Bind a zone to its intended customer before enabling self-service DNS. PD BIND 9 DNS keeps the server credentials in the administrative provider connection; customers manage permitted DNS records through their own portal.

Assign the intended owner

1. Open BIND 9 DNS → Zones and identify the exact provider and zone.
2. Open its row actions and choose Assign to client.
3. Select the intended customer and, where applicable, a domain or service on that account.
4. Review the saved relationship and any DNS package allowance.
5. Confirm that the intended client’s portal shows only their own zones.

An unowned zone does not become available to all clients. Removing a client binding removes that self-service relationship; it is different from explicitly deleting provider DNS.

Open the customer workflow

Clients use My Tools in the client portal, then the DNS manager. They can add, edit and delete permitted ordinary records and download a BIND-format zone file.

On Blesta, use My Tools and the zone’s in-page tabs. Keep a zone navigation choice that includes those tabs; menu-placement and domain/service-link settings from another platform do not control this portal.

Investigate a refused change

Check ownership, the relevant active service and allowance, zone lock and domain-only policy separately. A transferred secondary remains read-only because changes belong at its primary. A server validation or reload error is different from a client permission refusal.

Keep the exact redacted error and current record state if a write failed. An activation error can follow a file change that was already written; inspect actual state before repeating it. Never give the customer SSH credentials or an administrative API token to bypass restrictions. See the allowance guide and maintenance checks for those separate issues.

See the PD BIND 9 DNS Blesta guide for related tasks, or explore the module.