Night Warden

Guide · DirectAdmin

Updating DirectAdmin with CustomBuild: what the defaults do and how to stay current

Published 24 October 2026

On a DirectAdmin server, dnf upgrade updates the operating system and leaves alone the parts your customers actually use: PHP, the web server, Exim, Dovecot and MariaDB. CustomBuild compiles and owns those. This guide covers what CustomBuild does by itself, how to check and apply its updates, and the one thing its version check never tells you.

Why dnf skips PHP and MariaDB

DirectAdmin writes an exclude line into the package manager configuration, so the OS updates never overwrite its builds:

$ grep ^exclude /etc/yum.conf
exclude=apache* bind-chroot* dovecot* exim* httpd* mariadb-server* MariaDB-server* mod_* mysql-community-server* mysql-server* nginx* php* proftpd* pure-ftpd* sendmail* vsftpd

That is the right design, and it means automatic updates (dnf-automatic, or unattended-upgrades on Debian and Ubuntu) do nothing for these services. Their updates come from CustomBuild or not at all.

What CustomBuild does out of the box

CustomBuild has its own cron job. These are its settings on a default install:

$ da build opt_help | grep -E '^(cron|cron_frequency|notifications|email|updates):'
cron: yes, no. Current value: yes. Default value: yes.
cron_frequency: daily, weekly, monthly. Current value: daily. Default value: daily.
email: userinput. Current value: email@domain.com. Default value: email@domain.com.
notifications: yes, no. Current value: no. Default value: no.
updates: yes, no. Current value: no. Default value: no.

It checks for new versions every day, does not install them, and tells no one: notifications are off and the address is a placeholder. Both DirectAdmin servers we looked at while writing this still had email@domain.com. To get a mail when updates are waiting:

da build set email ops@example.com
da build set notifications yes

updates=yes would make the cron job install them as well. That rebuilds PHP or Exim at night without anyone checking afterwards, which is the same trade-off as automatic reboots: fine for a test server, a gamble for a server with customers on it.

Check and apply updates

da build versions compares what is installed with the latest release CustomBuild knows. On older installs the same command is ./build versions in /usr/local/directadmin/custombuild.

$ da build versions
Latest version of MariaDB: 10.6.28
Installed version of MariaDB: 10.6.28

Latest version of PHP 8.4: 8.4.27
Installed version of PHP 8.4: 8.4.27
...
If you want to update all the available versions run: da build update_versions

Apply everything at once, or one component at a time so you can check each service before the next:

da build update_versions     # everything that is out of date
da build php                 # or one component at a time
da build exim
da build nginx
  • Before a database build, make sure there is a fresh backup of the databases. A rebuild of MariaDB restarts it.
  • After a PHP build, load a few customer sites, including one that sends mail through PHP.
  • After an Exim or Dovecot build, send a test mail in and out and log in over IMAP.
  • Custom templates survive rebuilds when they live in the custom folders. da build used_configs lists the configuration files CustomBuild uses.

What da build versions never tells you

It compares within the major version you chose. When that version line reaches end of life, the last release is also the latest, and the check says you are current.

MariaDB 10.6 is the example right now. Its community support ended on 6 July 2026 and 10.6.28 was the final release. A server on 10.6 shows 10.6.28 as both latest and installed, with no warning. The same happens with PHP: every release up to 8.1 is past its security support, and 8.2 follows at the end of 2026.

See which major versions a server runs, and which ones CustomBuild offers it:

da build opt_help | grep -E '^(php[1-4]_release|mariadb|mysql|mysql_inst):'

Moving MariaDB to a newer line is an option change and a build, after a backup:

da build set mariadb 10.11
da build mariadb

Major upgrades only go forward; there is no downgrade back to 10.6. If opt_help lists nothing newer than 10.6 for mariadb, your DirectAdmin version or license does not offer newer releases. According to the DirectAdmin forum, legacy licenses do not get MariaDB 10.11 and later, so that needs a license change first.

The OS side still needs dnf

CustomBuild covers the services; the kernel, OpenSSL, glibc and everything else still come from dnf, and need a reboot or a service restart to take effect. The patch management guide has a read-only script to check a whole fleet at once.