Bind the intended PowerDNS zone to its customer before offering self-service DNS. A provider connection gives the host upstream access; it does not make every zone visible to every client.

Check the binding

1. Open PowerDNS → Zones and find the exact provider and zone.
2. Open the zone row’s actions and choose Assign to client, then optionally one of that client’s domains or services.
3. Select the intended customer and applicable domain or service.
4. Review the saved owner and any package allowance.
5. Confirm that the customer’s portal lists only the intended zones.

A zone without a recorded client owner does not appear in a client’s DNS area. Check account ownership separately from whether the zone exists at PowerDNS.

Open the customer workflow

Customers use My Tools in the client portal, then the DNS manager. They can manage permitted records, inspect DNSSEC status and download a BIND zone file. Keep staff/provider credentials out of that workflow.

On Blesta, zone pages such as DNSSEC and Import / Export are tabs within the DNS page. The navigation-link placement and domain/service sidebar settings described for other billing systems do not control this portal.

Investigate read-only or missing access

Check the client binding, relevant active service and allowance, zone lock and domain-only policy separately. A locked zone can remain visible while edits are refused. A secondary zone is read-only because its records come from a primary server; unlocking it is not the way to enable local editing.

Confirm the intended account before changing ownership. Do not grant broad provider access or share an administrative API token to work around a customer restriction. Use the allowance guide for entitlement refusals and the secondary guide for transferred records.

See the PD PowerDNS Blesta guide for related tasks, or explore PD PowerDNS.