DNS Records

DNS Records, in the admin app's System menu, is the account holder's record screen for any zone on the server, with the same filters, badges and actions, which the account holder's DNS Records page explains.

The screen opens on the server's own zone, and the Zone menu switches between the zones of that zone's owner. Any zone's records are at https://admin.<server hostname>/dns-records/<zone service UUID>; the UUID is on the zone's DNS Zone service in Hosts and services or in service:list.

elpanctl host:view <hostname>

prints the records at one host, with the rest of the host's details.

Four kinds of record

A zone holds records from four sources, told apart on every row and in every rule about who may change them:

Kind	Where it comes from	Shown as	You may
The account's own	Added on this screen, in the account panel or through the account API.	A plain row, with its note.	Edit and delete, as the account holder can.
Generated	A service: a Website's A and AAAA, a Mail service's MX, SPF, DKIM, DMARC and autodiscovery records, the zone's NS set.	Generated by the service, linked.	Change the service it comes from.
Derived	The null-mail hardening below.	Null mail record.	Nothing.
Temporary	The panel, for a job with a deadline: an ACME _acme-challenge token above all.	Temporary, with its end time.	Delete, not edit.

The voters are the same as in the account panel; you pass them for every zone.

The null-mail hardening

Any name with an A or AAAA record and no MX, except a wildcard, gets a derived set saying the name sends and receives no mail: a null MX (0 .), v=spf1 -all, a _dmarc reject policy, and an empty wildcard _domainkey. The derived SPF stands down when the name has an SPF record of its own and comes back when that record is deleted.

Change the source, not the record

A generated record that looks wrong is a setting that is wrong: the Mail service's authentication settings for SPF and DMARC, the website or the account's group (Shared IP Address Groups) for its addresses. The record follows the setting; a hand-maintained copy would not.

Download Zone File

Download Zone File renders the zone from its published record sets, not from the records as typed: SPF merged, TTLs collapsed, a suspended set commented out, and an SOA line synthesized around the serial the name server reports. It is the file to compare against dig or to give another provider, and it lags a change by however long publication takes.

Temporary records

A temporary record answers until its lifetime is up, then stops being published and is removed within a minute. The panel issues them itself for ACME DNS-01 challenges; you can issue one too:

elpanctl dns:add-temporary-record <zone> <name> <type> <content>
elpanctl dns:add-temporary-record example.com _verify TXT "token" --lifetime="15 minutes"

• <name> is relative to the zone, or fully qualified, or @ for the apex. The type is TXT, A, AAAA or CNAME.
• --lifetime defaults to an hour, as a relative time ("15 minutes", "2 hours").
• --ttl defaults to 60 seconds rather than the usual 1800, so a cached positive answer never outlives the record. Negative caching is the zone's SOA minimum (300 s) and unaffected.
• Publishing the same value twice extends the deadline of the record that is there instead of adding a second one. A value that already exists as a permanent record is left alone.

elpanctl dns:purge-expired-records --dry-run
elpanctl dns:purge-expired-records

removes the rows of expired records, and with them the record sets the name servers still hold, 500 per run by default (--limit). A worker runs it every minute, so by hand it is for seeing what is pending or for converging after the scheduler was down.

Maintenance commands

elpanctl dns:republish-generated-records --dry-run
elpanctl dns:republish-generated-records

Removes and recreates every derived (null-mail) record set through the same path the panel uses, so rows created before a change to what the derived set publishes pick it up. Read the --dry-run output first.

A name that gains v=spf1 -all

A name whose derived SPF record publishes for the first time gains v=spf1 -all in live DNS, which breaks SPF for anything that identifies itself as that name when sending mail. The dry run lists those names.

elpanctl dns:spf-refresh

The SPF half of publication: resolves the SPF records waiting on a flattening and refreshes the ones already flattened, up to 50 per pass (--limit). A worker runs it every five minutes. It never shrinks a record because a lookup failed, and never publishes an identical value. What flattening is, and why the records themselves never change, is in the account docs' SPF Record Publication.