DNS Manager Module

DNS Manager is a paid XtreamGo module that rewrites every player URL, Xtream Codes endpoint, and M3U output from your panel's raw IP into rotating subdomains. End users only ever see hostnames like cdn-3.your-domain.com — the underlying server IPs stay hidden and can be rotated without breaking active sessions.

You can plug in Dynu (free + paid, recommended for fast rotation), Cloudflare (proxy mode hides IPs behind their network), or a manual provider where you operate your own DNS. The panel never stores Dynu API keys centrally — each customer enters their own keys in Settings, so the patron CMS DB stays at 0 rows. The Cloudflare integration is also opt-in per customer.

Layer 1 is reseller_subdomains (stable customer-facing hostnames). Layer 2 is user_subdomains (app-level zero-quota lines that route through a different hostname). Layer 3 is the load-balancer rotation (LB hostnames cycle every N minutes by default). Each layer is independent so you can tune isolation vs. simplicity per customer.

A background goroutine runs every 5 minutes and resolves every active subdomain against your configured DNS provider. If a record returns NXDOMAIN (which happens with Dynu free-tier records that get silently purged after 9 hours), the daemon auto-recreates it from the active rotation pool. You see the audit trail in Settings → DNS Manager → Health Log.

Attempted abuse — credential stuffing, brute force, suspicious user-agents, geographic anomalies — feeds the auto-ban engine. Banned IPs and entire subdomains appear on a real-time heat map you can filter by hour or country. Manual unblock and per-rule sensitivity tuning are in the Security Center.

If you enter Cloudflare API token + Zone ID, the panel can create your subdomain records, switch the orange-cloud proxy on, and inject the recommended firewall rules (rate limits, bot fight mode, country block lists) in one click. Cloudflare keeps your origin IP hidden behind their POPs — perfect for the "Hidden Origin" stack.