HestiaCP: add a domain, DNS zone and mail domain

When you add a domain in HestiaCP, the panel can create the web domain, the DNS zone and the mail domain in a single step. This guide walks through that form, the records HestiaCP writes for you, your first mailbox, and the registrar change that makes the site and mail reachable from the internet.

You need root or panel access to a Linux VPS with HestiaCP installed, plus a registered domain you control.

Before you start

• A Linux VPS running HestiaCP. The panel is usually reachable at https://203.0.113.10:8083 — use your server's public IP.
• An admin account, or a normal user account. Admin can add domains to any user; a normal user can only add domains to their own account.
• Your domain registered and the registrar login ready. You will either change nameservers or copy a few records.
• DNS and Mail support switched on in the package assigned to the user. If either is off, the domain is created without a zone or without a mail domain.
• Optional: SSH access, for example ssh deploy@203.0.113.10, if you prefer the command line.

Add the domain in HestiaCP

1. Log in to the panel at https://203.0.113.10:8083.
2. Open Web and choose Add Domain (newer builds use a + button above the domain list).
3. Fill in the form:

• Domain: example.com
• IP address: your server's public IPv4 address
• Aliases: www.example.com
• Tick Create DNS zone and Create mail domain if those options are shown and you want them.

1. Save. HestiaCP creates the document root at /home/deploy/web/example.com/public_html and reloads the web server.

The same thing from the shell:

/usr/local/hestia/bin/v-add-web-domain deploy example.com 203.0.113.10
/usr/local/hestia/bin/v-add-dns-domain deploy example.com 203.0.113.10
/usr/local/hestia/bin/v-add-mail-domain deploy example.com

Upload your files to public_html over SFTP as the deploy user, or drop a test file there:

echo 'hello from example.com' | sudo -u deploy tee /home/deploy/web/example.com/public_html/index.html

Check the DNS zone HestiaCP created

Open DNS in the panel. You should see example.com with a set of records: A for the domain, A for mail, A for www, MX, and a TXT record carrying SPF. The zone file lives on disk under /home/deploy/conf/dns/. List what the panel holds:

/usr/local/hestia/bin/v-list-dns-records deploy example.com

If the mail domain has a DKIM key, copy the public key record into the zone as well — without it, receiving servers have no way to verify signatures from your server, and your mail is more likely to be filtered.

If your registrar or a third-party DNS provider hosts DNS for this domain instead, you can leave HestiaCP's zone in place. It simply will not be queried by anyone. Either way, you need the values from this screen — the server IP, the mail hostname, and the SPF and DKIM strings.

Create the mail domain and a mailbox

Open Mail. example.com should be listed as a mail domain because you ticked that option when adding the site. Open it and choose Add Account:

• Username: deploy (the address becomes deploy@example.com)
• Password: a long, unique password
• Quota: leave the default unless you have a reason to change it

Then send and receive mail with these settings:

IMAP  mail.example.com  port 993  SSL/TLS
SMTP  mail.example.com  port 587  STARTTLS
Username  deploy@example.com
Password  the password you just set

HestiaCP runs Exim and Dovecot for mail, and installs Roundcube as webmail on many setups, usually at https://example.com/webmail. To test delivery on the server:

tail -f /var/log/exim4/mainlog

For reliable delivery you also need correct mail DNS:

• A record for mail.example.com pointing at your server IP
• MX for example.com pointing at mail.example.com, priority 10
• TXT SPF, for example v=spf1 a mx ip4:203.0.113.10 ~all
• TXT DKIM with the public key from the mail domain
• TXT DMARC at _dmarc.example.com, for example v=DMARC1; p=none; rua=mailto:postmaster@example.com
• A matching reverse DNS (PTR) record for your server IP — see set your server hostname and reverse DNS

Point the domain at your server

Two routes, pick one:

Use HestiaCP as your DNS server. At the registrar, set the nameservers to the ones you run, for example ns1.example.com and ns2.example.com, with glue records for those hostnames pointing at your server IP. Every record is then managed in the panel.

Keep the registrar's DNS. Copy the A, MX, SPF, DKIM and DMARC values into the registrar's DNS editor. HestiaCP's local zone stays unused.

Check what the world sees:

dig +short example.com A
dig +short example.com MX
dig +short example.com TXT
dig +short example.com NS @1.1.1.1

Check it works

1. Load http://example.com in a browser. You should get your uploaded file or the panel's default page, not the HestiaCP login.
2. Issue a certificate: in Web, edit the domain, open SSL Support, choose Let's Encrypt and save. Then confirm with curl -I https://example.com.
3. Send a message from an outside account to deploy@example.com, then reply from Roundcube or your mail client.
4. On the server, tail -f /var/log/exim4/mainlog should show the message arriving and leaving without deferrals.

Troubleshooting

• The browser shows the panel or a default page for your domain → DNS is not pointing at this server yet, or the request is landing on another virtual host. Re-check dig +short example.com A and compare it with your server IP.
• No DNS zone appeared after adding the domain → DNS support is off for that user's package. Turn it on in the panel, or add the zone by hand under DNS → Add Domain.
• Record edits seem to have no effect → you are probably querying a cached resolver. Test the authoritative side with dig @203.0.113.10 example.com and allow the record TTL to expire.
• Mail lands in spam or is rejected → missing or wrong PTR, SPF or DKIM. Fix reverse DNS first, then re-check the TXT records with dig.
• Mail sits in the queue and never sends → outbound port 25 may be blocked upstream. Check the Exim log for connection timeouts, and ask your provider whether port 25 is allowed.

Next steps

• Postfix and Dovecot mail server setup on a Linux VPS if you want to understand what sits under HestiaCP's mail stack.
• Set your server hostname and reverse DNS before you send mail from a new IP.
• Add a swap file on a Linux VPS if your panel and mail services are tight on memory.