1 of 5

Tutorials

The tutorial guides you through the commonly referred topics in the Cloud DNS:

ExternalDNS: Cloud DNS offers ExternalDNS integration that makes Kubernetes resources discoverable via the public DNS servers. For more information, see tutorial.

Set Up a Secondary Zone: Guides you through how to set up a primary zone in IONOS Cloud Dedicated Core server and a secondary zone with Cloud DNS. For more information, see tutorial.

Enhance Email Deliverability with a Reverse DNS, SPF, and DKIM Record: Guides you through creating a reverse DNS, SPF, and DKIM record for your domain name. For more information, see tutorial.

Issue TLS Certificates using IONOS Cloud Certbot Plugin: Guides you through creating TLS certificates using the IONOS Cloud Certbot Plugin. For more information, see tutorial.

ExternalDNS for Managed Kubernetes

ExternalDNS Overview

ExternalDNS is an open-source tool that automates the management of public DNS records for Kubernetes resources such as services and ingresses, that are publicly exposed outside the cluster.

The ExternalDNS solution offers the following capabilities:

Control to developers to manage DNS resources that are usually managed manually by third teams. Example: Infrastructure team.
Ensures that the DNS records are always up-to-date with the current state of the Kubernetes cluster.
Manages a large number of records automatedly.
Simplifies the management of DNS records with improved security.

Deployment of ExternalDNS on Managed Kubernetes

Prerequisites: Ensure that you have the following before you begin:

A domain name that is registered with your domain provider aka Registrar or a subdomain under your control.
A token from a user with privileges to manage zones and records with Cloud DNS.
An IONOS Managed Kubernetes cluster.
The kubectl installed on your local machine.
The Helm tool for installing a Helm chart.

Follow these steps to set up ExternalDNS for your Managed Kubernetes with IONOS DNS Provider Cloud DNS:

Prepare domain name: You need to first Create a DNS Zone for your domain name with Cloud DNS and then Connect Domain Name to Cloud DNS.
Add Helm chart: Add the Bitnami Helm repository, which contains the official external-dns Helm chart.

helm repo add bitnami https://charts.bitnami.com/bitnami

Create configuration: Create values file for ExternalDNS Helm chart that includes the plugin configuration. In this example, the values file is called external-dns-ionos-values.yaml.

# OCI image of ExternalDNS that contains the plugin provider feature
image:
  registry: ghcr.io
  repository: ionos-cloud/external-dns-plugin-provider
  tag: latest

# Modify how DNS records are synchronised between sources and providers (default: sync, options: sync, upsert-only, create-only)
policy: sync

# provider needs to be set to plugin
provider: plugin

# url of the provider which the external-dns will target
extraArgs:
  plugin-provider-url: http://localhost:8888

# plugin is deployed as sidecar
sidecars:
  - name: ionos-plugin
    image: ghcr.io/ionos-cloud/external-dns-ionos-plugin:latest
    ports:
      - containerPort: 8888
        name: http
    livenessProbe:
      httpGet:
        path: /health
        port: http
      initialDelaySeconds: 10
      timeoutSeconds: 5
    readinessProbe:
      httpGet:
        path: /health
        port: http
      initialDelaySeconds: 10
      timeoutSeconds: 5
    env:
      # Set port of plugin (value needs to match the container port and plugin provider url port, default value: 8888)
      - name: SERVER_PORT
        value: "8888"
      # Listen on all interfaces for kubernetes probes
      - name: SERVER_HOST
        value: ""
      # Limit possible target zones by a domain suffix (optional)
      - name: DOMAIN_FILTER
        value: "example1.com,example2.com"
      # Exclude subdomains (optional)
      - name: EXCLUDE_DOMAIN_FILTER
        value: "example3.com"
      # Limit possible domains and target zones by a Regex filter. Overrides domain-filter (optional)
      - name: REGEXP_DOMAIN_FILTER
        value: ".*.example4.com"
      # Regex filter that excludes domains and target zones matched by regex-domain-filter (optional)
      - name: REGEXP_DOMAIN_FILTER_EXCLUSION
        value: ".*.example5.com"
      # When enabled, prints DNS record changes rather than actually performing them (default: false)
      - name: DRY_RUN
        value: "true"         
      # Token for DNSaaS rest API authentication (mandatory)  
      - name: IONOS_API_KEY
        value: "21215454"
      - name: LOG_LEVEL
        value: debug
      # When enabled debug logs for the DNSaaS rest API are enabled (default: false)  
      - name: IONOS_DEBUG
        value: "true"

Install ExternalDNS: To install ExternalDNS with Bitnami Helm chart, use the following commad:

helm install external-dns-ionos bitnami/external-dns -f external-dns-ionos-values.yaml

Deploy application: Follow this step to deploy an application:

Deploy an echo server application by using the file echoserver_app.yaml.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: echoserver
  namespace: echoserver
spec:
  replicas: 1
  selector:
    matchLabels:
      app: echoserver
  template:
    metadata:
      labels:
        app: echoserver
    spec:
      containers:
      - image: ealen/echo-server:latest
        imagePullPolicy: IfNotPresent
        name: echoserver
        ports:
        - containerPort: 80
        env:
        - name: PORT
          value: "80"
---
apiVersion: v1
kind: Service
metadata:
  name: echoserver
  namespace: echoserver
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  type: ClusterIP
  selector:
    app: echoserver
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echoserver
  namespace: echoserver
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
  - host: app.example1.com #This is your subdomain / record name
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: echoserver
            port:
              number: 80

If you want to use a service, you do not need to install an ingress controller. You can install an ingress controller in the cluster and deploy the application with kubectl by using the following command:

kubectl apply -f echoserver_app.yaml

Result: The deployment of ExternalDNS on Managed Kubernetes is complete.

Verify deployment

You can verify that the application deployed is functioning as expected by using one of the following options.

Access application

Check that the echo server app runs on the subdomain you have specified by using the following command:

curl -I app.example1.com/?echo_code=404-300

Expected result:

HTTP/1.1 404 Not Found 
HTTP/1.1 300 Multiple Choices

Check DNS records

Check that the new A and TXT records are created by using the following command:

curl --location --request GET 'https://dns.de-fra.ionos.com/records?filter.name=app' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJraWQiOiI4MmE5' \
--data ''

Set Up a Secondary Zone

This tutorial explains how to set up a secondary DNS zone in IONOS Cloud by running a bind9 server on an Ubuntu operating system. The setup includes the following configuration steps:

Set up a Dedicated Core server in IONOS Cloud.
Configure a primary nameserver on a in IONOS Cloud running a bind9 server on an Ubuntu operating system.
Create a secondary DNS zone using IONOS Cloud DNS API.
Establish and verify the zone transfer between primary and secondary zones.

Set up a Dedicated Core Server in IONOS Cloud

Note:

The user who creates the server has full root or administrator access rights. A server, once provisioned, retains all its settings (resources, drive allocation, password, and so on), even after server restart at the operating system level.
The server will only be removed from your virtual data center once you delete it in the DCD.

To set up a Dedicated Core server in IONOS Cloud, follow these steps:

1. Create a Dedicated Core server and configure the server in the Settings tab by following the steps in .

Result: A Dedicated Core Server is set up and started along with the configuration of Settings, Network, and Storage setup.

Dedicated Core Server network settings

2. MAC: Assigned on VM creation.

3. LAN: Select the LAN connection that is connected to the internet, by default LAN 1.

4. Firewall: By default, the firewall is disabled. To enable firewall rules, make sure that incoming and outgoing traffic is allowed on port 53 for UDP and TCP.

5. IPv4 Configuration: Leave to default values.

Result: The Network settings for a Dedicated Core server are configured.

Dedicated Core Server storage settings

Warning: The storage type cannot be changed after provisioning.

1. Click SSD and a new pop-up window Create New Attached Storage appears.

2. Configure the following storage details:

Name: Enter a name that is unique within your VDC.
Availability Zone: Leave on "Auto".
Size in GB: Enter "30" which is sufficient for this tutorial.
Performance: Select "Standard".

Image: You can select one of IONOS images or snapshots, or use your own. For this tutorial, we will use an Ubuntu server image from IONOS. To make the same choice, select ubuntu-22.04-server-cloudimg-amd64 under IONOS Images.
Password: Create a password for the "root" user of the server. You will need this password to SSH and make changes.
SSH Keys: Select an SSH key stored in the SSH Key Manager.
Ad-hoc SSH Key: If you have not created an SSH key, copy and paste the public part of your SSH key into this field.
Cloud-Init user data: Leave on "No configuration".
Boot from Device: Select this checkbox to make the SSD drive bootable.

3. Click Create SSD Storage to create the SSD storage.

Result: The Storage settings for a Dedicated Core server are configured.

Provision changes and start the Dedicated Core Server

1. Select the newly created Dedicated Core server.

2. From the Settings tab in the Inspector pane, select Power > Start.

3. Click Provision Changes in the lower right corner and further click Provision Now.

Result: The Dedicated Core server is provisioned and started.

Next steps: After your changes are provisioned and the server is started, select your Dedicated Core server, click the Network tab in the Inspector pane and copy the IPv4 address.

Configure a Dedicated Core Server as a primary nameserver

Prerequisite: A Dedicated Core server in IONOS Cloud needs to be set up and you must have the IPv4 address of the server.

To configure a Dedicated Core server and enable it to act as the primary nameserver, follow these steps:

1. SSH into the newly created Dedicated Core server.

2. Connect to the newly created server via SSH.

3. Proceed with configuring bind9 and your primary DNS zone.

4. Configure notify to the IONOS Cloud DNS anycast nameserver and allow zone update from localhost.

Note: For sending DNS notify messages, Cloud DNS uses the following Anycast addresses: IPv4 212.227.123.25 or IPv6 2001:8d8:fe:53::5cd:25.

5. Create your primary zone.

6. Edit the zone file.

7. Save your changes and quit the Vim editor.

8. Check the configuration, reload bind, and verify that the configured zone is working.

Result: The Dedicated Core server is configured as the primary nameserver in IONOS Cloud running a bind9 server on an Ubuntu operating system.

Create a secondary zone in IONOS Cloud DNS

Prerequisite: A Dedicated Core server in IONOS Cloud is set up as a primary nameserver.

To create a secondary zone in the IONOS Cloud DNS by using the REST API, follow this step:

Send a POST request to the /secondaryzones endpoint.

Response

Result: A secondary zone in IONOS Cloud DNS is successfully created By using a POST request.

Verify zone transfer

On the primary nameserver, you can verify the zone transfer in the logs by executing the following command:

You can also verify zone transfer status using IONOS Cloud DNS API:

Response

On success response: 200 OK

Result: The zone transfer between primary and secondary zones is successfully verified.

Add a record

To add a record, follow these steps:

1. On the primary nameserver, update the zone with a new record setting—A record to a TEST-NET-3 IP address:

2. Resolve the new record locally.

3. View the logs which show that a notification is sent to the secondary zone for the new record.

4. Using Cloud DNS API, verify that the newly added record is transferred to the secondary zone.

5. Globally resolve a new record from the IONOS Cloud DNS anycast network by using the following command:

Result: A record is successfully added to the primary nameserver.

Enhance Email Deliverability with a Reverse DNS, SPF, and DKIM Record

A PTR record is crucial for email servers, establishing Reverse DNS mapping and verifying server IP legitimacy. It's vital for email deliverability, preventing spam flags and contributing to FCrDNS. Servers lacking PTR records may face rejection, impacting delivery. Additionally, SPF records specify authorized email servers, preventing spoofing. DKIM further authenticates outgoing emails, enhancing trust and communication.

This tutorial will guide you on how to install and configure a email server and a PTR, SPF and DKIM records using IONOS . The steps we will follow are:

Reserve an IPv4 in your IONOS Cloud setup.
Create an A and MX record for your email server. For information on common record types, see .
Install and configure the email server on a Dedicated Core Server in the IONOS Cloud.
Test the email deliverability from the Dedicated Core Server.
Add a pointer record (PTR), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) record for your email server.
Test the email deliverability after adding PTR, DKIM and SPF records.

Info:

Pointer Record (PTR): A type of DNS record that maps an IP address to a domain name, commonly used for reverse DNS lookups to verify the authenticity of the sender's domain.
DomainKeys Identified Mail (DKIM): A method for validating the authenticity of email messages by adding a digital signature to the email headers, allowing receiving servers to verify that the message has not been altered and comes from a legitimate sender.
Sender Policy Framework (SPF): A DNS-based email authentication protocol used to prevent email spoofing by specifying which IP addresses are allowed to send emails on behalf of a particular domain. This helps to detect and prevent email fraud.

Switch to IPv6 and configure your email server to use IPv6.

Result: Email deliverability is achieved using reverse DNS, MX, A, DKIM, and SPF records for both IPv4 and IPv6.

Reserve an IPv4 in IONOS Cloud

To reserve an IPv4 in IONOS Cloud, follow these steps:

1. In the DCD, go to Menu > Network > IP Management.

2. In IP Management, click Reserve IPs, and a new pop-up window appears. Enter the following information:

Name: Enter a suitable name.
Number of IPs: Select the number of IP addresses to be reserved.
Region: Select a region that is the same as the region of your Dedicated Core server. Click Reserve IPs to reserve the IP addresses and confirm the reservation by selecting OK.

3. Exit the IP Management window and return to the IONOS Cloud Workspace.

Result: The IPv4 address is reserved.

Create an A and MX record for your email server

1. To create an A record for your email server, follow these steps:

Prerequisite: Make sure to use your own <zone_id> and <your_server_ip> along with your <authorization token>.

Result: The A and MX records for your email server are created.

Set up a Dedicated Core Server in IONOS Cloud

Note:

The user who creates the server has full root or administrator access rights. A server, once provisioned, retains all its settings (resources, drive allocation, password, and so on), even after server restart at the operating system level.
The server will only be removed from your virtual data center once you delete it in the DCD.

To set up a Dedicated Core server in IONOS Cloud, follow these steps:

Result: A Dedicated Core Server is set up and started along with the configuration of Settings, Network, and Storage setup.

Dedicated Core Server network settings

2. MAC: Assigned on VM creation.

3. LAN: Select the LAN connection that is connected to the internet, by default LAN 1.

4. Firewall: By default, the firewall is disabled. To enable firewall rules, make sure that incoming and outgoing traffic is allowed on port 25 for UDP and TCP.

5. In the IPv4 Configuration, click Add IP and select the same IP address that you used to create an A record.

Result: The Network settings for a Dedicated Core server are configured.

Dedicated Core Server storage settings

Warning: The storage type cannot be changed after provisioning.

1. Click SSD and a new pop-up window Create New Attached Storage appears.

2. Configure the following storage details:

Name: Enter a name that is unique within your VDC.
Availability Zone: Leave on "Auto".
Size in GB: Enter "20" which is sufficient for this tutorial.
Performance: Select "Standard".

Image: You can select one of IONOS images or snapshots, or use your own. For this tutorial, we will use an Ubuntu server image from IONOS. To make the same choice, select ubuntu-22.04-server-cloudimg-amd64 under IONOS Images.
Password: Create a password for the "root" user of the server. You will need this password to SSH and make changes.
SSH Keys: Select an SSH key stored in the SSH Key Manager.
Ad-hoc SSH Key: If you have not created an SSH key, copy and paste the public part of your SSH key into this field.
Cloud-Init user data: You can add the below Cloud-Init user data to your server. This will install Postfix, OpenDKIM, and OpenDKIM tools. Replace <your-email-domain> with your email domain.

Boot from Device: Select this checkbox to make the SSD drive bootable.

3. Click Create SSD Storage to create the SSD storage.

Result: The Storage settings for a Dedicated Core server are configured.

Provision changes and start the Dedicated Core Server

1. Select the newly created Dedicated Core server.

2. From the Settings tab in the Inspector pane, select Power > Start.

3. Click Provision Changes in the lower right corner and further click Provision Now.

Result: The Dedicated Core server is provisioned and started.

Next steps: After your changes are provisioned and the server is started, select your Dedicated Core server, click the Network tab in the Inspector pane and copy one of the IPv4 addresses.

Test email deliverability

Note: You can now connect to your Dedicated Core Server, and send a test email. The email might be marked as spam, depending on your email provider. At this point, you have configured only A and MX records.

1. Connect to your Dedicated Core Server via ssh:

2. Test the configuration using the following bash command:

Info: Replace <your-email>@<your-domain> with your email address.

You should receive an email titled Test Email containing the message This is a test email. However, depending on your email provider, the email might be redirected to your spam folder. For example, the email can be in the spam folder with a note Mail system could not verify that demo-ionos.cloud actually sent this message (and not a spammer).

3. Check the mail.log file to see the status of the email delivery:

4. Get the public key for the DKIM record:

Info: Public key for the DKIM record can be found in the /mail.txt file. This is necessary to create the DKIM record.

The output should be similar to something like this:

Here, you need to save the public key for the next step.

Result: You have tested email deliverability with A and MX records.

Add a Reverse DNS, DKIM and SPF record for your email server

Info:

For your SPF record make sure that instead of mail.demo-ionos.cloud you use your own domain name.
After creating the PTR record and the SPF record, it might take around 10 minutes to propagate.

4. Test the email deliverability using the following bash command:

Result: You have created reverse DNS, SPF, and DKIM records for your email server and tested email deliverability.

Info: Replace <your-email>@<your-domain> with your email address.

Switch to IPv6

Once you have configured your email server to use IPv4, you can now configure your email server to use IPv6.

1. To enable IPv6 for your LAN, select the LAN connection connected to the internet, then select the IPv6 enabled option. Provision your changes.

2. After the changes are provisioned and IPv6 is enabled you can configure your NIC in the Network tab. Provide the following details:

Name: Your choice is recommended to be unique to this Virtual Data Center (VDC).
MAC: The Media Access Control (MAC) address will be assigned automatically upon provisioning.
LAN: Select a LAN for which you want to configure the network.
Firewall: To activate the firewall, choose between Ingress / Egress / Bidirectional.
IPv4 Configuration: Provide the following details:
- Failover: If you have an HA setup including a failover configuration on your VMs, you can create and manage IP failover groups that support your High Availability (HA) setup.
- Firewall: Configure the firewall.
- DHCP: It is often necessary to run a Dynamic Host Configuration Protocol (DHCP) server in your VDC (e.g. Preboot Execution Environment (PXE) boot for fast rollout of VMs). If you use your own DHCP server, clear this checkbox so that your IPs are not reassigned by the IONOS DHCP server.
- Add IP: In order to use "floating" or virtual IPs, you can assign additional IPs to a NIC by selecting them from the drop-down menu.
IPv6 Configuration: Provide the following details:
- NIC IPv6 CIDR: You can populate an IPv6 CIDR block with prefix length /80 or allow it to be automatically assigned from the VDCs allocated range, by selecting PROVISION CHANGES. You can also choose 1 or more individual /128 IPs. Only the first IP is automatically allocated. The remaining IPs can be assigned as per your requirement. The maximum number of IPv6 IPs that can be allocated per NIC is 50.
- DHCPv6: It is often necessary to run your own DHCPv6 server in your Virtual Data Center (VDC) (e.g. PXE boot for fast rollout of VMs). If you use your own DHCPv6 server, clear this checkbox so that your IPs are not reassigned by the IONOS DHCPv6 server.
- Add IP: In order to use "floating" or virtual IPs, you can assign additional IPs to a NIC by selecting them from the drop-down menu.

To create the PTR record, use the automatically assigned IPv6 address from the VDCs allocated range. Continue and select PROVISION CHANGES.

Note: Replace 2001:0db8::1 with your own IPv6 address.

4. Create an AAAA record for mail.demo-ionos.cloud pointing to the IPv6 address that was assigned to your server:

Note: Replace 2001:0db8::1 with your own IPv6 address.

5. You need to alter the SPF record to include the IPv6 address. To update the SPF record, you need to get <spf_record_id> using:

6. Update the SPF record to include the IPv6 address using:

Note: Replace <IPv4 address of email server> and <IPv6 address of email server> with IPv4 and IPv6 addresses of the email server.

7. Login to the email server using the new IPv6 address and test again the email deliverability using:

and send an email:

8. We can check the mail.log using:

Result: You have switched from IPv4 to IPv6 and tested email deliverability.

Issue TLS Certificates using IONOS Cloud Certbot Plugin

Transport Layer Security(TLS), is a pivotal security protocol that ensures the encryption of data transmitted between web browsers like Chrome, Firefox, and web servers.

Employing TLS certificates for all hosted content and applications is imperative. It not only safeguards sensitive information but also fosters trust among users by guaranteeing secure communication channels.

Info: To obtain a Let’s Encrypt certificate for your domain, verification of ownership is required. This can be achieved through various methods detailed in the . One commonly used method is the DNS-01 challenge, which necessitates demonstrating control over the domain's DNS by generating a specific value in a TXT record. Utilizing the Certbot plugin facilitates the certificate issuance process by managing TXT records automatically, handling tasks such as creation, removal, renewal, and revocation. Further details on this process can be found in the . For more information on Cloud DNS Certbot plugin, see .

This tutorial will guide you on how to install and configure a simple web server, create an A record for that web server using IONOS , and create an TLS certificate for your web server using . The steps we will follow are:

Reserve an IPv4 in your IONOS Cloud setup.
Set up a Web Server on Dedicated Core Server in IONOS Cloud.
Create an A record for your web server. For information on common record types, see .
Create an TLS certificate for your web server using IONOS Cloud Certbot Plugin.
Add TLS certificate to your web server configuration.
Test your TLS certificate.

Prerequisites:

You have an IONOS account. If you do not have an account, you can create one by visiting the IONOS website.
You have a zone with IONOS Cloud DNS. If you do not have a zone, you can create one using the IONOS Cloud DNS API. For more information, see . We will refer to this zone and zone name as <your-zone> and <your-zone-name>, respectively.
Make sure to use your own <zone_id> and <your_server_ip> along with your <authorization token>.

Reserve an IPv4 address in IONOS Cloud

To reserve an IPv4 address in IONOS Cloud, follow these steps:

1. In the DCD, go to Menu > Network > IP Management.

2. In IP Management, click Reserve IPs, and a new pop-up window appears. Enter the following information:

Name: Enter a suitable name.
Number of IPs: Select the number of IP addresses to be reserved.
Region: Select a region that is the same as the region of your Dedicated Core server. Click Reserve IPs to reserve the IP addresses and confirm the reservation by selecting OK.

3. Exit the IP Management window and return to the IONOS Cloud Workspace.

Result: The IPv4 address is reserved.

Set up a Dedicated Core Server in IONOS Cloud

Note:

The user who creates the server has full root or administrator access rights. A server, once provisioned, retains all its settings (resources, drive allocation, password, and so on), even after server restart at the operating system level.
The server will only be removed from your virtual data center once you delete it in the DCD.

To set up a Dedicated Core server in IONOS Cloud, follow these steps:

Result: A Dedicated Core Server is set up and started along with the configuration of Settings, Network, and Storage setup.

Dedicated Core Server network settings

2. MAC: It is automatically assigned during the VM creation.

3. LAN: Select the LAN connection that is connected to the internet by default it is LAN 1.

4. Firewall: By default, the firewall is disabled. To enable firewall rules, make sure that incoming and outgoing traffic is allowed on port 25 for UDP and TCP.

5. In the IPv4 Configuration, click Add IP and select the same IP address that you used to create an A record.

Result: The Network settings for a Dedicated Core server are configured.

Dedicated Core Server storage settings

Warning: The storage type cannot be changed after provisioning.

1. Click SSD and a new pop-up window Create New Attached Storage appears.

2. Configure the following storage details:

Name: Enter a name that is unique within your VDC.
Availability Zone: By default, the value is set to "Auto".
Size in GB: We recommend using 20 for the storage size.
Performance: Select "Standard".

Image: You can select one of IONOS images or snapshots, or use your own. For this tutorial, we will use an Ubuntu server image from IONOS. To make the same choice, select ubuntu-22.04-server-cloudimg-amd64 under IONOS Images.
Password: Create a password for the "root" user of the server. You will need this password to SSH and make changes.
SSH Keys: Select an SSH key stored in the SSH Key Manager.
Ad-hoc SSH Key: If you have not created an SSH key, copy and paste the public part of your SSH key into this field.
Cloud-Init user data: To install the Nginx web-server, Certbot, and Python3-pip tools, use the following Cloud-Init user data.

Boot from Device: Select this checkbox to make the SSD drive bootable.

3. Click Create SSD Storage to create the SSD storage.

Result: The Storage settings for a Dedicated Core server are configured.

Provision changes and start the Dedicated Core Server

1. Select the newly created Dedicated Core server.

2. From the Settings tab in the Inspector pane, select Power > Start.

3. Click Provision Changes in the lower right corner and click Provision Now.

Result: The Dedicated Core server is provisioned and started.

Next steps: After your changes are provisioned and the server is started, select your Dedicated Core server, click the Network tab in the Inspector pane, and copy one of the IPv4 addresses.

Create an A record for your web server

1. To create an A record for your email server, follow these steps:

Prerequisite: Make sure to use your own <zone_id> and <your_server_ip> along with your <authorization token>.

Result: The A record for your web server is created.

Create an TLS certificate for your web server using IONOS Cloud Certbot Plugin

1. Create a credentials.ini file containing the IONOS Cloud API token. This file must contain ionos_dns_token key with the value of the access token:

and add the following content:

Save and exit the file.

2. Restrict access to the credentials.ini file:

3. Create an TLS certificate for your web server using the IONOS Cloud Certbot Plugin:

4. When prompted, enter the email address for urgent renewals and security notices.

5. The Certbot plugin will automatically create a TXT record in your zone to verify the domain ownership.

6. The Certbot plugin will issue the TLS certificate for your web server. On successful issuance, you will see the following message:

Note: TLS Certificate and Key will be created in /etc/letsencrypt/live/<your-zone>/ folder. For the purpose of this tutorial we used zone demo-ionos.cloud, therefore TLS Certificate and Key are created in /etc/letsencrypt/live/demo-ionos.cloud/ directory.

Result: The TLS certificate for your web server is issued using the IONOS Cloud Certbot Plugin.

Add TLS certificate to your web server configuration

1. Add the TLS certificate to your web server configuration by editing the Nginx configuration file:

2. At the beginning of /etc/nginx/sites-available/default file, uncomment the following lines:

3. Add the following lines to the bottom of the server block:

4. Your /etc/nginx/sites-available/default file should look like this:

5. Save and exit the file.

6. Restart the Nginx service:

7. Verify the Nginx service status:

Result: The TLS certificate is added to your web server configuration.

Test your TLS certificate

1. To test your TLS certificate, open a web browser and enter the URL https://<your-zone-name>.

Result: The TLS certificate is successfully installed, and your web server is secure.

Renew your TLS certificate

Let's Encrypt certificates are valid for 90 days.

1. To manually renew your TLS certificate using the IONOS Cloud Certbot Plugin, you can do it manually by issuing the following command:

Result: Your TLS certificate is renewed successfully.

Set Up a Secondary Zone

This tutorial explains how to set up a secondary DNS zone in IONOS Cloud by running a bind9 server on an Ubuntu operating system. The setup includes the following configuration steps:

Set up a Dedicated Core server in IONOS Cloud.
Configure a primary nameserver on a in IONOS Cloud running a bind9 server on an Ubuntu operating system.
Create a secondary DNS zone using IONOS Cloud DNS API.
Establish and verify the zone transfer between primary and secondary zones.

Set up a Dedicated Core Server in IONOS Cloud

Note:

The user who creates the server has full root or administrator access rights. A server, once provisioned, retains all its settings (resources, drive allocation, password, and so on), even after server restart at the operating system level.
The server will only be removed from your virtual data center once you delete it in the DCD.

To set up a Dedicated Core server in IONOS Cloud, follow these steps:

1. Create a Dedicated Core server and configure the server in the Settings tab by following the steps in .

2. Configure the server Network settings by following the steps in the .

3. Configure the server Storage settings by following the steps in the .

4. Continue to provision the changes and start the Dedicated Core Server by following the steps in the .

Result: A Dedicated Core Server is set up and started along with the configuration of Settings, Network, and Storage setup.

Dedicated Core Server network settings

In the > Inspector pane on the right, configure the following network details in the Network tab.

1. Name: Choose a name unique to this .

2. MAC: Assigned on VM creation.

3. LAN: Select the LAN connection that is connected to the internet, by default LAN 1.

4. Firewall: By default, the firewall is disabled. To enable firewall rules, make sure that incoming and outgoing traffic is allowed on port 53 for UDP and TCP.

5. IPv4 Configuration: Leave to default values.

Result: The Network settings for a Dedicated Core server are configured.

Dedicated Core Server storage settings

Warning: The storage type cannot be changed after provisioning.

In the > Inspector pane on the right, configure the following storage details in the Storage tab.

1. Click SSD and a new pop-up window Create New Attached Storage appears.

2. Configure the following storage details:

Name: Enter a name that is unique within your VDC.
Availability Zone: Leave on "Auto".
Size in GB: Enter "30" which is sufficient for this tutorial.
Performance: Select "Standard".

Image: You can select one of IONOS images or snapshots, or use your own. For this tutorial, we will use an Ubuntu server image from IONOS. To make the same choice, select ubuntu-22.04-server-cloudimg-amd64 under IONOS Images.
Password: Create a password for the "root" user of the server. You will need this password to SSH and make changes.
SSH Keys: Select an SSH key stored in the SSH Key Manager.
Ad-hoc SSH Key: If you have not created an SSH key, copy and paste the public part of your SSH key into this field.
Cloud-Init user data: Leave on "No configuration".
Boot from Device: Select this checkbox to make the SSD drive bootable.

3. Click Create SSD Storage to create the SSD storage.

Result: The Storage settings for a Dedicated Core server are configured.

Provision changes and start the Dedicated Core Server

1. Select the newly created Dedicated Core server.

2. From the Settings tab in the Inspector pane, select Power > Start.

3. Click Provision Changes in the lower right corner and further click Provision Now.

Result: The Dedicated Core server is provisioned and started.

Next steps: After your changes are provisioned and the server is started, select your Dedicated Core server, click the Network tab in the Inspector pane and copy the IPv4 address.

Configure a Dedicated Core Server as a primary nameserver

Prerequisite: A Dedicated Core server in IONOS Cloud needs to be set up and you must have the IPv4 address of the server.

To configure a Dedicated Core server and enable it to act as the primary nameserver, follow these steps:

1. SSH into the newly created Dedicated Core server.

ssh root@<IP-ADDRESS>

2. Connect to the newly created server via SSH.

root@ubuntu:~# sudo -i
root@ubuntu:~# apt update -y
[...]
root@ubuntu:~# apt install -y bind9 bind9utils
[...]

3. Proceed with configuring bind9 and your primary DNS zone.

root@ubuntu:~# vi /etc/bind/named.conf.local

4. Configure notify to the IONOS Cloud DNS anycast nameserver and allow zone update from localhost.

Note: For sending DNS notify messages, Cloud DNS uses the following Anycast addresses: IPv4 212.227.123.25 or IPv6 2001:8d8:fe:53::5cd:25.

logging {
  category xfer-out { default_syslog; };
  category xfer-in { default_syslog; };
  category notify { default_syslog; };
  category lame-servers { default_syslog; };
  category general { default_syslog; };
  category default { default_syslog; };
};


zone "primary-zone.de" IN {
  type master;
  file "/var/cache/bind/primary-zone.de.db";
  notify explicit;
  also-notify  { 212.227.123.25; };
  allow-update { 127.0.0.1; };
};

5. Create your primary zone.

root@ubuntu:~# vi /var/cache/bind/primary-zone.de.db

6. Edit the zone file.

; Zone: primary-zone.de
; Exported: Mon Aug 17 22:36:11 UTC 2023
 
$ORIGIN primary-zone.de.
$TTL 3600
 
@   3600    IN  SOA primary-zone.de. hostmaster.primary-zone.de. (
                    2017060104  ; serial
                    28800       ; refresh
                    7200        ; retry
                    604800      ; expire
                    600 )       ; minimum
@   3600    IN  NS  ns.ui-global-dns.com.
@   3600    IN  NS  ns.ui-global-dns.de.
@   3600    IN  NS  ns.ui-global-dns.org.
@   3600    IN  NS  ns.ui-global-dns.biz.
www 60    IN  A   127.0.0.1
www 60    IN  AAAA    ::1

7. Save your changes and quit the Vim editor.

8. Check the configuration, reload bind, and verify that the configured zone is working.

root@ubuntu:~# named-checkconf
root@ubuntu:~# systemctl reload named
root@ubuntu:~# dig +short primary-zone.de

Result: The Dedicated Core server is configured as the primary nameserver in IONOS Cloud running a bind9 server on an Ubuntu operating system.

Create a secondary zone in IONOS Cloud DNS

Prerequisite: A Dedicated Core server in IONOS Cloud is set up as a primary nameserver.

To create a secondary zone in the IONOS Cloud DNS by using the REST API, follow this step:

Send a POST request to the /secondaryzones endpoint.

curl --location 'https://dns.de-fra.ionos.com/secondaryzones' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJraWQiO' \
--data '{
    "properties": {
        "zoneName": "primary-zone.de",
        "description": "This is a secondary zone for primary-zone.de in IONOS Cloud DNS",
        "primaryIps": [
            "<IP-ADDRESS>"
        ]
    }
}'

Response

{
    "id": "bdae7da0-0363-49d7-929d-92992786efe1",
    "type": "secondaryzone",
    "href": "/secondaryzones/bdae7da0-0363-49d7-929d-92992786efe1",
    "metadata": {
        "createdDate": "2023-08-06T19:36:58+00:00",
        "lastModifiedDate": "2023-08-06T19:36:59+00:00",
        "nameservers": [
            "nscs.ui-dns.com",
            "nscs.ui-dns.de",
            "nscs.ui-dns.org",
            "nscs.ui-dns.biz"
        ],
        "state": "AVAILABLE"
    },
    "properties": {
        "description": "This is a secondary zone for test-dns-public.info in IONOS Cloud DNS",
        "primaryIps": [
            "<IP-ADDRESS>"
        ],
        "zoneName": "test-dns-public.info"
    }
}

Result: A secondary zone in IONOS Cloud DNS is successfully created By using a POST request.

Verify zone transfer

On the primary nameserver, you can verify the zone transfer in the logs by executing the following command:

root@ubuntu:~# journalctl --unit named --follow
Aug 07 14:43:39 ubuntu named[2666]: client @0x7f467825b958 212.227.123.26#33308 (primary-zone.de): transfer of 'primary-zone.de/IN': AXFR started (serial 2017060104)
Aug 07 14:43:39 ubuntu named[2666]: client @0x7f467825b958 212.227.123.26#33308 (primary-zone.de): transfer of 'primary-zone.de/IN': AXFR ended: 1 messages, 8 records, 299 bytes, 0.001 secs (299000 bytes/sec) (serial 2017060104)

You can also verify zone transfer status using IONOS Cloud DNS API:

curl --location 'https://dns.de-fra.ionos.com/secondaryzones/bdae7da0-0363-49d7-929d-92992786efe1/axfr' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJraWQiO'

Response

On success response: 200 OK

{
    "items": [
        {
            "errorMessage": "",
            "primaryIp": "<IP-ADDRESS>",
            "status": "OK"
        }
    ],
    "type": "collection"
}

Result: The zone transfer between primary and secondary zones is successfully verified.

Add a record

To add a record, follow these steps:

1. On the primary nameserver, update the zone with a new record setting—A record to a TEST-NET-3 IP address:

root@ubuntu:~# dig +short www. primary-zone.de @ns.ui-global-dns.com
217.160.0.148
root@ubuntu:~# nsupdate
> server 127.0.0.1
> zone primary-zone.de
> update add www2.primary-zone.de. 600 IN A 203.0.113.1
> send
> quit

2. Resolve the new record locally.

root@ubuntu:~# dig +short www2.primary-zone.de @127.0.0.1
203.0.113.1

3. View the logs which show that a notification is sent to the secondary zone for the new record.

Aug 07 16:00:22 ubuntu named[2666]: client @0x7f467000d0a8 127.0.0.1#34056: updating zone 'primary-zone.de/IN': adding an RR at 'www2.primary-zone.de' A 203.0.113.1
Aug 07 16:00:22 ubuntu named[2666]: zone primary-zone.de/IN: sending notifies (serial 2017060105)

4. Using Cloud DNS API, verify that the newly added record is transferred to the secondary zone.

curl --location 'https://dns.de-fra.ionos.com/secondaryzones/bdae7da0-0363-49d7-929d-92992786efe1/records' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJraWQiO'

{
    "id": "bdae7da0-0363-49d7-929d-92992786efe1",
    "type": "collection",
    "href": "/secondaryzones/bdae7da0-0363-49d7-929d-92992786efe1/records?limit=100&offset=0",
    "metadata": {
        "primaryIps": [
            "<IP-ADDRESS>"
        ]
    },
    "items": [
        {
            "type": "record",
            "metadata": {
                "fqdn": "primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "primary-zone.de hostmaster.primary-zone.de 2017060105 28800 7200 604800 600",
                "enabled": true,
                "name": "",
                "priority": 0,
                "ttl": 3600,
                "type": "SOA"
            }
        },
        {
            "type": "record",
            "metadata": {
                "fqdn": "primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "ns.ui-global-dns.de",
                "enabled": true,
                "name": "",
                "priority": 0,
                "ttl": 3600,
                "type": "NS"
            }
        },
        {
            "type": "record",
            "metadata": {
                "fqdn": "primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "ns.ui-global-dns.biz",
                "enabled": true,
                "name": "",
                "priority": 0,
                "ttl": 3600,
                "type": "NS"
            }
        },
        {
            "type": "record",
            "metadata": {
                "fqdn": "primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "ns.ui-global-dns.com",
                "enabled": true,
                "name": "",
                "priority": 0,
                "ttl": 3600,
                "type": "NS"
            }
        },
        {
            "type": "record",
            "metadata": {
                "fqdn": "primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "ns.ui-global-dns.org",
                "enabled": true,
                "name": "",
                "priority": 0,
                "ttl": 3600,
                "type": "NS"
            }
        },
        {
            "type": "record",
            "metadata": {
                "fqdn": "www.primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "127.0.0.1",
                "enabled": true,
                "name": "www",
                "priority": 0,
                "ttl": 3600,
                "type": "A"
            }
        },
        {
            "type": "record",
            "metadata": {
                "fqdn": "www.primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "0:0:0:0:0:0:0:1",
                "enabled": true,
                "name": "www",
                "priority": 0,
                "ttl": 3600,
                "type": "AAAA"
            }
        },
        {
            "type": "record",
            "metadata": {
                "fqdn": "www2.primary-zone.de",
                "zoneId": "bdae7da0-0363-49d7-929d-92992786efe1",
                "rootName": "primary-zone.de"
            },
            "properties": {
                "content": "203.0.113.1",
                "enabled": true,
                "name": "www2",
                "priority": 0,
                "ttl": 3600,
                "type": "A"
            }
        }
    ],
    "offset": 0,
    "limit": 100,
    "_links": {
        "self": "/secondaryzones/bdae7da0-0363-49d7-929d-92992786efe1/records?limit=100&offset=0",
        "next": "/secondaryzones/bdae7da0-0363-49d7-929d-92992786efe1/records?limit=100&offset=100"
    }
}

5. Globally resolve a new record from the IONOS Cloud DNS anycast network by using the following command:

root@ubuntu:~# dig +short www2.primary-zone.de @ns.ui-global-dns.com.

Result: A record is successfully added to the primary nameserver.

Issue TLS Certificates using IONOS Cloud Certbot Plugin

Transport Layer Security(TLS), is a pivotal security protocol that ensures the encryption of data transmitted between web browsers like Chrome, Firefox, and web servers.

Reserve an IPv4 in your IONOS Cloud setup.
Set up a Web Server on Dedicated Core Server in IONOS Cloud.
Create an A record for your web server. For information on common record types, see .
Create an TLS certificate for your web server using IONOS Cloud Certbot Plugin.
Add TLS certificate to your web server configuration.
Test your TLS certificate.

Prerequisites:

You have an IONOS account. If you do not have an account, you can create one by visiting the IONOS website.
You have a zone with IONOS Cloud DNS. If you do not have a zone, you can create one using the IONOS Cloud DNS API. For more information, see . We will refer to this zone and zone name as <your-zone> and <your-zone-name>, respectively.
Make sure to use your own <zone_id> and <your_server_ip> along with your <authorization token>.

Reserve an IPv4 address in IONOS Cloud

To reserve an IPv4 address in IONOS Cloud, follow these steps:

1. In the DCD, go to Menu > Network > IP Management.

2. In IP Management, click Reserve IPs, and a new pop-up window appears. Enter the following information:

Name: Enter a suitable name.
Number of IPs: Select the number of IP addresses to be reserved.
Region: Select a region that is the same as the region of your Dedicated Core server. Click Reserve IPs to reserve the IP addresses and confirm the reservation by selecting OK.

3. Exit the IP Management window and return to the IONOS Cloud Workspace.

Result: The IPv4 address is reserved.

Set up a Dedicated Core Server in IONOS Cloud

Note:

The user who creates the server has full root or administrator access rights. A server, once provisioned, retains all its settings (resources, drive allocation, password, and so on), even after server restart at the operating system level.
The server will only be removed from your virtual data center once you delete it in the DCD.

To set up a Dedicated Core server in IONOS Cloud, follow these steps:

1. Create a Dedicated Core server and configure the server in the Settings tab by following the steps in .

2. Configure the server Network settings by following the steps in the .

3. Configure the server Storage settings by following the steps in the .

4. Continue to provision the changes and start the Dedicated Core Server by following the steps in the .

Result: A Dedicated Core Server is set up and started along with the configuration of Settings, Network, and Storage setup.

Dedicated Core Server network settings

In the > Inspector pane on the right, configure the following network details in the Network tab.

1. Name: Choose a name unique to this .

2. MAC: It is automatically assigned during the VM creation.

3. LAN: Select the LAN connection that is connected to the internet by default it is LAN 1.

4. Firewall: By default, the firewall is disabled. To enable firewall rules, make sure that incoming and outgoing traffic is allowed on port 25 for UDP and TCP.

5. In the IPv4 Configuration, click Add IP and select the same IP address that you used to create an A record.

Result: The Network settings for a Dedicated Core server are configured.

Dedicated Core Server storage settings

Warning: The storage type cannot be changed after provisioning.

In the > Inspector pane on the right, configure the following storage details in the Storage tab.

1. Click SSD and a new pop-up window Create New Attached Storage appears.

2. Configure the following storage details:

Name: Enter a name that is unique within your VDC.
Availability Zone: By default, the value is set to "Auto".
Size in GB: We recommend using 20 for the storage size.
Performance: Select "Standard".

Image: You can select one of IONOS images or snapshots, or use your own. For this tutorial, we will use an Ubuntu server image from IONOS. To make the same choice, select ubuntu-22.04-server-cloudimg-amd64 under IONOS Images.
Password: Create a password for the "root" user of the server. You will need this password to SSH and make changes.
SSH Keys: Select an SSH key stored in the SSH Key Manager.
Ad-hoc SSH Key: If you have not created an SSH key, copy and paste the public part of your SSH key into this field.
Cloud-Init user data: To install the Nginx web-server, Certbot, and Python3-pip tools, use the following Cloud-Init user data.

#cloud-config

packages:
  - nginx
  - certbot
  - python3-pip
  
runcmd:
  - pip3 install certbot-dns-ionos-cloud

Boot from Device: Select this checkbox to make the SSD drive bootable.

3. Click Create SSD Storage to create the SSD storage.

Result: The Storage settings for a Dedicated Core server are configured.

Provision changes and start the Dedicated Core Server

1. Select the newly created Dedicated Core server.

2. From the Settings tab in the Inspector pane, select Power > Start.

3. Click Provision Changes in the lower right corner and click Provision Now.

Result: The Dedicated Core server is provisioned and started.

Create an A record for your web server

1. To create an A record for your email server, follow these steps:

Info: We already own the zone demo-ionos.cloud and will use it for this tutorial. Previously, we created a zone demo-ionos.cloud using the IONOS `. For more information on how to create a zone using IONOS , see .

Prerequisite: Make sure to use your own <zone_id> and <your_server_ip> along with your <authorization token>.

curl --location 'https://dns.de-fra.ionos.com/zones/<zone_id>/records' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <authorization_token>' \
--data '{
  "properties": {
    "name": "",
    "type": "A",
    "content": "<your_server_ip>",
    "ttl": 60,
    "priority": 0,
    "enabled": true
  }
}'

Result: The A record for your web server is created.

Info: For more information on how to create a record for a zone using IONOS , see .

Create an TLS certificate for your web server using IONOS Cloud Certbot Plugin

1. Create a credentials.ini file containing the IONOS Cloud API token. This file must contain ionos_dns_token key with the value of the access token:

vi credentials.ini

and add the following content:

dns_ionos_token=<your_ionos_api_token>

Save and exit the file.

2. Restrict access to the credentials.ini file:

chmod 600 credentials.ini

3. Create an TLS certificate for your web server using the IONOS Cloud Certbot Plugin:

certbot certonly \
  --authenticator dns-ionos \
  --dns-ionos-credentials /path/to/credentials.ini \
  --dns-ionos-propagation-seconds 60 \
  --agree-tos \
  --rsa-key-size 4096 \
  -d '<your-zone-name>' \
  -d '*.<your-zone-name>'

4. When prompted, enter the email address for urgent renewals and security notices.

5. The Certbot plugin will automatically create a TXT record in your zone to verify the domain ownership.

6. The Certbot plugin will issue the TLS certificate for your web server. On successful issuance, you will see the following message:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/<your-zone>/fullchain.pem
Key is saved at: /etc/letsencrypt/live/<your-zone>/privkey.pem
This certificate expires on <expiration-date>.
These files will be updated when the certificate renews.

Result: The TLS certificate for your web server is issued using the IONOS Cloud Certbot Plugin.

Add TLS certificate to your web server configuration

1. Add the TLS certificate to your web server configuration by editing the Nginx configuration file:

vi /etc/nginx/sites-available/default

2. At the beginning of /etc/nginx/sites-available/default file, uncomment the following lines:

         listen 443 ssl default_server;
         listen [::]:443 ssl default_server;

3. Add the following lines to the bottom of the server block:

        ssl_certificate /etc/letsencrypt/live/<your-zone>/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/<your-zone>/privkey.pem;

4. Your /etc/nginx/sites-available/default file should look like this:

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
	listen 80 default_server;
	listen [::]:80 default_server;

	# SSL configuration
	#
	 listen 443 ssl default_server;
	 listen [::]:443 ssl default_server;
	#
	# Note: You should disable gzip for SSL traffic.
	# See: https://bugs.debian.org/773332
	#
	# Read up on ssl_ciphers to ensure a secure configuration.
	# See: https://bugs.debian.org/765782
	#
	# Self signed certs generated by the ssl-cert package
	# Don't use them in a production server!
	#
	# include snippets/snakeoil.conf;

	root /var/www/html;

	# Add index.php to the list if you are using PHP
	index index.html index.htm index.nginx-debian.html;

	server_name _;

	location / {
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		try_files $uri $uri/ =404;
	}

	# pass PHP scripts to FastCGI server
	#
	#location ~ \.php$ {
	#	include snippets/fastcgi-php.conf;
	#
	#	# With php-fpm (or other unix sockets):
	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
	#	# With php-cgi (or other tcp sockets):
	#	fastcgi_pass 127.0.0.1:9000;
	#}

	# deny access to .htaccess files, if Apache's document root
	# concurs with nginx's one
	#
	#location ~ /\.ht {
	#	deny all;
	#}
	ssl_certificate /etc/letsencrypt/live/<your-zone>/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/<your-zone>/privkey.pem;

}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
#	listen 80;
#	listen [::]:80;
#
#	server_name example.com;
#
#	root /var/www/example.com;
#	index index.html;
#
#	location / {
#		try_files $uri $uri/ =404;
#	}
#}

5. Save and exit the file.

6. Restart the Nginx service:

systemctl restart nginx.service

7. Verify the Nginx service status:

systemctl status nginx.service

Result: The TLS certificate is added to your web server configuration.

Test your TLS certificate

1. To test your TLS certificate, open a web browser and enter the URL https://<your-zone-name>.

Result: The TLS certificate is successfully installed, and your web server is secure.

Renew your TLS certificate

Let's Encrypt certificates are valid for 90 days.

1. To manually renew your TLS certificate using the IONOS Cloud Certbot Plugin, you can do it manually by issuing the following command:

certbot renew

2. To automate the renewal process, you can set up a cron job to run the renewal command automatically. For more information on how to set up automated renewals, see the page.

Result: Your TLS certificate is renewed successfully.

Enhance Email Deliverability with a Reverse DNS, SPF, and DKIM Record

This tutorial will guide you on how to install and configure a email server and a PTR, SPF and DKIM records using IONOS . The steps we will follow are:

Reserve an IPv4 in your IONOS Cloud setup.
Create an A and MX record for your email server. For information on common record types, see .
Install and configure the email server on a Dedicated Core Server in the IONOS Cloud.
Test the email deliverability from the Dedicated Core Server.
Add a pointer record (PTR), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) record for your email server.
Test the email deliverability after adding PTR, DKIM and SPF records.

Info:

Pointer Record (PTR): A type of DNS record that maps an IP address to a domain name, commonly used for reverse DNS lookups to verify the authenticity of the sender's domain.
DomainKeys Identified Mail (DKIM): A method for validating the authenticity of email messages by adding a digital signature to the email headers, allowing receiving servers to verify that the message has not been altered and comes from a legitimate sender.
Sender Policy Framework (SPF): A DNS-based email authentication protocol used to prevent email spoofing by specifying which IP addresses are allowed to send emails on behalf of a particular domain. This helps to detect and prevent email fraud.

Switch to IPv6 and configure your email server to use IPv6.

Result: Email deliverability is achieved using reverse DNS, MX, A, DKIM, and SPF records for both IPv4 and IPv6.

Reserve an IPv4 in IONOS Cloud

To reserve an IPv4 in IONOS Cloud, follow these steps:

1. In the DCD, go to Menu > Network > IP Management.

2. In IP Management, click Reserve IPs, and a new pop-up window appears. Enter the following information:

Name: Enter a suitable name.
Number of IPs: Select the number of IP addresses to be reserved.
Region: Select a region that is the same as the region of your Dedicated Core server. Click Reserve IPs to reserve the IP addresses and confirm the reservation by selecting OK.

3. Exit the IP Management window and return to the IONOS Cloud Workspace.

Result: The IPv4 address is reserved.

Create an A and MX record for your email server

1. To create an A record for your email server, follow these steps:

Info: We already own the zone mail.demo-ionos.cloud and will use it for this tutorial. Previously, we have created a zone demo-ionos.cloud using the IONOS . For more information on how to create a zone using IONOS , see .

Prerequisite: Make sure to use your own <zone_id> and <your_server_ip> along with your <authorization token>.

curl --location 'https://dns.de-fra.ionos.com/zones/<zone_id>/records' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <authorization_token>' \
--data '{
  "properties": {
    "name": "",
    "type": "A",
    "content": "<your_server_ip>",
    "ttl": 60,
    "priority": 0,
    "enabled": true
  }
}'

2. Create an MX record for demo-ionos.cloud using the IONOS :

curl --location 'https://dns.de-fra.ionos.com/zones/<zone_id>/records' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <authorization_token>' \
--data '{
  "properties": {
    "name": "",
    "type": "MX",
    "content": "mail.demo-ionos.cloud",
    "ttl": 60,
    "priority": 10,
    "enabled": true
  }
}'

Result: The A and MX records for your email server are created.

Info: For more information on how to create a record for a zone using IONOS , see .

Set up a Dedicated Core Server in IONOS Cloud

Note:

The user who creates the server has full root or administrator access rights. A server, once provisioned, retains all its settings (resources, drive allocation, password, and so on), even after server restart at the operating system level.
The server will only be removed from your virtual data center once you delete it in the DCD.

To set up a Dedicated Core server in IONOS Cloud, follow these steps:

1. Create a Dedicated Core server and configure the server in the Settings tab by following the steps in .

2. Configure the server Network settings by following the steps in the .

3. Configure the server Storage settings by following the steps in the .

4. Continue to provision the changes and start the Dedicated Core Server by following the steps in the .

Result: A Dedicated Core Server is set up and started along with the configuration of Settings, Network, and Storage setup.

Dedicated Core Server network settings

In the > Inspector pane on the right, configure the following network details in the Network tab.

1. Name: Choose a name unique to this .

2. MAC: Assigned on VM creation.

3. LAN: Select the LAN connection that is connected to the internet, by default LAN 1.

4. Firewall: By default, the firewall is disabled. To enable firewall rules, make sure that incoming and outgoing traffic is allowed on port 25 for UDP and TCP.

5. In the IPv4 Configuration, click Add IP and select the same IP address that you used to create an A record.

Result: The Network settings for a Dedicated Core server are configured.

Dedicated Core Server storage settings

Warning: The storage type cannot be changed after provisioning.

In the > Inspector pane on the right, configure the following storage details in the Storage tab.

1. Click SSD and a new pop-up window Create New Attached Storage appears.

2. Configure the following storage details:

Name: Enter a name that is unique within your VDC.
Availability Zone: Leave on "Auto".
Size in GB: Enter "20" which is sufficient for this tutorial.
Performance: Select "Standard".

Image: You can select one of IONOS images or snapshots, or use your own. For this tutorial, we will use an Ubuntu server image from IONOS. To make the same choice, select ubuntu-22.04-server-cloudimg-amd64 under IONOS Images.
Password: Create a password for the "root" user of the server. You will need this password to SSH and make changes.
SSH Keys: Select an SSH key stored in the SSH Key Manager.
Ad-hoc SSH Key: If you have not created an SSH key, copy and paste the public part of your SSH key into this field.
Cloud-Init user data: You can add the below Cloud-Init user data to your server. This will install Postfix, OpenDKIM, and OpenDKIM tools. Replace <your-email-domain> with your email domain.

#cloud-config

packages:
  - postfix
  - opendkim
  - opendkim-tools
  - mailutils

write_files:
  - path: /etc/postfix/main.cf
    content: |
      # Postfix configuration
      smtpd_banner = <your-email-domain> ESMTP $mail_name (IONOS CloudDNS Mail)
      biff = no
      append_dot_mydomain = no
      readme_directory = no
      compatibility_level = 3.6
      # TLS parameters
      smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
      smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
      smtpd_tls_security_level=may
      smtp_tls_CApath=/etc/ssl/certs
      smtp_tls_security_level=may
      smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
      smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
      myhostname = ubuntu
      alias_maps = hash:/etc/aliases
      alias_database = hash:/etc/aliases
      myorigin = /etc/mailname
      mydestination = $myhostname, <your-email-domain>, ubuntu, localhost.localdomain, localhost
      relayhost =
      mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
      mailbox_size_limit = 0
      recipient_delimiter = +
      inet_interfaces = all
      inet_protocols = all
      # Enable OpenDKIM milter
      milter_default_action = accept
      milter_protocol = 6
      smtpd_milters = inet:localhost:12301
      non_smtpd_milters = inet:localhost:12301

  - path: /etc/opendkim.conf
    content: |
      # OpenDKIM configuration
      Syslog                  yes
      SyslogSuccess           yes
      Canonicalization        relaxed/simple
      OversignHeaders         From
      Domain                  <your-email-domain>
      Selector                mail
      KeyFile                 /etc/opendkim/keys/<your-email-domain>/mail.private
      UserID                  opendkim
      UMask                   007
      Socket                  inet:12301@localhost
      PidFile                 /run/opendkim/opendkim.pid
      TrustAnchorFile         /usr/share/dns/root.key

  - path: /etc/cloud-init/opendkim-keys.sh
    permissions: '0755'
    content: |
      #!/bin/bash
      mkdir -p /etc/opendkim/keys/<your-email-domain> &&
      opendkim-genkey -t -s mail -d <your-email-domain> &&
      mv mail.private /etc/opendkim/keys/<your-email-domain>/ &&
      chown -R opendkim:opendkim /etc/opendkim/keys/<your-email-domain> &&
      systemctl restart opendkim

  - path: /etc/mailname
    content: "<your-email-domain>"

runcmd:
  - sudo apt-get update
  - sudo apt-get install -y postfix opendkim opendkim-tools mailutils
  - sudo systemctl enable postfix opendkim
  - sudo systemctl start postfix
  - /etc/cloud-init/opendkim-keys.sh

Boot from Device: Select this checkbox to make the SSD drive bootable.

3. Click Create SSD Storage to create the SSD storage.

Result: The Storage settings for a Dedicated Core server are configured.

Provision changes and start the Dedicated Core Server

1. Select the newly created Dedicated Core server.

2. From the Settings tab in the Inspector pane, select Power > Start.

3. Click Provision Changes in the lower right corner and further click Provision Now.

Result: The Dedicated Core server is provisioned and started.

Test email deliverability

1. Connect to your Dedicated Core Server via ssh:

ssh root@<your_server_ip>

2. Test the configuration using the following bash command:

echo "This is a test email" | mail -s "Test Email" -a "From: sender@mail.demo-ionos.cloud" <your-email>@<your-domain>

Info: Replace <your-email>@<your-domain> with your email address.

3. Check the mail.log file to see the status of the email delivery:

tail -f /var/log/mail.log

4. Get the public key for the DKIM record:

Info: Public key for the DKIM record can be found in the /mail.txt file. This is necessary to create the DKIM record.

cat /mail.txt

The output should be similar to something like this:

mail._domainkey	IN	TXT	( "v=DKIM1; h=sha256; k=rsa; t=y; "
	  "p=MIIBIjANBgkdfdfwefweyQEFAAOCAQ8AMIIBCgKCAQEAvJk3SIlLNap0Mt9fMIKaTDKAUGykTrTyaFmFvJZ3KLMp2tFQqZE99HBeZMofACOaMBkT0ykGxf6MR8zJrvNQTGCDPVVqZjsph7514+HyHTK/rjvz3c2ysbq1JBFz8g6G9R5cLowjqsYp1jggPKmCapfi4QQdbSYEcYPj8+TCz2D8U9xpGdbwxtMO01vuQgFlqkfIWFm4mDH4vY"
	  "efBH4+O2ndr657j4oFsdcLptwpQLmEFlSpzcSn/K2OoPwbFGoaQomLC1lQiTFycGOe+wIVNTtMrVpyMEDQikzm1knIejivpwFEDAv7zOcPSRTHzU1L2ky7DAHquwhEUeYOwIDAQAB" )  ; ----- DKIM key mail for mail.demo-ionos.cloud

Here, you need to save the public key for the next step.

Result: You have tested email deliverability with A and MX records.

Add a Reverse DNS, DKIM and SPF record for your email server

1. Create a PTR record for your email server using the IONOS :

curl --location 'https://dns.de-fra.ionos.com/reverserecords' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <authorization_token>' \
--data '{
  "properties": {
    "name": "mail.demo-ionos.cloud",
    "description": "The Reverse DNS record is used for mail.demo-ionos.cloud",
    "ip": "<your_server_ip>"
  }
}'

2. Create an SPF record for mail.demo-ionos.cloud using IONOS :

curl --location 'https://dns.de-fra.ionos.com/zones/<zone_id>/records' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <authorization_token>' \
--data '{
  "properties": {
    "name": "",
    "type": "TXT",
    "content": "v=spf1 ip4:<your_server_ip> -all",
    "ttl": 60,
    "enabled": true
  }
}
'

Info:

For your SPF record make sure that instead of mail.demo-ionos.cloud you use your own domain name.
After creating the PTR record and the SPF record, it might take around 10 minutes to propagate.

3. Create a DomainKeys Identified Mail (DKIM) record for mail.demo-ionos.cloud using the IONOS :

curl --location 'https://dns.de-fra.ionos.com/zones/<zone_id>/records' \
--header 'Content-Type: application/json' \
--header 'Authorization Bearer <authorization_token>' \
--data '{
  "properties": {
    "name": "mail._domainkey",
    "type": "TXT",
    "content": "v=DKIM1; h=sha256; k=rsa; t=y; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvJk3SIlLNap0Mt9fMIKaTDKAUGykTrTyaFmFvJZ3KLMp2tFQqZE99HBeZMofACOaMBkT0ykGxf6MR8zJrvNQTGCDPVVqZjsph7514+HyHTK/rjvz3c2ysbq1JBFz8g6G9R5cLowjqsYp1jggPKmCapfi4QQdbSYEcYPj8+TCz2D8U9xpGdbwxtMO01vuQgFlqkfIWFm4mDH4vYefBH4+O2ndrBVh6C49mOptwpQLmEFlSpzcSn/K2OoPwbFGoaQomLC1lQiTFycGOe+wIVNTtMrVpyMEDQikzm1knIejivpwFEDAv7zOcPSRTHzU1L2ky7DV8RfPFwjNifSkezeYOwIDAQAB",
    "ttl": 6000,
    "enabled": true
  }
}
'

4. Test the email deliverability using the following bash command:

echo "This is a test email" | mail -s "Test Email" -a "From:sender@mail.demo-ionos.cloud" <your-email>@<your-domain>

Result: You have created reverse DNS, SPF, and DKIM records for your email server and tested email deliverability.

Info: Replace <your-email>@<your-domain> with your email address.

Switch to IPv6

Once you have configured your email server to use IPv4, you can now configure your email server to use IPv6.

1. To enable IPv6 for your LAN, select the LAN connection connected to the internet, then select the IPv6 enabled option. Provision your changes.

2. After the changes are provisioned and IPv6 is enabled you can configure your NIC in the Network tab. Provide the following details:

Name: Your choice is recommended to be unique to this Virtual Data Center (VDC).
MAC: The Media Access Control (MAC) address will be assigned automatically upon provisioning.
LAN: Select a LAN for which you want to configure the network.
Firewall: To activate the firewall, choose between Ingress / Egress / Bidirectional.
IPv4 Configuration: Provide the following details:
- Primary IP: The primary IP address is automatically assigned by the IONOS DHCP . You can, however, enter an IP address for manual assignment by selecting one of the reserved IPs from the drop-down list. Private IP addresses should be entered manually. The has to be connected to the Internet.
- Failover: If you have an HA setup including a failover configuration on your VMs, you can create and manage IP failover groups that support your High Availability (HA) setup.
- Firewall: Configure the firewall.
- DHCP: It is often necessary to run a Dynamic Host Configuration Protocol (DHCP) server in your VDC (e.g. Preboot Execution Environment (PXE) boot for fast rollout of VMs). If you use your own DHCP server, clear this checkbox so that your IPs are not reassigned by the IONOS DHCP server.
- Add IP: In order to use "floating" or virtual IPs, you can assign additional IPs to a NIC by selecting them from the drop-down menu.
IPv6 Configuration: Provide the following details:
- NIC IPv6 CIDR: You can populate an IPv6 CIDR block with prefix length /80 or allow it to be automatically assigned from the VDCs allocated range, by selecting PROVISION CHANGES. You can also choose 1 or more individual /128 IPs. Only the first IP is automatically allocated. The remaining IPs can be assigned as per your requirement. The maximum number of IPv6 IPs that can be allocated per NIC is 50.
- DHCPv6: It is often necessary to run your own DHCPv6 server in your Virtual Data Center (VDC) (e.g. PXE boot for fast rollout of VMs). If you use your own DHCPv6 server, clear this checkbox so that your IPs are not reassigned by the IONOS DHCPv6 server.
- Add IP: In order to use "floating" or virtual IPs, you can assign additional IPs to a NIC by selecting them from the drop-down menu.

To create the PTR record, use the automatically assigned IPv6 address from the VDCs allocated range. Continue and select PROVISION CHANGES.

3. Create a PTR record for your mail server using IONOS :

curl --location 'https://dns.de-fra.ionos.com/reverserecords' \
--header 'Authorization: Bearer <authorization_token>' \
--header 'Content-Type: application/json' \
--data '{
    "properties": {
        "ip": "2001:0db8::1",
        "name": "mail.demo-ionos.cloud",
        "description": "IPv6 PTR record for mail.demo-ionos.cloud"
    }
}

Note: Replace 2001:0db8::1 with your own IPv6 address.

4. Create an AAAA record for mail.demo-ionos.cloud pointing to the IPv6 address that was assigned to your server:

curl --location 'https://dns.de-fra.ionos.com/zones/<zone_id>/records' \
--header 'Authorization: Bearer <authorization_token>' \
--header 'Content-Type: application/json' \
--data '{
  "properties": {
    "name": "",
    "type": "AAAA",
    "content": "2001:0db8::1",
    "ttl": 60,
    "priority": 0,
    "enabled": true
  }
}

Note: Replace 2001:0db8::1 with your own IPv6 address.

5. You need to alter the SPF record to include the IPv6 address. To update the SPF record, you need to get <spf_record_id> using:

curl --location --request GET 'https://dns.de-fra.ionos.com/zones/<zone_id>/records' \
--header 'Authorization: Bearer <authorization_token>' \
--header 'Content-Type: application/json'

6. Update the SPF record to include the IPv6 address using:

curl --location --request PUT 'https://dns.de-fra.ionos.com/zones/<zone_id>/records/<spf_record_id>' \
--header 'Authorization: Bearer <authorization_token>' \
--header 'Content-Type: application/json' \
--data '{
  "properties": {
    "name": "",
    "type": "TXT",
    "content": "v=spf1 ip4:<IPv4 address of email server> ip6:<IPv6 address of email server> ~all",
    "ttl": 60,
    "enabled": true
  }
}'

Note: Replace <IPv4 address of email server> and <IPv6 address of email server> with IPv4 and IPv6 addresses of the email server.

7. Login to the email server using the new IPv6 address and test again the email deliverability using:

ssh root@2001:0db8::1

and send an email:

```bash
echo "This is a test email" | mail -s "Test Email" -a "From:sender@mail.demo-ionos.cloud" <your-email>@<your-domain>

8. We can check the mail.log using:

tail -f /var/log/mail.log

Result: You have switched from IPv4 to IPv6 and tested email deliverability.