DNS providers

DNS providers (/connect/dns) is where you connect a DNS host to your MZPanel account. Connect once here and every server and site in your fleet can read and write DNS records and issue wildcard certificates — no per-box setup. Cloudflare is the one supported provider, and the connection lives on the control plane, never on a VPS.

Connect Cloudflare, step by step

Click Connect Cloudflare (top-right, or the Cloudflare card lower down).
In your Cloudflare dashboard, create an API token with the Edit zone DNS template. Minimum scope: Zone · DNS · Edit (plus Zone · Read).
Pick the zone(s) MZPanel should manage, then create the token.
Back in the Connect Cloudflare drawer, paste the token into API token. Add an optional Label (e.g. [email protected]) to tell multiple accounts apart.
Click Verify & connect. MZPanel validates the token against Cloudflare, discovers the zones it can reach, and shows Verified — found N zones. The drawer closes and the account appears under Connected accounts.

The token is encrypted at rest with AES-256-GCM — only the last 4 characters stay readable, and the token is never copied to any of your servers.

What else you can do

Connected accounts — each connection shows its status dot (Connected / Auth failed), masked token (••••last4), when it was connected, last used, and the list of zones it manages (green dot = active zone).
Rename — click the pencil next to a connection’s label to give it a friendly name.
Re-verify — re-check the token against Cloudflare and refresh the zone list. Use this after adding a zone in Cloudflare, or if a connection flips to Auth failed.
Revoke — remove the token from MZPanel. Existing DNS records stay at Cloudflare, but MZPanel stops managing records, SSL renewals, and mail for those zones until you reconnect.
On another registrar? — the second card links Cloudflare’s step-by-step guide for moving your nameservers to a free Cloudflare account, then connecting a token here.
Wildcard certificates — once a zone is connected, a Wildcard certificates panel appears. See Issue a wildcard certificate below.

Issue a wildcard certificate

With a Cloudflare zone connected, click Issue wildcard in the Wildcard certificates panel to get a *.domain + apex certificate validated over DNS-01:

Pick the Server that will run the ACME flow and hold the private key.
Enter the Domain (the apex — the cert covers *.example.com and example.com).
Click Issue certificate. It takes ~15–40s.

The private key is generated on the server and never leaves it; the Cloudflare token never leaves MZPanel. The cert auto-renews before expiry, and any subdomain site you later create on that server reuses it automatically — instant HTTPS with no per-site cert. Each row shows the covered domain, server, expiry countdown (it warns under 30 days), and a Stop tracking action that halts auto-renew.

How it works

This page is control-plane only — it drives the /v1/dns/* API, not an agent job:

Action	API route	What happens
List	`GET /v1/dns/connections`	Returns the org’s connections, token masked
Connect	`POST /v1/dns/connections`	Lists zones (which also verifies the token), stores it encrypted, saves the zone list
Re-verify	`POST /v1/dns/connections/:id/verify`	Re-lists zones, refreshes the cache, flips status
Rename	`PATCH /v1/dns/connections/:id`	Updates the display label
Revoke	`DELETE /v1/dns/connections/:id`	Deletes the connection + token
Issue wildcard	`POST /v1/dns/wildcard-cert`	Box makes a CSR, control plane answers DNS-01 via your Cloudflare token, box installs the chain

The scoped token is encrypted (AES-256-GCM) and stored on the control plane. When a site or server needs DNS — reading records on the DNS & TLS tab, creating records, issuing a wildcard cert, or purging Cloudflare’s edge cache from the Cache manager — MZPanel looks up which connected zone owns the domain, decrypts the token in memory, and calls the Cloudflare API directly. Your VPS never sees the token.

Wildcard certs are tracked in the control plane (status, expiry, owning server) so the account-level panel and per-server SSL tools stay in sync.

API & automation

This is an account-level control-plane feature, so the on-box mz CLI does not apply. Manage connections and issue wildcard certificates programmatically through the REST API (Max plan) — the same /v1/dns/* routes the dashboard uses. See the API reference.

Gotchas & troubleshooting

Live and real. The Cloudflare connection is not a mock — the token is verified against Cloudflare’s API on connect and stored encrypted (AES-256-GCM).
Owner-only for connecting. Only the account owner (or a role with the integrations capability) can connect, re-verify, rename, or revoke a provider. Other infra roles can still read the connection list and manage records for zones that are already connected.
“Auth failed” means the token changed at Cloudflare. If you revoked or edited the token in Cloudflare, the connection flips to Auth failed. Create a fresh Edit zone DNS token and connect it again.
A newly added Cloudflare zone won’t appear until you re-verify. MZPanel caches the zone list at connect time; click Re-verify to pick up zones you added to the token afterward.
Wildcard issuance needs a managed (agent) server. The Issue wildcard picker only lists online, non-suspended agent servers — the box runs the ACME flow and holds the key. SSH-only (Lite) servers can’t issue wildcards here.
The domain must be on a connected zone. Wildcard issuance and record management fail with “no connected zone” if the domain isn’t covered by one of your Cloudflare tokens.
Revoking is safe for existing records. Revoke removes the token from MZPanel only; records already at Cloudflare are untouched. Automation (SSL renewals, mail records) just stops until you reconnect.

DNS & TLS records — manage records for a connected zone, per server.
SSL certificates — per-site HTTPS, including wildcard reuse.
Team & roles — who can connect providers and manage DNS.
API reference — automate DNS from the control plane.