DNS cluster & DNS-only servers

Like cPanel's DNS cluster and DNSOnly: your nameservers run on their own small servers, every panel sends its zones to them, and when one server is down the others keep answering.

How it works#

• Every server answers DNS itself, from its own copy of the zones (PowerDNS).
• Servers are paired with a pairing token made on the server that receives the zones.
• Each pairing has a role:

• Changes go out within seconds. A server that is down gets them when it is back (they wait in a queue), and a check every few minutes repairs any zone that differs.
• Several panels can share the same DNS-only servers. Each zone belongs to the server that sent it: no other server can overwrite or delete it.
• One domain, one server. When an account or domain is added, the panel asks the cluster first and refuses a domain that already exists on another server (This domain already exists on the DNS cluster).

Install a DNS-only server#

A small VPS is enough (1 CPU, 1 GB RAM, AlmaLinux / Rocky Linux / RHEL 9 or 10). Point its name (for example ns2.example.com) to its IP first, then as root:

curl -fsSLO https://downloads.nexpanel.app/install/install.sh && bash install.sh --dns-only --domain ns2.example.com --email you@example.com

It installs PowerDNS and a small admin panel at https://ns2.example.com/admin with only DNS Zones, DNS Cluster and administration (no websites, email or customer accounts). Port 53 is opened for DNS; the PowerDNS API stays local. The installer ends with a one-time setup link to create the administrator. Use --admin-allow CIDR to allow the admin panel only from your IPs.

Pair the servers#

1. On the DNS-only server: DNS Cluster › Pairing tokens › Make pairing token (name it after the panel that will use it). Copy the token: it is shown once.
2. On each panel: DNS › DNS Cluster › Add DNS server, type NexPanel server, the address https://ns2.example.com, the token, role Write-only. The panel checks the connection and copies all its zones.
3. Repeat for every DNS-only server (ns1, ns2…).
4. Reverse trust: when adding a server you can let it add this one back (for example DNS-only server A ↔ B as Synchronize changes), so zones made on either DNS-only server reach the other. The token for the way back is made automatically.

Each server on the DNS Cluster page shows its state (in sync, copying, unreachable), the number of your zones on it, the last check and copy, and zones that failed to copy with the reason.

Recommended setups#

At your registrar create the glue records (ns1.example.com → IP of A, ns2.example.com → IP of B), and set the same names under Basic Settings › Default nameservers on every panel.

Zones from other servers#

On a DNS-only server, DNS Zones shows where each zone comes from. A zone sent by a panel is changed on that panel; it is read-only here, but you can delete it (for example after the panel left the cluster). Revoking a pairing token stops that server from sending more changes; its zones stay until you delete them.

Plain PowerDNS servers#

A server running only PowerDNS can still join: Add DNS server › PowerDNS server, with its API address and key (install-powerdns.sh --allow-from <panel IP> prints them). It gets every zone of the panel like a write-only server.