This server's DNS

Like cPanel, the server can be the authoritative DNS of the domains it hosts: no external provider, the records are ready and update by themselves. It uses PowerDNS and answers only for its own zones (no recursive resolution on behalf of others).

Activating it (administrator)

In DNS › This server's DNS enter two nameservers in a domain of yours (for example ns1.yourdomain.com and ns2.yourdomain.com) and press Activate this server's DNS. The panel installs PowerDNS, opens port 53 (UDP and TCP) in the firewall, creates the zones of the existing sites and adds "This server" to the DNS list, next to Cloudflare and 1PrimeCDN.

At your domain's registrar then create the nameservers (host or glue records) with the names and addresses the panel shows, and for each domain to host set those nameservers. Each zone page has the Checks: they tell when the delegation is active and whether everything is consistent.

If the provider has its own firewall (Vultr, Hetzner…), open port 53 UDP and TCP there too.

The zones

Every site has its zone, created by itself, with:

A/AAAA of the domain and of www;
mail: with the mail service active, MX, SPF, DKIM, DMARC, autoconfig and autodiscover are written by themselves (the "Mail DNS" box is already fine); without it, mail.<domain> points to this server;
CAA authorising Let's Encrypt;
NS and SOA with the version number updated at every change.

An alias on another domain has its own zone; a subdomain goes in its parent domain's zone. Records changed by hand are never overwritten. When you delete a site, the zone created for it is deleted; zones created by hand (New zone) stay.

Records are edited in the DNS editor as for the other providers: the panel checks the values and prevents invalid combinations (a CNAME next to other records, the zone's last NS).

DNSSEC

On the zone page Enable DNSSEC signs the zone (ECDSA P-256 key). The panel shows the DS record to enter at the registrar. To disable it, first remove the DS at the registrar.

Custom nameservers for resellers

A reseller can set its own nameservers (with its brand) in DNS: its clients' zones use them instead of the server's. At the registrar of its domain it creates the same names with this server's addresses.

Secondary server

A second Koapanel server can copy the zones, so the domains resolve even if this server stops:

Here: Add a secondary server, with the secondary's address and its name in the NS records (for example ns2.yourdomain.com). The panel creates a TSIG key and shows a pairing code (only once).
On the secondary: Become the secondary of another server and paste the code.

Zones are transferred only with the TSIG key and the secondary is notified at every change.

Who can do what

Administrator: activation, nameservers, secondary, every zone.
Reseller: the zones of its clients' domains and its own nameservers.
User: the zones of its own sites (not those shared with other accounts).