PD PowerDNS for Blesta

PD PowerDNS lets a hosting company manage its own PowerDNS authoritative servers from Blesta. Connect a server once through its HTTP API and every zone on it appears in your admin area with no import. DNSSEC is one button, and your customers edit their own records from your client portal without any access to the server.

It is built for hosts who run PowerDNS and want a control panel for it that their team and their customers can both use, with zone allowances they can sell.

Why hosts choose PD PowerDNS

DNSSEC in one click. Sign a zone, see the DS record for each key ready to copy to the registrar, and turn signing off just as easily. Customers can manage DNSSEC on their own zones.

Records written the way PowerDNS expects. PowerDNS's API works on whole record sets. The module writes them as whole sets without dropping the other values at the same name and type.

Reverse DNS included. Add an IP range, map addresses to hostnames, and each PTR record is written to the matching reverse zone.

Customers help themselves. Customers add, edit and delete their own records, turn on DNSSEC and restore their own snapshots.

How it works

1. Enable the API. In your PowerDNS configuration, switch on the HTTP API with a key, and allow your Blesta server to reach it.
2. Add the provider. Enter the server's API address and key in Providers and press Test connection. Your zones appear straight away.
3. Link zones to clients. Assign zones with the client picker, or press Track matched zones to bind every zone that matches an active domain or service.
4. Sell and support it. Link DNS packages to your Blesta packages to set zone allowances, switch on auto-provisioning for new domains, and let customers manage their own records.

What you get in Blesta

Connecting and zones

• Add a PowerDNS server from Providers with its API address and key; Test connection says whether the module can reach it, and what to fix when it cannot
• More than one PowerDNS server can be connected; secondary zones can be created from master IPs and are read-only
• Every zone is listed with no import or sync step, read live from your PowerDNS server; changes are written straight back and the module keeps no copy of your records
• Server-side paging, search and sort keep the list fast with thousands of zones; narrow it by name, provider, status or client
• Track matched zones binds every zone matching an active domain or service to its client in one step, changing nothing at the provider
• Lock a zone against the client's own changes; admins keep full control and the client keeps read access

Records

• A type-aware editor that shows only the fields the type uses: priority and mail server for MX, priority, weight, port and target for SRV, flags, tag and value for CAA
• Addresses and hostnames are checked before saving, so a malformed record never reaches the provider. Search by name or value and filter by type
• Export a zone as a BIND zone file. Import adds only missing records and shows how many before it writes anything
• DNSSEC per zone with one button on the Records page; with it on, the DS record for each key is shown copy-ready for the registrar
• Records are written as whole record sets, as PowerDNS's API requires, without dropping other values at the same name and type

Selling DNS with your Blesta packages

• Zone allowances: a DNS package caps how many zones a customer may have and is linked to your Blesta packages; the largest allowance wins
• Record limits per zone and per record type, held in the customer's editor, imports, templates and the API
• Templates: apply a named set of records to any zone in one click, with merge fields such as {domain}, {ns1} and {ip}; applying twice is safe
• Auto-provision, off until you switch it on: a zone is created and bound to the client when a domain is registered, transferred or set up with a service. A failure is logged and never interrupts the order
• TLD takeover: for the extensions you choose, a newly registered or transferred domain also gets its nameservers pointed at your PowerDNS server
• Reverse DNS: add an IP range, then map addresses to hostnames; each PTR is written to the matching reverse zone

Running it day to day

• Backups on by default: every zone is snapshotted as a BIND zone file each 24 hours, keeping the newest 10, with settings for both and an optional age cap. Back up one zone or all on demand
• Restore makes a zone match a snapshot exactly, after a safety snapshot; a zone deleted by mistake is recovered with every record
• Optional emails, off until you turn them on: admin alerts for drift or a failed backup, and customer notices when a zone is created, removed or changed by staff
• A REST API with named read or write tokens and optional source-IP limits. Tokens are shown once and stored hashed, and writes pass the same checks as the panel. Every API write is logged in Activity

In your client portal

• Customers reach their DNS page from My Tools in the client portal menu, and a zone's pages by tabs
• The page saves changes and its links work in Blesta's own client portal theme

What your customers get

• Their own zones, and only theirs. A customer sees and changes only zones bound to their account. This is enforced on the server, not just hidden in the page
• The same editor your team uses. Add, edit and delete records in their own zones with the validating, type-aware form, written straight to the provider
• Snapshots they control. With client backups on, customers snapshot their zone, download any snapshot and restore one, with a safety snapshot first. Turn it off to keep backups admin-only
• One-click set-ups. Quick set-ups add the records Google Workspace or Microsoft 365 needs, or an SPF lockdown, without changing anything already there
• Read-only where you say so. A locked zone is view-only, and for a domain with no hosting here you choose full editing, view only or hidden
• DNSSEC for their own zone. A customer can turn DNSSEC on or off and copy the DS record, except on a zone you have locked or a domain-only zone you set to view only or hidden

Every customer string is translatable, and wording overrides survive updates.

Security built in

• The API key is stored encrypted, with tamper-evident encryption, in your Blesta database and is never shown back in the provider form.
• PowerDNS has no scoped keys: one API key controls every zone on that server. The docs say so, and how to fence it with webserver-allow-from, a firewall or a dedicated instance.
• The stored credential is used only to read and update zones and records on the connected server.
• Credentials never reach a customer-facing page, and customers' DNS pages and emails never name the backend that serves their DNS.
• Content policy: blocked patterns and IP allow and deny lists refuse matching customer saves; admin changes are never restricted

One product, every feature

PD PowerDNS is one paid module with everything included: zones, records, backups, templates, packages, auto-provisioning, the API and customer self-service. There are no add-on tiers to compare, and beyond the subscription there is no per-zone, per-seat or per-unit fee. It installs into PD Modules in one click, adds its own tables and templates, modifies no Blesta files, and removes everything on uninstall.

Your customers are not cut off if your subscription lapses. DNS records are never touched and the provider keeps serving your zones. Admin management locks first while customers keep their own self-service; customer management stops later behind a neutral "temporarily unavailable" message, and renewing restores everything.

Requirements

• Blesta 6 or later on PHP 8.2 or later, with the ionCube Loader
• A PowerDNS authoritative server with its HTTP API enabled and reachable from your server
• PD Modules, the free control panel every PD module installs into