Two-Layer DNS Architecture

Cloudflare for global DNS, Kubernetes CRD for state management

Cloudflare Integration

Store your Cloudflare API tokens securely (encrypted). Create and manage DNS zones through Cloudflare's global Anycast network. Manage records with proxy toggle and TTL configuration.

  • Encrypted API token storage
  • Zone creation and deletion
  • Record CRUD with proxy toggle
  • Cloudflare DDoS protection

Kubernetes DNSZone CRD

Each domain's DNS is tracked as a Kubernetes Custom Resource. The operator syncs records to Cloudflare and tracks sync status, zone ID, and nameservers.

  • DNSZone CRD per domain
  • Operator-synced to Cloudflare
  • Status tracking (phase, lastSyncedAt)
  • Alias DNS support

Supported Record Types

Full record management from the dashboard

A AAAA CNAME TXT MX NS SRV CAA

Automatic Records

When a domain is created with email enabled, KubePanel automatically creates DKIM TXT records, SPF records, DMARC records, and MX records pointing to the mail server.

Domain Alias DNS

Each domain alias gets its own DNSZone CRD with independent record management. Email-enabled aliases get their own DKIM keys and DNS records.

Bulk Operations

Select multiple records and delete them in one action. Cleanup zones efficiently when migrating or decommissioning domains.

DNS on Cloudflare's Global Network

Anycast DNS with built-in DDoS protection. Managed from your KubePanel dashboard.