DNS setup

Point your domain's names at the server before you install, so that the SSL certificate covers every address from the first minute. If DNS is not ready, the installation still works: each name joins the certificate by itself within 5 minutes of pointing at the server.

A and CNAME records

At the company that runs your domain's DNS, add these records. Only the names that must be A records hold the server's public IPv4 address: the domain itself, the mail server's name (the target of an MX record can't be a CNAME) and your own nameservers (their glue records). Every other name is a CNAME to your domain, so if the server's IP ever changes you update only the A records. If the server has IPv6, add AAAA records with its IPv6 address next to the A records.

The trailing dot in yourdomain.com. marks a full name; most DNS providers add it for you, so type the domain with or without it as their form asks.

Which names you need depends on the installer options:

• with --no-mail, leave out mail., smtp., imap. and the MX record
• with --no-dns, leave out ns1. and ns2.
• with --no-portals, leave out srv., rs., fm., dbs., cld., dep., api., pay. and hook.

See Customise the installation.

You don't have to type the list by hand

In the browser installer, the DNS step lists the exact records your domain needs and checks each one (a CNAME is green once it leads to the server). Copy all copies them as zone-file lines, and Download DNS file saves them as yourdomain.com.zone.txt, a standard BIND zone file that most DNS providers can import (it has no SOA or NS records, which an import refuses or replaces). The installer in the terminal shows the same records, marks each one that already points at the server, and waits for Enter so you can add the rest first. It also saves the list as a zone file, /etc/hostfog/dns-setup.zone.

At any time later, on the server:

hf-agent dns-setup           # the records the server's own domain needs
hf-agent dns-setup --check   # also looks each one up in public DNS and marks what is missing

--check exits with status 1 while anything is still missing, so you can use it in scripts.

Mail records

The installer creates SPF, DKIM, DMARC and TLS reporting records for your domain in the server's own DNS. When your domain's DNS is hosted elsewhere, copy them from hf-agent dns-setup to that provider:

Tip: use the values hf-agent dns-setup prints, not the examples above: they contain your server's real IP address and DKIM key.

Reverse DNS (PTR)

At your server provider (not your domain's DNS provider), set the reverse DNS of the server's IP to:

mail.yourdomain.com

That is the name the server greets other mail servers with. Without a matching PTR, large mail providers are likely to put your mail in spam. Server Admin › Server › Server health and Server Admin › Email › Mail health show whether it is right.

Note: if you choose another mail server name with --mail-host or hf-agent mail-name, set the PTR to that name instead.

Your own nameservers (optional)

To let customers point their domains at ns1.yourdomain.com and ns2.yourdomain.com:

1. Keep the A records for ns1. and ns2. from the table above.
2. At your domain registrar, add them as glue records (also called child nameservers or host records), with the server's IP.
3. To use other names, give --ns1 and --ns2 when you install.

You can skip this. Customers can keep their DNS elsewhere and add the records the Control Panel's DNS setup page lists for them.

DNS providers that proxy traffic

If your DNS provider can proxy web traffic (an orange-cloud style setting), set the server's names — srv., cp., rs., api., mail., smtp., imap. and ftp. — to DNS only. Port 8443, mail and FTP do not pass through a web proxy, and Let's Encrypt needs to reach the server directly.

Related

• Install
• After installation
• Server commands