live alongside the generated ones. Add a verification TXT record, a record for an external service, or a CNAME to another provider under DNS Records. The panel never touches them.
DNSSEC
Your zones are signed with DNSSEC by default, so resolvers can verify that answers for your domain aren't forged.
The panel can't complete the chain of trust on its own: you need to add the DS record at your domain's registrar. You'll find it, with any other record the parent zone needs, on the zone's Delegation tab. See DNS Records.
- No DS record at the registrar: DNSSEC does nothing, silently. Your domain still resolves.
- A wrong DS record: your domain stops resolving for every resolver that validates DNSSEC.
If your DNS is hosted elsewhere
All of the above assumes this server is authoritative for your domain, i.e. your registrar's NS records point here.
If you keep DNS at another provider, the panel still shows what the records should be, but you copy them by hand and keep them current every time a key rotates. Unless you have a strong reason, hosting the zone here is far less work.