Skip to main content
← back to home FR

Plesk DNS Integration

Plesk remains your DNS source; le_dns publishes the desired zone

Pre-launch pilot: this guide documents the in-tree v2 extension. It is not deployed on the legacy production platform and cannot be installed from a live le_dns account yet. Use it only after le_dns explicitly admits your panel to the October 2026 pilot and provides the package and v2 endpoint. A Pro or Enterprise subscription alone does not activate the preview. Until server-side pilot enrollment is deployed and your panel is enrolled, the integration is unavailable.

Before you connect

The extension supports Plesk Obsidian 18.0.63 or newer on Linux and requires a le_dns Pro or Enterprise plan plus explicit pilot enrollment of one exact installation UUID. Windows panels and Plesk releases older than 18.0.63 are outside the supported scope. A pilot administrator first preallocates a random UUID and grants that exact account-and-installation enrollment. Your Billing page then exposes the generic package only for that active UUID. The UUID is not a secret; authority comes from the interactive session, audited enrollment and later Plesk-scoped key. Do not reuse a full customer API key or a key created for another Plesk installation. The connection check returns only the key scope, bound installation UUID, current tier and Plesk eligibility; it does not expose the account identity, quotas or unrelated features to the panel.

Plesk 18.0.63 introduced the custom-backend domain lifecycle messages required for safe creation, update and deletion. Before installing, a server administrator must configure this exact setting in /usr/local/psa/admin/conf/panel.ini:

[dns]
newEvents = true

Record plesk version and inspect the active section with sed -n '/^[[:space:]]*\[dns\][[:space:]]*$/,/^[[:space:]]*\[/p' /usr/local/psa/admin/conf/panel.ini. The extension validates both requirements before contacting le_dns, storing a credential or registering its backend. It fails closed if either requirement is missing and never edits panel.ini for you.

Download the extension package for the preallocated UUID from your le_dns Billing page, verify the shown SHA-256 checksum, then upload it in **Extensions

My Extensions** in Plesk. Open le_dns and paste that exact UUID. Create a dedicated API key with Plesk only authority for the same UUID, enter the API endpoint and key, and run the connection check before enabling synchronization. The first successful connection locks the UUID; a restored or cloned panel must use the guarded rotation or adoption workflow instead of changing it locally.

The upload button is disabled by default on recent Plesk releases. If it is not visible, the server administrator must explicitly enable extension uploads in panel.ini or install the supplied ZIP with plesk bin extension -i /absolute/path/le-dns-0.1.0-1.zip; do not download a similarly named package from an untrusted mirror.

How synchronization works

Plesk remains the management source. Its complete desired DNS state is queued locally and sent to le_dns over HTTPS. Each zone update is ordered by the Plesk SOA serial and applied transactionally, so an older event cannot replace newer published data. Platform SOA and apex NS records remain owned by le_dns.

The extension shows queue progress and retains failed work for bounded retry. If retries reach Needs attention, fix the connection problem, then confirm Resynchronize all zones. This restarts terminal synchronization work for domains still present in Plesk, without requiring a DNS edit. Pending retries, billing holds and zone retirements keep their existing schedule. When a plan downgrade makes synchronization read-only, already published DNS data remains served; status and disconnect remain available.

A payment failure during billing grace is different from a downgrade. Plesk keeps each accepted desired state in its local queue and retries it at most once per hour without exhausting the normal delivery limit. The last published DNS state stays online. Once billing recovery is confirmed, queued changes resume automatically; if the account was actually downgraded after grace, restore Pro or Enterprise and run Resynchronize all zones.

Deleting a Plesk zone

Deleting a zone in Plesk queues safe retirement at le_dns; it does not wipe the published records immediately. The request is bound to this installation’s last acknowledged SOA serial and desired-state revision, so an older delete cannot retire a newer resynchronization. If DNSSEC is active, the extension will tell you to remove the complete DS RRset at the parent registrar and will continue serving the signed zone while le_dns proves absence and drains the observed DS TTL. Authoritative withdrawal and managed-key cleanup follow before the zone is reported Safely retired.

Keep the panel and its dedicated key connected until retirement is terminal. This authority-reducing work continues after a plan downgrade or during a billing hold. By contrast, disabling or uninstalling the whole extension is a non-destructive disconnect and retains remote zones.

Delegation and verification

Synchronization creates a pending zone; it does not prove ownership or make the zone authoritative. Publish the _ledns-verify TXT challenge through Plesk, wait until the current public authority answers it, then sign in to the le_dns portal and verify the zone. The Plesk credential is intentionally unable to perform that verification. Retry in the portal until it reports serving=true for every authoritative replica.

Only then delegate at the registrar to the nameservers shown by le_dns. Delegation state is informational until public DNS observation confirms it. Never remove the previous provider before verifying the new authoritative answers from outside your network. The v2 published set is ns-gra.ledns.eu, ns-lim.ledns.eu and ns-waw.ledns.eu; delegate all three when the pilot operator confirms that your zone is ready.

The DS for the synchronized zone is parent-side delegation data: publish it at the registrar or parent DNS provider, not in the zone itself. DS records below the apex remain supported when this zone delegates one of its own children.

Uninstall and recovery

Disable or uninstall through Plesk so the extension can disconnect and revoke its bound API key. If le_dns is unreachable, check the Plesk action/panel log and manually revoke the key in the le_dns portal before treating the uninstall as complete; extension-local warning files do not survive a completed uninstall. A restored or cloned panel must enroll a new installation UUID and create a new key already bound to it. If the old installation retained remote zones, an operator must then complete the guarded installation-adoption workflow before the replacement panel performs a fresh complete resynchronization. Never reuse the source-panel identity or bearer.

For rollback before delegation, disable synchronization and confirm the custom backend is no longer registered; no live le_dns zone is deleted. After delegation, first restore the previous provider’s complete zone and registrar NS set, verify authoritative answers externally, then disable the integration.

For help, email support@ledns.eu.