Web Portal User Manual For

Web Portal User Manual for

Afilias Managed DNS – Web Portal User Manual

Contents 1. Introduction ...... 1 1.1 About Afilias Managed DNS Service ...... 1 1.2 Afilias Managed DNS Service Website Help ...... 1 1.3 Support ...... 2 2. DNS Portal Login Screen ...... 4 3. MyAccount Screen ...... 5 3.1 Users & Groups ...... 5 3.1.1 User Details Tab ...... 6 3.1.2 User Password Tab ...... 7 3.1.3 Users Tab ...... 8 3.1.4 Groups Tab ...... 9 3.2 Add User ...... 9 3.3 Delete Users ...... 11 3.4 Add Groups ...... 12 3.5 Delete Group ...... 16 3.6 Managing Security ...... 18 4. Domains Screen ...... 19 4.1 List Domains ...... 20 4.1.1 Remove Domains ...... 20 4.1 2 View/Edit Domain Configuration ...... 21 4.2 Add Domain or Zone ...... 21 4.2.1 Add a Primary Domain - Maintained on the Afilias DNS Portal ...... 21 4.2.2 Verification of Primary DNS Changes ...... 28 4.2.3 Add a Secondary Domain - Maintained on an External Server...... 29 4.2.4 Verification of Secondary DNS Changes ...... 32 5. Reports ...... 32 6. Billing ...... 33

Web Portal User Manual

1. Introduction

1.1 About Afilias Managed DNS Service Afilias provides a premium DNS (Domain Name System) service for resolution of public domains, i.e. domains that are registered on the Internet, as opposed to private domains on the internal network of an organization. Based on a global network of dedicated high performance servers that are monitored 24 hours a day 7, days a week, Afilias Managed DNS provides superior response times to all DNS lookups and queries. This manual provides the technical details for administrators who manage the public domains of an organization on the Afilias Managed DNS service. For more general details about this service, see the product information on the Afilias web site, http://afilias.info/products-services/dns. A basic understanding of DNS concepts and terminology is assumed. Good introductory information about DNS is available in many books as well as articles on the Internet.

1.2 Afilias Managed DNS Service Website Help Once you access the website, you will notice that many screens have ? question marks displayed next to a label or description. If you place your cursor over the ? and wait a second, a small window will pop up with help information on that specific item. For more detailed help, click on the “Help” link which is in the top right corner of every screen. This will open the Help page in a new browser tab/window. On the Help page, there is a link to Frequently Asked Questions (FAQs) and this User Guide. Simply click on the link for the information you would like to see. See the example below.

Help Screen

1.3 Support The Afilias Customer Service Center maintains a 24 x 7 schedule so you can also contact them any time at the phone number shown at the top right-hand side of each screen (enlarged below).

Afilias Technical Support Telephone Number

If you have any technical questions or problems, you can send a message to the Afilias Customer Service Center. Click on the Support tab on the main menu and then follow the steps shown below.

Contact Support Screen

2. If the Reply to: email address is different from your User/Email address, then provide it here. 3. In the Subject text box, type the reason for your support request. 4. Explain your question in detail in the Description of the issue text box.

5. When you click Submit, an email will be sent to the Afilias Customer Service Center where it will be assigned a “ticket” number. You will receive an email response that provides the ticket number. If you need to follow up on the same issue, you cannot reply to the email you received. You can use this Support form to send further information or questions about the issue by using the same subject description and including the ticket number.

2. DNS Portal Login Screen The following procedure describes how you access the Afilias Managed DNS Services web site. 1. Direct your browser to: https://afiliasdns.info or use the link from the Afilias web site product page, http://afilias.info/products-services/dns

DNS Portal Login Screen

2. Login to your account by typing your Username (which is usually your email address) and Password in the appropriate text boxes in the MyAccount section. NOTE: Click the Forgot your password? link to reset your password if necessary. After clicking this link and filling out the requested information, an email will be sent to the

email address stored in the User Details (under MyAccount), with instructions on how to complete the password reset. If you do not have access to that email address, or if you have forgotten your username, then you will have to ask for assistance to reset your access as explained below:  If your organization has multiple users on the system, an AccountMaster user can change your email address, look up your username and/or reset your password.  If you are the only AccountMaster user on the account, then you must call the Afilias Customer Service Center for help. The Customer Service Center phone number is shown on the top of every screen next to the telephone icon. 3. Click the Login button to access the system. The List Domains screen displays (See section 4.1 List Domains). This will show you all of the domains that have been created on this account. If this is a new account and you are an administrator for the account, you may want to begin on the MyAccount screen to set up Users and Groups.

3. MyAccount Screen

3.1 Users & Groups The Users & Groups screen allows you to manage the users and groups on your account. Users of the service are assigned to a group (also called a role). A group has a set of permissions that allow or restrict different operations. The following groups are available on every customer account, but you can also create your own groups with different sets of permissions. • AccountMaster – users in this group have full permission for all operations. • AccountView – users in this group are limited to only viewing information. They do not have permission to add, disable, edit or delete users or domains.

1. Move the cursor over the MyAccount drop-down menu on any screen to see the menu offerings. 2. On the drop-down menu, click Users & Groups. MyAccount Drop-down Menu, Users & Groups Selected

The Users & Groups screen has four tabs: Four Tabs of Users & Groups Screen

3.1.1 User Details Tab The User Details tab (shown below) provides information stored about the user (sometimes called the user “properties”). When edits have been made, click Save to make the changes or Cancel to stop them. It is important to keep the email address current as system notices will be sent to this address and it is needed for resetting a forgotten password. Since the Username (email address) cannot be changed, you will have to delete the user and create a new user with the new email address.

MyAccount Screen, Users & Groups – User Details Tab

3.1.2 User Password Tab The User Password tab allows you to change your login password. Simply type the Current Password. Then type the New Password, once initially, then again in the Confirm New Password text box. Click Save.

MyAccount Screen, Users & Groups – User Password Tab

3.1.3 Users Tab The Users tab shows a list of all the users on the account and the groups to which they belong. To view and/or edit the account details of a user, click the Edit icon (the small image of the pencil over paper). To delete users, see the steps described in 3.3 Delete Users. You have to be an AccountMaster or have Users Change permissions to be able to view, add, update, delete, disable, or reset user-password. You can also see users information if you have Users View permission.

MyAccount Screen, Users & Groups – Users Tab

3.1.4 Groups Tab The Groups tab shows the groups currently defined in your account and a list of their permissions. It also allows you to add groups. See 3.4 Add Groups below.

MyAccount Screen, Users & Groups – Groups Tab

3.2 Add User Use the steps below to create new users on your account. Provide the requested information and do not omit any steps. 1. Click Add User on the MyAccount drop-down menu.

MyAccount Drop-down Menu, Add User Selected

The Add User screen displays.

Add User Screen

2. Make sure that you type the correct email address in the User Name/Email text box, as it will be used to send an email messageto the new user, containing instructions and a link for them to set their password. 3. Required fields are Full Name, Work Phone, Address, City, State, Zip. If the address location does not have a Zip or Postal Code, enter n/a or a blank space. 4. Use the drop-down arrow to select the appropriate Country. 5. Assign the appropriate role (group) for the user in Assign Roles by clicking the down arrow to the right of the text box and selecting from the available choices. The role assigned to a user determines what they are allowed to do on the account. See 3.4 Add Groups below. NOTE: A user must be assigned to a role (group) and cannot be assigned to more than one. 6. Click Add to complete the screen and create the new user, or click Canc el to stop the process.

3.3 Delete Users Use the steps below to delete users from your account. 1. Click the Users tab on the MyAccounts, Users & Groups screen.

MyAccount, Users & Groups – Users Tab

2. Click the check box in the Delete column for the user you wish to remove. 3. Click the Delete button. A successful deletion message will display and the user will be deleted from the account.

3.4 Add Groups Groups are used to define a set of permissions that will apply to a user when the user is assigned to the group. Groups may be used by any user on the account who has permissions to create users. Groups created on your account will not be visible to users on other accounts on the Afilias Managed DNS system. Basic permissions are defined in the system and apply to defined objects. A user can define new groups but cannot define new permissions or objects. The permissions are: • Change – the user is allowed to add, delete, edit, view the object. • View – the user may only view the object. • None – if no permissions are enabled, then the user cannot even view the object. The Objects control access to the following parts of the system: • Users • Groups • Domains • Reports There is a special “built-in” group in the system: • AccountMaster is a group with all the Change boxes turned on (the “Super” user). Built-in groups cannot be changed or deleted. When a new customer account is created, two AccountMaster users are set up – the Primary and Secondary contacts. Only AccountMaster users can create, change and delete other AccountMaster users. There is one default user defined group on each new account. Users on the account may change or delete this group just like any other user defined group. • AccountView is a group with all the View permissions turned on. This user can view everything on the account but cannot change anything. You may not need any more groups than these two. However, if you are an AccountMaster and want to delegate day-to-day administration of the account to someone else without giving them all the “super” admin rights of an AccountMaster, you can create another group. The following example shows how to create such a group. It has all the permissions of

an AccountMaster except that users in this group cannot create, change or delete AccountMaster users. Provide the requested information and do not omit any steps. 1. On the MyAccount, Users & Groups screen, Groups tab, (shown in 3.1.4) click the Add Group link.

Users Tab, Add Group Link

The Group Management - Add screen displays.

Group Management – Add Screen

2. Use the Change and Vi ew check boxes to indicate the desired permissions for Users, Groups, Domains and Reports. For an administrative user with all rights (except the “super” admin rights of an AccountMaster), set the Change permission on all objects. 3. In the Role Name text box, enter the name that you wish to use for this group. It must be a name that is not being used for any other group. The role name must be at least two characters in length. (In the example above, the group “AccountModify” is being added.)

4. Click Add to complete the screen and create the new group, or Cancel to stop the process. A message displays stating the new group has been added to the Groups list. The new group name shows in the Groups list with its Record Type/Permissions settings.

Example Showing New Group “AccountModify” Added to List of Groups

3.5 Delete Group Use the steps below to delete a group (role) from an account. 1. On the MyAccount, Users & Groups screen, Groups tab, choose the group you wish to remove by clicking [delete] (following the group name) as indicated in the example below. NOTE: You cannot delete a group if it has users associated with it. To delete such a group, you must transfer those users to another suitable group.

MyAccount, Users & Groups – Groups Tab

The Group Management – Delete screen displays.

Group Management – Delete Screen

2. The detailed Group information will be displayed. Click the Delete button to confirm removal of the group, or click Cancel to stop the deletion.

3.6 Managing Security The Security function lets you control access to the system. 1. Click Security & Alerts on the MyAccount drop-down menu.

MyAccount Drop-down Menu, Security & Alerts Selected

The Security screen displays.

Security Screen

2. Enter a list of IP addresses from which you wish to allow Login access. By default, the system will display the IP address of the machine being used in the current Login session. If you access the Afilias DNS web portal from several locations, you must enter a list of all the IP addresses. These are entered in a comma separated list. Note that most organizations have a firewall between the internal network and the Internet which ‘hides’ the actual IP address of your machine. The Afilias DNS web portal ’sees’ the external (Internet) address of your organization’s firewall, not the IP address of your machine. This means that using this Security restriction will allow access from any machine within your organization that uses the same firewall. This also means that even when you use the same laptop computer, the Afilias DNS web portal will see different IP addresses from different locations. For example, if another office location in your company uses a different firewall to connect to the Internet, you will not be able to Login from your laptop there unless you add the necessary IP address to the list. IMPORTANT! If you are not sure of the IP address at other locations (including hotels), then you should de-activate this feature before you travel. Otherwise you may be locked out of logging in to your account. If you work from a home or small office using a broadband Internet connection, you should be aware that a power reset of your cable/DSL modem may result in a different IP address being assigned to your machine by the ISP. This could result in you being locked out from logging in to your account. If your Login gets locked out due to one of these conditions, you can call the Afilias Customer Service Center and have them de-activate the Security feature on your account. 3. Click the Activate check box. 4. Click the Submit button (or Cancel if you do not wish to continue). A message will display if the update is performed successfully.

4. Domains Screen The tabs under this menu allow you to manage the Domains on your account. There are two types of services provided by Afilias Managed DNS. • Primary (Master) Domain – all the domain information is entered and maintained on the Afilias DNS web portal. • Secondary (Slave) Domain – the master domain information is maintained on your own server or a server external to Afilias. 1. On the D om ai ns menu, click List Domains to see the domains being managed by Afilias.

Domains Drop-down Menu – List Domains

The List Domains screen displays.

4.1 List Domains This tab shows all the domains on the account being managed by Afilias, including any domains that were set up by another user on the account.

List Domains Screen

4.1.1 Remove Domains To remove one or more domains from the Afilias Managed DNS service:

1. On the List Domains screen, select the check box under the Delete column for the domain you wish to remove. (In the example below, the “green.com” domain (zone) is selected to be deleted.)

List Domains Screen, with Domain Selected for Deletion

2. Click the Delete button. A message displays showing the domain (zone) was successfully removed.

4.1 2 View/Edit Domain Configuration To view and/or edit the domain configuration, click the Edit icon (detailed instructions on how to enter configuration information are in the Add sections following).

4.2 Add Domain or Zone

4.2.1 Add a Primary Domain - Maintained on the Afilias DNS Portal 1. Click Add Domain on the Domains drop-down menu.

Domains Drop-down Menu – A dd Dom ain

The Add a New Domain screen displays.

Add a New Domain Screen

2. Click the Add Primary Domain - Maintained on DNS Portal link if you want Afilias to be a Primary (Master) DNS for the domain.  Your domain configuration will be stored in an Afilias database and distributed to the Afilias DNS network. You should already have a registered domain name.  Afilias Managed DNS does not register new domain names; this is done via any number of third party Internet domain name registrars.  Once you have ownership of a domain name, you can set it up as a Primary DNS on the Afilias service. The Add Primary Domain - Maintained on DNS Portal screen displays.

Add Domain Maintained on DNS Portal Screen

2. Type the Domain Name that you wish to add in the text box. 3. Click Add. (In the example above, the domain name to be added is “orange.com”.) The Add Domain screen displays. There are two tabs, a Start of Authority (SOA) tab, and a Resource Records tab. 4. Complete the SOA Record tab (see below). This tab provides global parameters for the zone. Default values are generally recommended. All time values must be entered in seconds. NOTE 1: None of your changes are saved until you click the Save button at the bottom of the screen. After saving your changes, it may take a few minutes before the information is propagated to the Afilias DNS network. NOTE 2: You cannot enter the Name Servers (NS) for the domain. They are set up automatically, as shown in the read-only fields.

a. Type the email address of the person responsible for the zone in the Contact Email text box (see below). b. In the Default TTL (Time To Live) text box, type the length of time (in seconds) that resource records will be cached unless overridden by a TTL configured for each record. Default: (1 day) c. The Serial number cannot be changed. It is automatically set and incremented every time your saved changes are propagated to the Afilias DNS servers. d. In the Refresh box, select the time interval for how often a secondary polls the primary. If a higher serial number is detected, the secondary will request a zone update. Default: 900 (15 minutes) NOTE: The Afilias DNS network uses Notify so this is rarely used for a zone update. e. In the Retry box, type the length of time between retries if the secondary fails to contact the primary when refresh has expired. Default: 300 (5 minutes) f. Use the Expire box to type the length of time the zone data on a secondary is authoritative after the last contact with the primary. Default: 864000 (10 days) NOTE: Expiry in the Afilias DNS network is extremely unlikely. g. In the Negative Cache box, type the length of time a “Non-Existent Domain” reply (NXDOMAIN) is cached. Default: 600 (10 minutes).

Add Domain Screen, SOA Tab Example

5. Complete the Resource Records tab (below).

Add Domain Screen, Resource Records Tab Example

a. Use the Select Record Type option to restrict the display to a particular type of record. Select the option in the drop-down list and click the View button. NOTE: If you leave default “All”, all of the record types will display, as shown in the example below.

b. Click the View button. The resource records for the domain display as the tab updates to show more information on all record types.

Resource Records Tab, All View

c. To change an existing record, type your change into any of the text boxes. d. To add a new record, type your entry in the text box following Add: You can make multiple changes at the same time before clicking the Save button. For example, you could add an A record and an MX record, change an A record and delete two CNAME records. When you click Save, all of those changes will be submitted.

Each resource record type is described in more detail following. All have a TTL override. Generally leave this blank if you want the record to be cached for the same time as the Default TTL configured on the SOA tab. If you want a different value, then enter and it will apply only to that record. All host names and domain names must be fully qualified domain names (FQDN). That is, they must contain the complete name, as in “www.mydomain.info”. However, if the name is on the domain being configured, you can enter only the first part, up to but not including the dot and the domain name will be appended. So you can just enter “www” for the example above (assuming the domain being configured is “mydomain.info”). If you want a host name to be the same as the domain name, then simply enter the full domain name to create such an “apex” record. 1) Map a host name to an IPv4 “Address” using the A: Host record type. This provides the basic DNS name resolution of translating a name into an IP address.

 Host name to Address mappings do not need to be unique.  Multiple A records can be entered to map serveral different host names to the same address.  The same host name can be mapped to more than one address. 2) Use the CNAME: Alias record type to map an alias name (must be within the domain or subdomain) to a “Canonical Name”, or real name.

 The alias must be within the domain.  The real name may be on the domain or an external domain.  The CNAME (alias) must not be used in other resource records like MX, NS or TXT. 3) The MX (Mail Exchange): Domain record specifies the host name of the mail server that handles email for the domain.

 If that mail server is in the domain, you must also enter an A record to provide its IP address.  If you have more than one MX record, you can set the Priority of the servers. Lower numbers have higher priority. 4) Name servers for the domain are set up automatically on the Afilias network (as shown on the SOA tab). The NS (Name Server): D om ain record is used only to define a name server for a subdomain. If that name server is in the domain, you must also enter an A record to provide its IP address (sometimes called a glue record).

5) Use the TXT: Host field to associate arbitrary “Text” with a host name. This record is also used by some standards for controlling spam email, such as SPF (Sender Policy Framework) and DomainKeys.

6. Click Save to save the information, or click Canc el to stop the process. When you click Save, your configuration is written to a database. From there, it is propagated to the name servers on the Afilias DNS network. This may take a few minutes to occur.

4.2.2 Verification of Primary DNS Changes A good way to verify that changes have been propagated to the Afilias DNS network is to verify that the serial number on the Afilias name servers has been incremented and matches your configuration. Every time you save domain configuration changes, the serial number is incremented. 1. Refresh the SOA display to see the current serial number of your configuration. The SOA tab also shows the Afilias name servers for your domain. 2. Use dig, host or nslookup on Linux/Unix, or nslookup on Windows, to display the SOA record (which contains the serial number) on the Afilias DNS network. NOTE: Remember that you must wait a few minutes after saving your configuration for it to be transferred to the Afilias name servers.

STEP 1. If you are verifying a new domain that you have just added, you need to query against one of the Afilias name servers for the domain. The following are examples using dig and nslookup to display the SOA information for the domain, where a. service.afiliasdns.info is an Afilias name server. dig @a. service.afiliasdns.info mydomain.name soa nslookup -type=soa mydomain.name a. service.afiliasdns.info You may want to run some additional queries to make sure that specific names are resolving correctly, as in: dig @a. service.afiliasdns.info www.mydomain.name STEP 2. Once you have confirmed that your domain configuration is being resolved on the Afilias network, you are ready to go live and have Afilias resolve your domain on the Internet. To accomplish this step, you need to add all the Afilias name servers into the domain registry where you purchased your domain. After some delay (depending on the provider), you should verify that your domain resolves on the Internet. STEP 3. To confirm that your domain is being resolved on the Internet, run dig/nslookup queries without specifying an Afilias name server, as in the following examples: dig mydomain.name soa nslookup -type=soa mydomain.name

4.2.3 Add a Secondary Domain - Maintained on an External Server The information for the domain is pulled from your primary (master) DNS server into the Afilias DNS network by a zone transfer (AXFR/IXFR). 1. Click Add Domain on the Domains drop-down menu.

Domains Drop-down Menu – A dd Dom ain

The Add a New Domain screen displays.

Add a New Domain Screen

2. Click the Add Secondary Domain - Maintained on External Server link if you want Afilias to be a Secondary (Slave) DNS for the domain. NOTE: The domain must be on a Primary DNS server that is capable of performing a standard AXFR/IXFR zone transfer to the Afilias DNS network over the Internet. The Secondary Domain - Maintained on External Server screen displays.

Secondary Domain - Maintained on External Server Screen

3. In the Zones box, list all the domains that are to be transferred from the primary server. 4. Specify the IP address of the primary server in the text box. 5. If you are using the standard port 53, do not change the Port text box. Otherwise, change accordingly. 6. Click Add to add the domain, or Cancel to stop the process. 7. Configure your server to notify the Afilias server when zone changes are made and to allow the Afilias servers to do the zone transfer.

The following example shows the IPv4 and IPv6 addresses that are needed and how they would be used in a zone statement in the named.conf file for BIND9. zone " mydomain.name" { type master; file "db.mydomain.name"; allow-transfer { 199.19.48.0/23; 2001:500:6::/47; }; also-notify { 199.19.48.100; 199.19.49.100; 2001:500:6:400::100; 2001:500:7:400::100; }; };

4.2.4 Verification of Secondary DNS Changes A good way to verify that changes have been propagated to the Afilias DNS network is to confirm that the serial number on your primary (master) DNS server matches that on the Afilias secondary servers. NOTE: Remember that you must wait a few minutes after saving your configuration for it to be transferred to the Afilias network. Examples of dig/nslookup commands that can be used to display the serial number on the Afilias servers are shown in Section 4.2.2 Verification of Primary DNS Changes. Follow the STEP 1/STEP 2/STEP 3 sequence in this section to verify doman resolution before and after ‘go live’ configuration on your domain name provider. If you are unable to verify the matching serial number on the Afilias network, check the logs of your DNS server to determine if the notify command was sent successfully and if the zone transfer was completed. If notify/zone transfer failed, your zone will not get updated on the Afilias network until the Refresh time in the SOA of your Primary server. 5. Reports In a future release this section will providesummary information and status about all your managed domains.

6. Billing In a future release, this section will provide information about your usage and copies of current and past invoices.