DNS records replaced after every HestiaCP update

Felix · July 31, 2026, 6:22pm

I have two domains on a HestiaCP based VPS. Both are based on this DNS template

ID='1' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns1%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='2' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns2%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='3' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns3%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='4' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns4%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='5' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns5%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='6' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns6%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='7' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns7%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='8' RECORD='@' TYPE='NS' PRIORITY='' VALUE='%ns8%.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='9' RECORD='@' TYPE='A' PRIORITY='' VALUE='%ip%' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='10' RECORD='www' TYPE='A' PRIORITY='' VALUE='%ip%' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='11' RECORD='mail' TYPE='CNAME' PRIORITY='' VALUE='host.example.com.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='12' RECORD='webmail' TYPE='CNAME' PRIORITY='' VALUE='host.example.com.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='13' RECORD='@' TYPE='MX' PRIORITY='10' VALUE='host.example.com.' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='14' RECORD='@' TYPE='TXT' PRIORITY='' VALUE='"v=spf1 mx a:host.example.com -all"' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='15' RECORD='_dmarc' TYPE='TXT' PRIORITY='' VALUE='"v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=s; aspf=s"' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='16' RECORD='cm._domainkey' TYPE='TXT' PRIORITY='' VALUE='"v=DKIM1; k=rsa;"' SUSPENDED='no' TIME='%time%' DATE='%date%'
ID='17' RECORD='_imap._tcp' TYPE='SRV' PRIORITY='0' VALUE='0 0 .'
ID='18' RECORD='_imaps._tcp' TYPE='SRV' PRIORITY='10' VALUE='1 993 host.example.com.'
ID='19' RECORD='_pop3._tcp' TYPE='SRV' PRIORITY='0' VALUE='0 0 .'
ID='20' RECORD='_pop3s._tcp' TYPE='SRV' PRIORITY='10' VALUE='1 995 host.example.com.'
ID='21' RECORD='_submission._tcp' TYPE='SRV' PRIORITY='0' VALUE='0 0 .'
ID='22' RECORD='_submissions._tcp' TYPE='SRV' PRIORITY='10' VALUE='1 465 host.example.com.'
ID='23' RECORD='_autodiscover._tcp' TYPE='SRV' PRIORITY='10' VALUE='1 443 host.example.com.'
ID='24' RECORD='autoconfig' TYPE='CNAME' PRIORITY='' VALUE='host.example.com.'
ID='25' RECORD='autodiscover' TYPE='CNAME' PRIORITY='' VALUE='host.example.com.'
ID='26' RECORD='@' TYPE='CAA' PRIORITY='' VALUE='0 issue "letsencrypt.org"'

After every HestiaCP update, on both these domains, the CNAME record of webmail is being overwritten/replaced from
'webmail' TYPE='CNAME' PRIORITY='' VALUE='host.example.com.'
to
'webmail' TYPE='A' PRIORITY='' VALUE='[VPS_IPv4]'

In essence, it stops pointing to the email server and instead it starts pointing to the HestiaCP VPS where the web site is located.

I have no clue where to look and how to troubleshoot this. Any bright ideas?

masterguru · July 31, 2026, 6:48pm

I am wondering how you created your custom DNS template, because checking the upgrade code I can only see this related to it:

cp -rf $HESTIA_COMMON_DIR/templates/dns $HESTIA/data/templates/

so maybe you have an old copy of your custom template in

HESTIA_COMMON_DIR/templates/dns

with that line

'webmail' TYPE='A' PRIORITY='' VALUE='[VPS_IPv4]'

that is overwritting the template used in

$HESTIA/data/templates/

every time that there is an upgrade.

Felix · July 31, 2026, 8:18pm

Good call! Let me check… I tracked
$HESTIA_COMMON_DIR/templates/dns
to actually be
/usr/local/hestia/install/common/templates/dns/
which only has the default templates:

-rw-r--r-- 1 root root 1285 Jul 30 18:29 child-ns.tpl
-rw-r--r-- 1 root root 1093 Jul 30 18:29 default-nomail.tpl
-rw-r--r-- 1 root root 2297 Jul 30 18:29 default.tpl
-rw-r--r-- 1 root root 1825 Jul 30 18:29 gmail.tpl
-rw-r--r-- 1 root root 2554 Jul 30 18:29 office365.tpl
-rw-r--r-- 1 root root 1554 Jul 30 18:29 zoho.tpl

My custom DNS template is named ARION.tpl and resides in /usr/local/hestia/data/templates/dns

I tried to locate other files with this name, just in case, and…

/root/hst_backups/180720260100/templates/dns/ARION.tpl
/root/hst_backups/220720250100/templates/dns/ARION.tpl
/root/hst_backups/290520260100/templates/dns/ARION.tpl
/root/hst_backups/300520260100/templates/dns/ARION.tpl
/root/hst_backups/310720260100/templates/dns/ARION.tpl
/usr/local/hestia/data/templates/dns/ARION.tpl

I understand that these are backups. I checked and all contain the correct CNAME. So the backup part of the update works correctly

I also checked /usr/local/hestia/data/users/[user]/dns.conf which contains this entry:

DOMAIN='domain.com' IP='[VPS_IPv4]' TPL='ARION' TTL='120' EXP='2031-12-31' SOA='ns.domain.com' SRC='' SERIAL='2026073104' MASTER='' SLAVE='' KEY='' DNSSEC='' RECORDS='38' SUSPENDED='no' TIME='19:47:47' DATE='2021-06-27'

which I think is correct, cause it mentions the right DNS Template (BTW, the TTL is too low because I’m gonna move it soon).

Problem not solved yet, but you gave me an idea where to continue looking at… The HestiaCP update code.

masterguru · July 31, 2026, 8:28pm

mmm… you right, I didn’t realize that

HESTIA_COMMON_DIR="$HESTIA/install/common"

so my theory was not fully correct.

Well, in this case, you can play with immutable attrib flag setting it to /usr/local/hestia/data/templates/dns/ARION.tpl in this way:

chattr +i /usr/local/hestia/data/templates/dns/ARION.tpl

and during next HestiaCP update just check update log to see where it fails or causes errors, trying to find the place where that change occurs to understand better how to fix it.

sahsanu · July 31, 2026, 8:48pm

Looks like it’s related to this issue: [Bug] Updater overwrites custom webmail A record in DNS zones

I’ll take a look this weekend.

Felix · July 31, 2026, 9:49pm

Scenario where the issue occurs: the domain has local mail enabled in HestiaCP

That’s exactly my case! I had enabled the mail domain, when email was served by the HestiaCP VPS. Then I moved the emails to an external server, but did not turn off the mail domain.

sahsanu · July 31, 2026, 10:23pm

If you want to test the fix:

cd /usr/local/hestia/bin/
mv v-add-mail-domain-webmail v-add-mail-domain-webmail.bak
curl -fsSL https://deve.dev/patch/v-add-mail-domain-webmail -o v-add-mail-domain-webmail && chmod +x v-add-mail-domain-webmail

Then you can rebuild your mail domain to test it or just execute v-add-mail-domain-webmail directly:

v-add-mail-domain-webmail YourUser YourMailDomain

Felix · August 2, 2026, 8:09pm

I confirm that after downloading your patched v-add-mail-domain-webmail and then running v-add-mail-domain-webmail YourUser YourMailDomain the webmail DNS record was intact.

Thank you very much!! You’re just awesome!

sahsanu · August 2, 2026, 9:16pm

Thanks for testing it.

This PR should fix it:

Felix · August 5, 2026, 7:16am

Unfortunately the patch did not “survive” the 1.9.9 update >.<
Unless it wasn’t supposed to. I mean if the patch wasn’t merged in 1.9.9, then it’s not expected to “survive”

eris · August 5, 2026, 8:21am

It was not included 1.9.9

Will be in 1.10.0