DNS Records

DNS Records shows the complete record set of each of your DNS zones, in two kinds the page keeps clearly apart:

• records the panel generates from your services, each marked with the service it comes from
• custom records you add yourself

DNS is managed for you explains why the two kinds exist. Generated records can't be edited or deleted; you change the setting they come from.

The zone itself is a service. Open it from Services for the tabs with its settings and health: Delegation, Zone Transfers, Publication Queue, and Publication Issues.

Generated records

Each generated record names the service it comes from, and that service is where a change belongs:

You want	Change it here
A different SPF or DMARC policy	The Mail service's authentication settings.
An external mail gateway	The service. The MX and SPF records then follow.

A generated record stays correct when something changes later; a copy you maintain by hand doesn't.

The panel merges a custom SPF record

A custom SPF record on a name that already has a generated one is merged with it into one published record, marked Merged. They don't conflict.

Temporary records

The panel adds a temporary record when a job needs one, e.g. the _acme-challenge record that proves control of a name to a certificate authority.

It carries the Temporary badge and its own end time, and the panel removes it when the job ends, or at the latest when the time is up. There's nothing for you to do; you can delete one, but not edit it.

Custom records

Add DNS Record covers the common types (A, AAAA, CNAME, MX, TXT, NS) and, under the advanced option, SRV, CAA, TLSA, SSHFP, DS, NAPTR, LOC, CERT, URI, HTTPS, and SVCB. Each type's form validates its own fields, e.g. an A record must hold a valid IPv4 address, so a malformed record never reaches the zone.

The TTL, how long a resolver may cache the record, defaults to 1800 seconds (30 minutes) and accepts one minute to 30 days.

Before a risky change

Lower the TTL first when you're about to change a record you may need to change back quickly.

Custom and generated records coexist without trouble. The usual custom ones are a verification TXT record, a record pointing a subdomain at an external host, and a CAA policy.

A CNAME record must be alone at its name

DNS doesn't allow a CNAME beside any other record at the same name; the panel refuses one and names the record types already there. That's also why the domain's own name takes no CNAME: the panel generates NS and SOA records there.

What a badge on a record means

A record can be correct and still answer nothing. The page says so on the record itself, so the reason is where the record is:

Badge	What it means
Temporary	Added by the panel for a job with a deadline. It stops answering on the date shown and is then removed.
Merged	This SPF record was joined with the generated one. One record goes out.
Not served	The name is in a part of the zone you delegate to other name servers. They answer for it, so this record is published but never used.
Glue	The address of a name server inside a zone you delegate away. Resolvers can't reach that name server without it; remove it and the delegated zone becomes unreachable.
Name server address	The address of one of this domain's name servers. Remove it and the domain becomes unreachable.
Missing glue	A name server you delegate to is inside the zone you delegate away, with no address record for it here. Add an A or AAAA record for that name.
Missing address	One of this domain's name servers has no address record in this zone. The domain can't be resolved at all until you add one.
Not answering	Another record at the same name and type is published instead of this one.
Null mail record	The panel published a record saying the name sends and receives no mail.

A record that hasn't reached the name servers yet says so too. See When a change has not reached the name servers.

DNSSEC

DNSSEC signs your zone cryptographically. It's on by default, and the signing needs nothing from you.

The zone service's General tab holds the two settings:

Setting	What it does
DNSSEC Status	On or off for the whole zone. On by default.
Denial of Existence Mode	How the zone proves a name doesn't exist: NSEC or NSEC3. Keep the default unless you know you need the other.

The chain of trust does need you. The zone's Delegation tab shows the DS records; give them to your domain registrar, or whoever operates the zone above yours. Until you do, resolvers can't verify your signatures. The zone still works, but unverified.

Before you move DNS away from the panel

Remove the DS records at the registrar first. Otherwise every resolver that validates DNSSEC refuses the new zone, and your domain stops resolving for them.

Delegation

The Delegation tab is the one page about records the panel doesn't publish. Everything on it belongs to the parent zone: the registry your domain is registered with, or whoever operates the zone above yours. It's a list to copy from, not to edit, with absolute names because that's the form a registrar asks for.

The tab holds three kinds of record:

Kind	Marked	Why the parent zone needs it
The name servers	Required: Delegation	Tell the internet which name servers answer for your domain.
Address records	Required: Glue	A name server inside your own domain can't be looked up before it can be reached; the parent zone carries its address to break that circle.
DS records	Optional: DNSSEC	Complete the chain of trust. Without them the domain still resolves, but unverified.

What the parent zone actually carries

Once a day, the panel asks the zone above your domain what it carries, a live query against your registrar's name servers, so the tab shows the last answer, dated at the top, rather than a fresh one per visit. Check again now asks again.

The tab states one of these results:

Result	What it means
Not delegated	The parent zone carries no delegation for your domain. Nothing on the internet reaches your name servers. Give it the records on this tab.
Not checked	The panel couldn't ask, hasn't asked yet, or found no parent zone. Normal for a private or test top-level domain. The panel claims nothing about the records on this tab.
Still checking	Queued. Open the tab again in a few minutes.

Also in the Parent Zone lists what the parent zone hands out that your zone didn't ask for, usually left over from an earlier configuration. The panel can't tell whether it's deliberate, so it only shows it.

A stale DNSSEC record takes the domain off the internet

A DS record at your registrar with no key behind it makes every validating resolver refuse to answer for your domain: it looks correct from your own computer and is unreachable for most of the internet. If the panel marks a DS record Stale DNSSEC record, ask your registrar to remove it.

When a change has not reached the name servers

The records on these pages are what the panel holds; what the name servers answer is a separate thing. Each change is sent in the background a few seconds after you make it. Two tabs cover the two ways this goes wrong, and the zone shows a red banner when either has something in it.

Tab	The question it answers
Publication Queue	"I changed something. Where is it?" What's still on its way, oldest first; it usually empties in seconds.
Publication Issues	"Why has this never worked?" What the name servers refused, with the reason they gave.

An entry in Publication Issues stays Outstanding until somebody changes the refused value. When the refusal is about a value you typed, the tab shows the name server's own words; for anything else it says publication is delayed, and your hosting provider gets the report.

Zone transfers

An external system, e.g. a secondary DNS provider or a monitoring tool, may need a copy of a zone. The zone's Zone Transfers tab lists the systems that can take that copy with AXFR.

One entry per line: an IP address or a CIDR range such as 192.168.1.0/24. The panel normalizes a range to its network address, so 192.168.1.5/24 and 192.168.1.0/24 are one entry.

The list is empty by default; nothing can transfer your zones until you add it.

Only CIDR counts as a range

10.0.0.* and 10.0.0.1-10.0.0.9 look like ranges to a person, but no name server reads them. The panel refuses them and tells you which entry is the problem.