DNS and FTP settings – Administrator Guide

StackRegent serves DNS with the Microsoft DNS Server and FTP with the Microsoft FTP Service (IIS FTP). Both are installed under Tools & Settings › Server Components. This article covers the server-wide settings of both, which live under Tools & Settings › General Settings and Security.

DNS Settings#

Go to Tools & Settings › DNS Settings. If the DNS Server role is not installed, the page says so and links to Server Components. The role is installed with recursion switched off, so it answers only for hosted zones and is not an open resolver.

The page has five tabs.

Zone Records Template#

The records every new zone gets. The default template has:

Host	Type	Value
`<domain>`	A	`<ip>`
`<domain>`	AAAA	`<ipv6>`
`www.<domain>`	CNAME	`<domain>`
`mail.<domain>`, `webmail.<domain>`	A	`<ip>`
`ftp.<domain>`	CNAME	`<domain>`
`ns1.<domain>`, `ns2.<domain>`	A	`<ip>`
`<domain>`	NS	`ns1.<domain>`, `ns2.<domain>`
`<domain>`	MX	10 `mail.<domain>`
`<domain>`	TXT	`v=spf1 +a +mx -all`
`_dmarc.<domain>`	TXT	`v=DMARC1; p=none`

Placeholders are <domain>, <ip> (the subscription's IPv4 address), <ipv6> and <hostname> (this server). Rows whose placeholder has no value are skipped, so the AAAA record is left out when a subscription has no IPv6 address.

Add Record adds a row. Record types are A, AAAA, CNAME, MX, NS, TXT, SRV, CAA and PTR.
Edit changes a row; the remove button deletes it. Each change is saved at once and applies to new domains.
Apply to All Zones rebuilds every primary zone on the server from the template. Records customers added are lost, so use it with care.
Restore Defaults returns the template to StackRegent's default records. Existing zones do not change.

SOA Records Template#

The SOA values new zones get, in seconds:

Field	Default
Default TTL	86400
Refresh	10800
Retry	3600
Expire	604800
Minimum (negative caching) TTL	10800

Also set Administrator email (empty: hostmaster@ the zone) and Serial number format: YYYYMMDDnn (recommended) or Unix time stamp. Click Save.

Each website's own DNS Settings tool has an SOA Record button to change one zone's values.

Transfer Restrictions#

List the IP addresses of secondary name servers, one per line. They may copy every zone and are notified of changes. Leave the list empty to refuse all zone transfers. Click Save; the zones are updated.

Zones#

All zones on the server with type, serial and state. Write All Zones Again writes every zone to the DNS Server again.

Server-wide Settings#

Setting	Options
Recursive DNS	Off: answer only for hosted zones; This server and the networks below; Everyone (open resolver, not recommended)
Networks	With the second option: IP addresses or networks allowed to use recursion, one per line. This server always may.
Forwarders	DNS servers recursive queries are sent to, one IP address per line. Empty uses the root servers.

Click Apply.

Per-domain DNS#

Each website has a DNS Settings tool with Add Record, SOA Record, DNS Service (primary, secondary with a primary server IP, or off) and Reset to Default, which replaces the zone's records with the template.

Subzones#

To stop customers creating a domain inside another customer's zone, use Tools & Settings › Restrict Creation of Subzones or the DNS subzones option in Server Settings.

FTP Settings#

Go to Tools & Settings › FTP Settings. These are the settings of the server's FTP site, which every subscription logs in to. With user isolation, each subscription user lands in its own webspace. If the FTP server is not installed, the page says so; the settings apply as soon as it is.

Passive mode#

Set Passive port range, the lowest and highest port for data connections (default 49152 to 65535).
If the server sits behind NAT, enter External IP address, the public address passive replies announce. Leave it empty otherwise.

StackRegent opens the passive range in Windows Firewall as a fixed rule, because with FTPS the firewall's FTP helper cannot read the encrypted control connection. Open the same range in any external firewall.

Encryption#

FTP over TLS (FTPS): Allow (clients choose plain FTP or FTPS) or Require (refuse logins without TLS, so passwords are never sent in clear text). The same choice appears in Security Policy.
Certificate: the certificate FTPS and Web Deploy (port 8172) present: Same as the panel, or a certificate from the server pool. Without one, a self-signed certificate is made on first use.

Messages#

Welcome message is shown before login. Leave it empty to show nothing about the server software.

Click Save; the FTP server is updated.

FTP accounts themselves are created per subscription, under the subscription's FTP Access page.

Active FTP Sessions#

Tools & Settings › Active FTP Sessions shows who is connected right now: user, address, connected since, last command, bytes sent and received, and the FTP site. The list refreshes every 15 seconds; click Refresh to update it at once. Click Close to end a session.

Troubleshooting#

Problem	What to do
Zones are kept but not served	Install Microsoft DNS Server under Server Components.
A zone shows an error state	Open Zones and click Write All Zones Again.
Secondary server cannot transfer	Add its IP address under Transfer Restrictions.
FTP login works but listings hang	Open the passive port range in every firewall; behind NAT, set External IP address.
FTP clients warn about the certificate	Choose a pool certificate that covers the FTP host name under Certificate.
Clients cannot log in after Require	Turn on FTP over TLS in the FTP program, or switch back to Allow.

Security (firewall, certificates, IP banning)
Server components
Mail server