Every domain added to DirectAdmin gets a DNS zone, whether or not anything queries it. If the domain's nameservers point at the server, that zone is the domain's DNS and the panel is where you edit it. If they point elsewhere, the zone is a template you copy from. This post covers both cases, the records people change most, and how to tell whether a change has taken effect.
DNS Management for a domain
At User Level, open Account Manager → DNS Management and pick the domain. The page lists every record in the zone, grouped by type, with a form at the top to add one.
A new domain's zone contains: an A record for the bare domain and for www, mail and ftp; NS records for the server's nameservers; an MX record pointing at mail.example.com; the SPF TXT record; and, if the server has IPv6, matching AAAA records. That is enough for a website and mail on this server.
The form takes a name, a type, a value and a TTL. The name is relative to the domain, so blog means blog.example.com and the bare domain name means the domain itself. Values follow the type: an IP for A and AAAA, a hostname ending in a dot for CNAME, MX and NS, quoted text for TXT.
The record types DirectAdmin supports are A, AAAA, CNAME, MX, TXT, SRV, CAA, NS and PTR. What each does, and when to use CNAME rather than A, is in DNS record types explained.
The changes you will actually make
Point the site elsewhere. Edit the A record for the bare domain and www, leave everything else. Mail keeps working because MX still points at mail.example.com, which still points here.
Use Google Workspace or Microsoft 365 for mail. Delete the existing MX record, add the provider's MX records with their priorities, and replace the SPF TXT with theirs. Then tell the server to stop treating the domain as local, on the domain's E-mail Manager → MX Records page, otherwise mail sent from a PHP script on this server to you@example.com lands in the local mailbox instead of going out. That is the step everyone forgets.
CAA. Add 0 issue "letsencrypt.org" on the bare domain to restrict which authorities may issue certificates. A CAA record that does not list Let's Encrypt makes ACME issuance fail, so check here first when a certificate will not renew.
TTL
TTL is how long resolvers cache an answer, in seconds. DirectAdmin's default is 14400, four hours. Before a planned IP change, lower the TTL on the records that will change to 300, wait at least the old TTL so caches have picked up the short value, then make the change and raise it back afterwards. Lowering the TTL at the same moment as the change achieves nothing.
Enable DKIM
Once the administrator has turned DKIM on server-wide, DNS Management shows an Enable DKIM button. It generates a key pair, adds the x._domainkey TXT record and makes Exim sign outgoing mail for the domain. If DNS lives elsewhere, copy that record there exactly; one missing character and the signature fails. The rest of mail authentication is in creating email accounts in DirectAdmin.
Admin Level: DNS Administration
Administrators have Admin Level → Server Manager → DNS Administration, which lists every zone on the server, including zones that belong to no user. From there you can edit any record without logging in as the user, add a zone for a domain that is not hosted here, or delete a stale zone after a user has gone.
The nameservers a new zone gets are set under Admin Level → Server Manager → Administrator Settings. Resellers can define their own under Reseller Level → Account Manager → Name Servers, so their customers' zones show ns1.reseller.com rather than yours.
Nameservers and glue
For ns1.example.com and ns2.example.com to work as nameservers, two things must be true. The zone for example.com on this server must contain A records for ns1 and ns2, which DirectAdmin adds when you create the nameservers. And the registrar for example.com must have those hostnames registered as nameservers with their IPs, the glue records, without which a resolver is told to ask ns1.example.com and has no way to find it. Registrars label this "register a nameserver", "child nameservers" or "host records". Two nameservers on one server is common and works, at the cost of both going away when the server does.
Using Cloudflare or another external DNS instead
Many people keep DNS at Cloudflare or the registrar, and that is fine: DirectAdmin does not require the server to be authoritative. Create the zone at the provider, copy the records from DNS Management, and change the domain's nameservers at the registrar. The local zone keeps existing and the panel keeps updating it, but nothing queries it, so every panel change you rely on, a new subdomain, the DKIM key, the mail record for a certificate, has to be repeated at the provider by hand.
Checking that a change is live
Ask the server itself first, then the world:
dig @server1.example.com blog.example.com A +short
dig blog.example.com A +short
dig +trace blog.example.com AThe first line confirms the zone file is right; if it is wrong here, look at /var/named/example.com.db and at named in Service Monitor. The second shows what your resolver has cached. The third follows the delegation from the root and shows which nameservers are actually being asked, which is how you catch a registrar still pointing at old ones. Changes at the server are live immediately; the rest of the internet takes up to the old TTL.
On a VPSPioneer managed VPS with DirectAdmin we set up the nameservers and glue with you at handover, so the zone works from the first domain you add.