DNS zone editor
The editor opens from Manage → DNS & rDNS, Manage DNS button on the domain row (or View zone for a cPanel zone). It is available as soon as the zone exists and belongs to you, whether the domain already points to YorkHost or not (Zone ready — point the NS state, see domain states).
At the top: the number of records, the zone serial and the DNSSEC state. The record list can be filtered by Type and by search.
Add a record
Add a record card:
- Type: the record type; the fields adapt to it.
- Name:
@for the domain itself, or a subdomain (www,mail,_dmarc…). A full name inside the zone (www.example.com) is accepted too. - TTL (seconds): cache duration, from 60 to 604800. Left empty, the default TTL is used.
Targets (CNAME, MX, SRV, NS…) are written as full names: mail.example.com, example.com, or @ for the domain itself.
Types and examples
The examples use the example.com zone.
| Type | Fields | Example |
|---|---|---|
| A | Value (IPv4) | @ → 192.0.2.10; www → 192.0.2.10 |
| AAAA | Value (IPv6) | @ → 2001:db8::10 |
| CNAME | Value (target name) | blog → mysite.some-host.com |
| ALIAS | Value (target name) | @ → mysite.some-host.com (alias at the root, where a CNAME is not allowed) |
| MX | Priority, Target | @ → priority 10, target mail.example.com |
| TXT | Value (text) | see SPF, DKIM and DMARC |
| SRV | Priority, Weight, Port, Target | _sip._tcp → 10 5 5060 sip.example.com |
| CAA | Flags, Tag (issue, issuewild, iodef), Value | @ → 0 issue letsencrypt.org |
| TLSA | Usage, Selector, Matching type, Data (hexadecimal) | _443._tcp.www → 3 1 1 <SHA-256 fingerprint, 64 hex characters> |
| NS | Value | dev → ns1.other-provider.net (delegation of a subdomain; the NS of the domain itself is protected) |
| SSHFP | Algorithm, Fingerprint type, Fingerprint | server → 4 2 <SHA-256 fingerprint> (output of ssh-keygen -r) |
| PTR, NAPTR | Value; Order, Preference, Flags, Service, Regular expression, Replacement | advanced uses |
| DS | Key tag, Algorithm, Digest type, Digest | for a delegated subdomain signed with DNSSEC (never on @) |
Rules to know:
- A CNAME is not allowed on
@(use ALIAS, or A / AAAA) and cannot coexist with another record of the same name. - SRV and TLSA: the name looks like
_service._protocol(for example_sip._tcp,_443._tcp), optionally followed by a subdomain. - CAA
iodef: the value is amailto:address or anhttps://URL. - A wildcard name
*is accepted, except for NS, DS, SRV and TLSA. - The number of records per zone is capped: beyond it, "Maximum number of records reached for this zone."
SPF, DKIM and DMARC
Enter the value without quotes. Long values (DKIM key…) are split automatically.
| Use | Type | Name | Value (example) |
|---|---|---|---|
| SPF | TXT | @ | v=spf1 mx include:_spf.google.com ~all |
| DKIM | TXT | selector._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqh… (given by your e-mail service) |
| DKIM through CNAME | CNAME | selector._domainkey | the target given by your provider |
| DMARC | TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com |
| Domain verification | TXT | @ | google-site-verification=… |
A domain must have only one SPF record (v=spf1…): merge the include: parts into a single value.
Protected records: NS and SOA
The SOA and the name servers (NS) of the domain itself are managed by YorkHost. They are marked Protected ("Managed by YorkHost (SOA, zone name servers)."): they cannot be changed or deleted, and an import ignores them. Any attempt returns "This record is managed by YorkHost and cannot be changed."
To use other name servers, change them at the registrar: the YorkHost zone will then no longer be used.
Edit or delete
Each row has Edit and Delete buttons (with confirmation). Deleting an A, MX or CNAME record can take a website or a mailbox offline: check first.
TTL
The TTL tells resolvers how long they keep the answer in cache. A change is immediate on the YorkHost servers, but a resolver that already cached the answer keeps it until its TTL expires. Before a migration (new website IP, new mail server), lower the TTL of the records involved a few hours in advance (for example 300), then raise it again once the migration is done.
E-mail templates
The E-mail templates card adds in one click the MX and SPF records of a mail provider:
| Template | Records added |
|---|---|
| Google Workspace | MX 1 smtp.google.com; TXT v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | MX 0 <your-domain-with-dashes>.mail.protection.outlook.com; TXT v=spf1 include:spf.protection.outlook.com -all; CNAME autodiscover → autodiscover.outlook.com |
| Zoho Mail (EU) | MX 10 mx.zoho.eu, 20 mx2.zoho.eu, 50 mx3.zoho.eu; TXT v=spf1 include:zohomail.eu ~all |
| Proton Mail | MX 10 mail.protonmail.ch, 20 mailsec.protonmail.ch; TXT v=spf1 include:_spf.protonmail.ch ~all |
| OVHcloud (MX Plan) | MX 1 mx1.mail.ovh.net, 5 mx2.mail.ovh.net, 100 mx3.mail.ovh.net; TXT v=spf1 include:mx.ovh.com ~all |
For Microsoft 365, <your-domain-with-dashes> is replaced by the domain name with dots changed to dashes (example-com).
Applying a template replaces the MX records of the domain and its SPF record. Other TXT records (verifications, DKIM, DMARC…) are kept. Check the zone afterwards.
Templates add neither DKIM nor DMARC: these values are specific to your account at the provider. Add them by hand (see SPF, DKIM and DMARC).
BIND import / export
Import / export card:
- Export → Download the zone: text file in BIND format. Do it before a large change, as a backup.
- Import: paste records in BIND format, one record per line, then Import.
- Accepted:
$ORIGIN,$TTL,@, relative names, optionalINclass,;comments and multi-line records between parentheses. - The SOA and the zone name servers are ignored, as are types that are not allowed, invalid lines and names outside the zone. Skipped lines are listed after the import.
- By default, imported values are added to the existing ones. Tick Replace existing records with the same name and type so that each imported group (name + type) replaces the existing one.
- 256 KB of content max.
- Accepted:
Example:
$TTL 3600
@ IN A 192.0.2.10
www A 192.0.2.10
@ MX 10 mail.example.com.
mail A 192.0.2.20
@ TXT "v=spf1 mx ~all"
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
DNSSEC
DNSSEC signs DNS answers so they cannot be forged.
- In the DNSSEC card, click Enable DNSSEC. The zone is signed.
- The card shows the DS record to set (key tag, algorithm, digest type, digest) and the public key (DNSKEY).
- Copy these values into the DNSSEC section of your registrar. Until the DS is set there, DNSSEC does not actually protect the domain.
Remove the DS record at your registrar first, then click Disable. If the zone is no longer signed while the DS is still published, the domain stops resolving for validating resolvers.
Zones hosted on cPanel: read-only
If the domain is used on a cPanel web hosting, its zone is managed by cPanel: it carries the cPanel hosting — read-only badge and the editor shows "This zone is managed by your cPanel web hosting: it is shown read-only."
Edit your records in the cPanel Zone Editor (Domains section): they are copied automatically to DNS & rDNS. See also Configure a domain name.
Delete the zone
When the zone can be deleted from the client area, the Delete the zone card shows at the bottom of the page: it removes the zone and all its records from the YorkHost name servers (confirmation required). If the domain still uses ns1.yorkdns.com and ns2.yorkdns.com, it stops resolving.
If the card is not shown (cPanel zone in particular), the zone cannot be deleted from the client area: contact support.