DNS & TLS

DNS and TLS are two halves of one job: get a domain served safely by this server. The A record has to point correctly → validation can reach the host → the certificate issues → HTTPS works. MZPanel keeps both on one DNS & TLS section per server (/servers/:id/dns-tls), so the most common support problem — “SSL won’t issue / the site won’t load,” almost always a DNS mistake — is visible in one place. Certificate issuing works on all plans; writing DNS records needs a connected Cloudflare token (Plus), and running your own nameservers needs the BIND9 extension (Pro).

The section has two tabs in its toolbar: DNS & TLS (the per-domain view, default) and zoneDNS (authoritative BIND9 zones on this box).

Issue or renew a certificate, step by step

1. On the DNS & TLS tab, find the domain’s row and click Manage to open its drawer. It opens on the Certificate tab.
2. Read the recommended strategy banner at the top — it’s derived from the domain’s live DNS. DNS-only → Let’s Encrypt (HTTP-01); proxied through Cloudflare → a Cloudflare Origin Certificate; not pointing here yet → “point the A record here first.”
3. If there’s no certificate yet, click Issue certificate. If one exists, use Renew now (Let’s Encrypt) or Re-issue (auto) (self-signed / Origin) — the button auto-detects the right method from the domain’s DNS.
4. For Let’s Encrypt certificates, toggle Enable / Disable auto-renew. The row updates in place with the new status, issuer and expiry.

Tip

You don’t have to open the drawer for each domain. Select rows on the list and use the floating dock’s Renew SSL to issue/renew a whole batch at once.

What else you can do

• Scan the fleet at a glance. Each row pairs a live DNS verdict (Proxied via Cloudflare, Direct to IP — exposed, Points elsewhere, or No A record) with a SSL/TLS status (Valid, Expiring, Expired, No cert), the certificate’s days remaining and auto-renew state.
• Filter by All domains, On Cloudflare (proxied), IP exposed (direct), Misconfigured DNS, or SSL needs attention — and search by domain name.
• Force HTTPS — the per-row HTTPS toggle turns on the HTTP → HTTPS redirect in the site’s vhost (available once a certificate exists).
• Toggle the Cloudflare proxy — the per-row Proxy switch flips a domain between proxied (orange cloud, IP hidden) and DNS-only (grey), when a Cloudflare token owns the zone.
• Bulk actions — select multiple domains and the floating dock offers Renew SSL and a Proxy & HTTPS popover that pushes proxy-on/off and force-HTTPS on/off to every selected domain.
• Edit DNS records — the DNS records tab of the Manage drawer shows the live dig resolution, and, when Cloudflare is connected, a full record editor (add/edit/delete A/AAAA/CNAME/MX/TXT/SRV/CAA/NS and more, proxy toggle, TTL, and a one-click Point here).
• Install a custom or paid certificate — the Advanced panel on the Certificate tab offers a Cloudflare Origin Certificate, Upload a certificate (paste your own cert + key), or Buy a certificate (generate a CSR on the box, buy from any CA, paste the signed cert back — the private key never leaves the server).
• Run your own nameservers — the zoneDNS tab manages authoritative BIND9 zones (see below).

How it works

The DNS & TLS tab joins three data sources per domain:

Signal	Where it comes from
Domain list	the agent-pushed sites inventory (instant, works offline)
Certificate status	the agent-pushed ssl inventory (issuer, expiry, days left, auto-renew, HTTPS redirect)
Live DNS health	a dns.lookup job per domain — the agent shells to dig and reports A/AAAA/CNAME/MX/TXT/NS, whether it resolves to this server, and whether Cloudflare is proxying

Certificate actions dispatch ssl.* jobs to the agent, which runs them natively:

Action	Job	Agent runs
Issue	ssl.issue	ssl issue <domain> (Let’s Encrypt / origin / self-signed, auto-picked)
Renew / re-issue	ssl.renew	ssl renew <domain>
Delete	ssl.delete	removes the certificate, site falls back to HTTP
Auto-renew on/off	ssl.auto-renew	toggles the certbot renewal for that domain
Force HTTPS	ssl.https-redirect	adds/removes the return 301 HTTPS redirect in the vhost

Cloudflare record editing is different — it runs on the control plane, not the agent. MZPanel needs a scoped Cloudflare API token, connected once at the account level; it’s verified against the Cloudflare API and stored encrypted on the control plane and never sent to your VPS. Record CRUD, the proxy toggle, Origin Certificates and CSR/paste flows all go control plane → Cloudflare API (or control plane → agent for installing the finished cert). dig alone is read-only (“what the world sees”), which is why writes need the token.

The zoneDNS tab drives dns.* jobs against BIND9 running on the box: dns.status (is BIND9 installed, which nameservers), dns.ns-set (set your nameserver hostnames), dns.zone-list / zone-create / zone-delete, dns.record-list / record-add / record-del, dns.reload, and dns.sync (scan site domains and auto-create zones for any now delegated here). Zone state is served from the agent-pushed dns inventory snapshot, so the list loads instantly; every zone is validated with named-checkzone before a reload, so a broken zone never loads.

CLI & automation

Every box-native action here maps to an mz command — the same engine the dashboard drives. SSH into the server and run them directly, or let an on-box AI (ClaudeCode) run them:

mz dns example.com --json                    # live dig health for a domain
mz ssl issue example.com --json              # issue a certificate
mz ssl renew example.com --json              # renew / re-issue
mz ssl auto-renew example.com on --json      # toggle Let's Encrypt auto-renew

Authoritative BIND9 zones (zoneDNS tab) use the mz dns sub-commands:

mz dns zone-list --json                      # zones served by BIND9 on this box
mz dns record-add example.com --name @ --type A --value 1.2.3.4 --json

Note

Cloudflare record edits, proxy toggles and Origin Certificates are not mz commands — they run on the control plane against the Cloudflare API. Only the dig health check, ssl.* certificate actions and the BIND9 dns zone commands run on the box.

See The mz CLI and the command catalog.

Gotchas & troubleshooting

• Writing records needs a connected Cloudflare token. Without one, the DNS records tab is read-only — it shows the dig view and tells you exactly which A record to create at your provider. Connect a scoped token (minimum Zone.DNS:Edit + Zone.Zone:Read; add SSL and Certificates: Edit for Origin Certificates) under DNS providers — never the Global API Key.
• “Direct to IP — exposed” is a caution, not an error. A bare A record pointing straight at the server’s public IP works, but it exposes the origin. Enabling the Cloudflare proxy (orange cloud) hides it. Only the proxied state shows green.
• Force HTTPS needs a certificate first. The HTTPS toggle is disabled until a certificate exists — issue one, then turn on the redirect.
• Auto-renew is Let’s Encrypt-only. Self-signed and Cloudflare Origin certificates don’t renew via certbot; there’s no toggle for them, and “Re-issue (auto)” simply re-creates the cert.
• Live signals need the agent online. The domain list and certificate status render from the last cached snapshot when the server is offline, but dig lookups and every issue/renew/toggle action need a live agent.
• BIND9 is a single point of failure. Running one authoritative nameserver on one VPS means the whole domain’s DNS — web, mail and every subdomain — goes down if that box does. Proper authoritative DNS wants at least two nameservers on separate networks. The nameservers drawer says so up front; use it only if you specifically want vanity nameservers. You provide the nameserver hostnames and create the glue records at your registrar — MZPanel is not a DNS registrar.
• zoneDNS is gated on setup, not a mock. The BIND9 tab is fully live: it prompts to install the bind9 extension inline (streamed), then to set your nameservers, before showing zones. A zone auto-creates only for a domain whose nameservers point here; if you delegated after creating the site, hit Sync.

Related

• DNS providers — connect a Cloudflare token for record editing and automated SSL.
• Sites on a server — the domains that show up here.
• The mz CLI — driving the box from the command line.