DNS setup

DNS setup

The A, mail and reverse DNS records your server's domain needs, your own nameservers, and how to list and check them.

Point your domain's names at the server before you install, so that the SSL certificate covers every address from the first minute. If DNS is not ready, the installation still works: each name joins the certificate by itself within 5 minutes of pointing at the server.

A records

At the company that runs your domain's DNS, add an A record for each of these names, pointing at the server's public IPv4 address. If the server has IPv6, add AAAA records with its IPv6 address too.

Name	Used for
`panel.yourdomain.com`	Control Panel: your customers' panel (and the server's own host name)
`server.yourdomain.com`	Server Admin: the administrators' panel
`reseller.yourdomain.com`	Reseller Panel: your resellers' panel
`files.yourdomain.com`	HF Files: the File Manager
`db.yourdomain.com`	HF Studio: databases in the browser
`api.yourdomain.com`	the API: billing systems, scripts and the HF Server desktop app
`webmail.yourdomain.com`	HF Mail: webmail
`mail.yourdomain.com`	the mail server: the MX of every hosted domain
`smtp.yourdomain.com`	mail apps: outgoing mail (port 587 or 465)
`imap.yourdomain.com`	mail apps: incoming mail (IMAP 993, POP3 995)
`ftp.yourdomain.com`	FTP
`ns1.yourdomain.com`, `ns2.yourdomain.com`	your own nameservers (optional, see below)
`*.port.yourdomain.com`	HF Tunnel links (only if you switch HF Tunnel on; you choose the domain there)

Which names you need depends on the installer options:

with --no-mail, leave out webmail., mail., smtp. and imap.
with --no-dns, leave out ns1. and ns2.
with --no-portals, leave out server., reseller., files., db. and api.

See Customise the installation.

You don't have to type the list by hand

Right after you enter the domain, the installer shows the exact records your domain needs. It marks each one that already points at the server, and waits for Enter so you can add the rest first. It also saves the list as a zone file you can import at most DNS providers, /etc/hostfog/dns-setup.zone.

At any time later, on the server:

bash

hf-panel dns-setup           # the records the server's own domain needs
hf-panel dns-setup --check   # also looks each one up in public DNS and marks what is missing

--check exits with status 1 while anything is still missing, so you can use it in scripts.

Mail records

The installer creates SPF, DKIM, DMARC and TLS reporting records for your domain in the server's own DNS. When your domain's DNS is hosted elsewhere, copy them from hf-panel dns-setup to that provider:

Type	Name	Value
MX	`yourdomain.com`	`mail.yourdomain.com`
TXT	`mail.yourdomain.com`	`v=spf1 a -all`
TXT	`yourdomain.com`	SPF, for example `v=spf1 a mx ip4:203.0.113.10 ~all` — merge it with an SPF record you already have: a domain may have only one
TXT	`hf._domainkey.yourdomain.com`	DKIM: the key `hf-panel dns-setup` prints
TXT	`_dmarc.yourdomain.com`	`v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r` — keep a policy you already have and add the `rua` part
TXT	`_smtp._tls.yourdomain.com`	`v=TLSRPTv1; rua=mailto:tls@yourdomain.com`

Tip: use the values hf-panel dns-setup prints, not the examples above: they contain your server's real IP address and DKIM key.

Reverse DNS (PTR)

At your server provider (not your domain's DNS provider), set the reverse DNS of the server's IP to:

text

mail.yourdomain.com

That is the name the server greets other mail servers with. Without a matching PTR, large mail providers are likely to put your mail in spam. Server Admin › Server › Server health and Server Admin › Email › Mail health show whether it is right.

Note: if you choose another mail server name with --mail-host or hf-panel mail-name, set the PTR to that name instead.

Your own nameservers (optional)

To let customers point their domains at ns1.yourdomain.com and ns2.yourdomain.com:

Keep the A records for ns1. and ns2. from the table above.
At your domain registrar, add them as glue records (also called child nameservers or host records), with the server's IP.
To use other names, give --ns1 and --ns2 when you install.

You can skip this. Customers can keep their DNS elsewhere and add the records the Control Panel's DNS setup page lists for them.

DNS providers that proxy traffic

If your DNS provider can proxy web traffic (an orange-cloud style setting), set the server's names — server., panel., reseller., api., mail., smtp., imap. and ftp. — to DNS only. Ports 8443 and 2087, mail and FTP do not pass through a web proxy, and Let's Encrypt needs to reach the server directly.