Secondary DNS for cPanel with PowerDNS: three ways to do it

Every cPanel server runs its own nameserver. Since cPanel switched its default, that nameserver is PowerDNS (“The system defaults to PowerDNS”, in cPanel’s Nameserver Selection docs). If the web server is also the only server answering for its domains, one machine going down takes the websites and their DNS with it, and every DNS lookup for those domains fails until it’s back.

The fix is to answer DNS from separate nameservers, ideally in more than one place. There are three ways to get there from cPanel. This guide covers what each one needs, where it breaks, and which one fits which setup.

Option 1: cPanel’s DNS cluster with DNSOnly servers

cPanel has clustering built in (WHM » Clusters » DNS Cluster). You install cPanel DNSOnly, which cPanel describes as “the simplest version of cPanel & WHM”, on the nameserver machines and link them to your web servers. DNSOnly is a free download.

Each link has a role:

• Synchronize: records sync both ways, and the most recent change wins. This is the usual role on web servers.
• Standalone: the server accepts zones with newer serials but sends no changes. This is the usual role on the DNS servers.
• Write-only: the local server’s records are written to the remote server without zone checks, so it can overwrite newer zones.

What it needs, and where it stops:

• Every member is cPanel. Members must run cPanel & WHM or cPanel DNSOnly, and the cluster needs at least one full cPanel & WHM server. Plesk or DirectAdmin servers can’t join, and neither can a plain BIND server.
• Sync goes through WHM’s API, not DNS. Changes travel between WHMs (API tokens, trust relationships, /etc/ips.dnsmaster), not by standard zone transfers. Your nameservers have to be cPanel machines with ports 53, 953 and 2087 open. A DNSOnly server must also be a clean install.
• DNSSEC needs PowerDNS everywhere. cPanel says “All servers in the DNS cluster must run PowerDNS if domains that use DNSSEC exist in that cluster.”
• Topology can go wrong. The docs warn that two Write-only servers writing to the same DNS server “will cause a conflict and may corrupt data”, and that dedicated nameservers shouldn’t be linked to each other.

Good fit: a fleet that is 100% cPanel, where you don’t mind your nameservers being cPanel installs too.

Option 2: plain BIND slaves over AXFR

Standard DNS can do this on its own. The cPanel server stays the primary, and your nameservers run ordinary BIND as secondaries: they transfer each zone (AXFR) and refresh it when the primary sends a NOTIFY. Nothing on the nameservers is cPanel.

On the cPanel server, PowerDNS must allow your nameservers to transfer, and must notify them. In pdns.conf, with 198.51.100.1 and 198.51.100.2 as your nameservers:

primary=yes
disable-axfr=no
allow-axfr-ips=127.0.0.0/8, 198.51.100.1, 198.51.100.2
allow-notify-from=0.0.0.0/0, ::/0, 198.51.100.1, 198.51.100.2
also-notify=198.51.100.1, 198.51.100.2
allow-unsigned-notify=yes

primary is the PowerDNS 4.5+ name; older releases call it master. If you skip this step, every transfer fails with NOTAUTH: see the logs and the fix.

On each nameserver, every zone needs its own slave entry in named.conf:

zone "example.com" {
    type slave;
    file "slaves/example.com.db";
    masters { 203.0.113.10; };   // the cPanel server that owns the zone
};

Then rndc reconfig, and BIND transfers the zone.

Where it breaks: the nameservers can’t know which zones exist. Every account created on any cPanel server means a new zone entry on every nameserver. Every account deleted, or moved to another server, means removing or editing it, by hand or with a script you write and maintain. Forget once, and a domain stays broken on half your nameservers.

DNSSEC caveat: cPanel signs zones in PowerDNS’s narrow NSEC3 mode, and narrow-signed zones don’t transfer to external secondaries. To serve signed zones from plain slaves you re-sign them without narrow mode: see Enable DNSSEC on cPanel.

Good fit: a handful of servers with zones that rarely change.

Option 3: ZoneCloud, option 2 without the bookkeeping

ZoneCloud keeps option 2’s architecture: plain BIND nameservers, standard AXFR and NOTIFY. It automates the part that breaks.

1. An agent on each web server finds every zone. On a cPanel server running PowerDNS it lists them through pdnsutil list-all-zones.
2. The agent also writes the pdns.conf settings above itself, in a managed block that follows your nameservers’ IPs as you add or remove them. See PowerDNS with the BIND backend.
3. A Controller collects the zones from all agents, catches duplicates, and hands the list to the Nodes.
4. Each Node is a nameserver running BIND. It renders a type slave entry for each zone, with masters pointing at the server that owns it, reloads BIND, and transfers the zone.

New accounts appear on every nameserver without anyone touching named.conf, and deleted accounts disappear. When you move an account to another server, its zone is re-pointed to the new server once the old one no longer has it. During the move, the Controller flags the zone as a duplicate, and you can exclude it on the old server.

Because the nameservers are plain BIND and the agents read each server’s own DNS, the same cluster can serve cPanel, Plesk, DirectAdmin, InterWorx, Virtualmin, Enhance and standalone BIND or PowerDNS servers side by side. Moving a site from one panel to another doesn’t touch its nameservers.

To set it up: install the Controller, add the agent to your cPanel servers, and install the Nodes. There’s a free trial to test it on your fleet.

Side by side

	cPanel DNS cluster	Plain BIND slaves	ZoneCloud
Nameservers run	cPanel DNSOnly	plain BIND	plain BIND (+ the Node service)
Panels supported	cPanel only	any, by hand	cPanel, Plesk, DirectAdmin, InterWorx, Virtualmin, Enhance, plain BIND / PowerDNS
New and deleted zones	automatic	by hand on every nameserver	automatic
Sync method	WHM API between cPanel servers	AXFR + NOTIFY	AXFR + NOTIFY, slave config generated
DNSSEC	PowerDNS on every member	needs non-narrow signing	needs non-narrow signing
Cost	free (DNSOnly)	free, plus your time	licensed per server

Which one to pick

• All your servers are cPanel and always will be: start with cPanel’s own DNS cluster. It’s free and built in.
• A few servers whose zones rarely change: plain BIND slaves are fine, as long as someone owns the named.conf bookkeeping.
• Mixed panels, plain BIND nameservers you control, or accounts that move between servers: that’s the case ZoneCloud was built for.