PD Azure DNS for Blesta

PD Azure DNS lets a hosting company run customer DNS on Microsoft Azure DNS and manage all of it from Blesta. Connect your Azure subscription once and every hosted zone appears in your admin area with no import, and your customers edit their own records from your client portal without an Azure login or a support ticket.

It is built for hosts and agencies who keep their zones in Azure DNS and want their team and their customers working from Blesta, not from the Azure portal.

Why hosts choose PD Azure DNS

Connect in minutes, with help when it goes wrong. One Azure Cloud Shell command creates the access credentials the provider form needs. When a value is wrong, Test connection tells you which one and what to fix, instead of a generic failure.

No expired-secret surprises. Enter the expiry date of your Azure secret and Test connection counts down to it, with warnings 60, 30 and 7 days before it runs out, so DNS changes do not fail the day it lapses.

Delegation is never missed. A zone's Azure name servers are shown right on the Zones list, so you can see at a glance what a domain must point to at its registrar.

DNSSEC without the key handling. Sign a zone with one button and the DS record and key details your registrar asks for are shown, ready to copy.

Customers help themselves. Customers manage their own records and snapshots with no access to your Azure subscription.

How it works

1. Connect Azure. Run the single Cloud Shell command Azure DNS gives you, paste the values into the provider form and press Test connection. Enter the secret's expiry date to get the warnings.
2. Your zones appear. Every zone in the subscription is listed with its Azure name servers, health, sync and DNSSEC state. Assign each to a client, or let Track matched zones do it.
3. Turn on what you sell. Create templates and packages, link packages to your packages, and switch on auto-provisioning if you want a zone created whenever a domain is registered or a service is set up.
4. Customers manage their own DNS. They add records, switch on DNSSEC and restore from snapshots, and you see every change in Activity.

What you get in Blesta

Connecting and zones

• Add Azure DNS from Providers; one Azure Cloud Shell command creates the credentials the form needs
• Test connection names the value that is wrong and what to fix; with the secret's expiry date entered, it counts down and warns 60, 30 and 7 days ahead
• More than one Azure account can be connected and managed in the same interface
• A zone's Azure name servers are shown on the Zones list
• Every zone is listed with no import or sync step, read live from Azure DNS; changes are written straight back and the module keeps no copy of your records
• Server-side paging, search and sort keep the list fast with thousands of zones; narrow it by name, provider, status or client
• Track matched zones binds every zone matching an active domain or service to its client in one step, changing nothing at the provider
• Lock a zone against the client's own changes; admins keep full control and the client keeps read access

Records

• A type-aware editor that shows only the fields the type uses: priority and mail server for MX, priority, weight, port and target for SRV, flags, tag and value for CAA
• Addresses and hostnames are checked before saving, so a malformed record never reaches the provider. Search by name or value and filter by type
• Export a zone as a BIND zone file. Import adds only missing records and shows how many before it writes anything
• DNSSEC per zone with one button on the Records page: when it is on, the DS record and key details (keytag, algorithm, digest type and digest) are shown copy-ready for the registrar

Selling DNS with your Blesta packages

• Zone allowances: a DNS package caps how many zones a customer may have and is linked to your Blesta packages; the largest allowance wins
• Record limits per zone and per record type, held in the customer's editor, imports, templates and the API
• Templates: apply a named set of records to any zone in one click, with merge fields such as {domain}, {ns1} and {ip}; applying twice is safe
• Auto-provision, off until you switch it on: a zone is created and bound to the client when a domain is registered, transferred or set up with a service. A failure is logged and never interrupts the order
• TLD takeover: for the extensions you choose, a newly registered or transferred domain also gets its nameservers pointed at Azure DNS

Running it day to day

• Backups on by default: every zone is snapshotted as a BIND zone file each 24 hours, keeping the newest 10, with settings for both and an optional age cap. Back up one zone or all on demand
• Restore makes a zone match a snapshot exactly, after a safety snapshot; a zone deleted by mistake is recovered with every record
• Optional emails, off until you turn them on: admin alerts for drift or a failed backup, and customer notices when a zone is created, removed or changed by staff
• A REST API with named read or write tokens and optional source-IP limits. Tokens are shown once and stored hashed, and writes pass the same checks as the panel. Every API write is logged in Activity

In your client portal

• Customers reach their DNS page from My Tools in the client portal menu, and a zone's pages by tabs
• The page saves changes and its links work in Blesta's own client portal theme

What your customers get

• Their own zones, and only theirs. A customer sees and changes only zones bound to their account. This is enforced on the server, not just hidden in the page
• The same editor your team uses. Add, edit and delete records in their own zones with the validating, type-aware form, written straight to the provider
• Snapshots they control. With client backups on, customers snapshot their zone, download any snapshot and restore one, with a safety snapshot first. Turn it off to keep backups admin-only
• One-click set-ups. Quick set-ups add the records Google Workspace or Microsoft 365 needs, or an SPF lockdown, without changing anything already there
• Read-only where you say so. A locked zone is view-only, and for a domain with no hosting here you choose full editing, view only or hidden
• DNSSEC for their own zone. A customer can turn DNSSEC on or off and copy the DS record, except on a zone you have locked or a domain-only zone you set to view only or hidden

Every customer string is translatable, and wording overrides survive updates.

Security built in

• Azure credentials are stored encrypted, with tamper-evident encryption, in your Blesta database and are never shown back in the provider form.
• The stored credential is used only to read and update zones and records in the connected account.
• Credentials never reach a customer-facing page, and customers' DNS pages and emails never name the backend that serves their DNS.
• To rotate a credential, edit the provider, enter the new one, test and save. The old one can then be revoked with nothing else to change.
• Content policy: blocked patterns and IP allow and deny lists refuse matching customer saves; admin changes are never restricted

One product, every feature

PD Azure DNS is one paid module with everything included: zones, records, backups, templates, packages, auto-provisioning, the API and customer self-service. There are no add-on tiers to compare, and beyond the subscription there is no per-zone, per-seat or per-unit fee. It installs into PD Modules in one click, adds its own tables and templates, modifies no Blesta files, and removes everything on uninstall.

Your customers are not cut off if your subscription lapses. DNS records are never touched and the provider keeps serving your zones. Admin management locks first while customers keep their own self-service; customer management stops later behind a neutral "temporarily unavailable" message, and renewing restores everything.

Requirements

• Blesta 6 or later on PHP 8.2 or later, with the ionCube Loader
• An Azure subscription to hold your DNS zones
• PD Modules, the free control panel every PD module installs into