Host DNS zones for your organization

The DNS page, under Hosting, holds the zones your organization owns on Coritan's authoritative nameservers. They are the domains you add, such as your storefront's domain, your mail domain or the base domain of your game proxy, and the names your customers claim under a platform domain from your storefront.

• Every member can see the zones and their records, and export a zone file. Creating, changing and deleting them needs the owner or admin role; other members see a note saying so at the top of the page.
• You need a domain you control at a registrar, so you can point its nameservers at Coritan.

1. In the dashboard, open the organization, then Hosting, then DNS.
2. Select New zone….
3. Enter the Domain, such as example.com, then select Create zone. The zone opens.
4. The zone starts with NS records at @ that name Coritan's nameservers. The Zone card lists them under Nameservers to set at the registrar. At your registrar, set the domain's nameservers to those names.

Coritan signs every new zone with DNSSEC. When the zone's DNSSEC reads Signed, the Zone card also shows the DS record to give your registrar. Until you add it there, resolvers treat the zone as unsigned. Set up DNSSEC explains the DS record.

The DNS page lists your zones by domain, 50 to a page, each with its Status, how many Records it holds and whether it is signed. On a wide screen it also shows each zone's Serial and when it last Changed. To find a zone, type part of its domain or its SOA contact, or its number, in the search box. When your zones differ, Any status and Any DNSSEC state narrow the list to one status, or to the zones that are signed or not, and each choice says how many zones it would show. The search, the filters and the page stay in the page's address, so a link or a reload keeps them. When nothing matches, select Reset filters. The column headers sort the list while every zone fits on one page; past that, the zones stay in domain order and the pager under the list moves between pages.

Select a zone's row to open it. Its header shows the zone's status, whether it is signed, how many records it holds, its serial and when it last changed. The zone page has three sections: Records, Load balancing and Query stats. Its Zone card shows the zone's Status, its DNSSEC state, its Serial, which goes up with each change, and its SOA contact, with the nameservers to set at your registrar and the DS record once the zone is signed. All zones takes you back to the list as you left it.

1. Open the zone.
2. Select Add record…, or select a record's row to edit it. Edit record… in the menu at the end of the row does the same.
3. Fill in the record:
   • Name: @ for the domain itself, or a label under it, such as www. The full name, such as www.example.com, works too and is stored as www. A name that ends in a domain above the zone is refused.
   • Type: the record type. DNS record types describes each one.
   • Content: what the record answers with, such as 203.0.113.10 for an A record.
   • TTL: how long resolvers may cache the answer, from 1 minute to 1 day.
   • Priority for MX and SRV records, and Weight and Port for SRV records.
   • Comment: a note for your team.
4. For an A or AAAA record, tick Proxy through Coritan to send its traffic through Coritan's edge for TLS and the web application firewall. The origin address then stays hidden. The address must be public, since Coritan's edge connects to it.
5. Select Add record, or Save record when editing.

You cannot change the name or type of an existing record. Delete it and add a new one instead.

To find a record in a long zone, type in the search box above the records to match a name, content or comment, or choose a type in All types. The search and the type stay in the page's address, and Reset filters shows every record again.

To delete a record, open the menu at the end of its row and choose Delete record…. Type the record type to confirm, then select Delete record in the dialog. Resolvers drop it as their caches expire.

To delete a zone, choose Delete zone… in the menu at the end of its row on the DNS page, or in Zone actions on the zone page. Type the domain to confirm, then select Delete zone in the dialog. This deletes every record in the zone, and the domain stops resolving through Coritan.

A zone file lists a zone's records as text, one record per line, in the format most DNS hosts read and write.

To add the records from a zone file:

1. Open the zone. Open Zone actions at the top of the page and choose Import zone file….
2. Paste the file into Zone file. Each line holds the name, a TTL, IN, the type and then the value, as in www 3600 IN A 203.0.113.10.
3. Select Import records, then Done once you have read the result.

The dialog says how many records it imported, and lists each line it skipped with the reason. The SOA line, lines that start with $ or ;, and each record the zone already has are left out without a message, so importing a file again adds only what is new. When the zone has every record, the dialog says Nothing new to import.

To save the zone as a file, select Export zone file at the top of the zone page, or choose it in the menu at the end of the zone's row on the DNS page. Your browser downloads it as example.com.zone.

The zone's SOA record names a contact address for problems with the zone.

1. Open the zone, then open Zone actions and choose Change SOA contact….
2. Enter a full address in SOA contact, or a name such as hostmaster for an address at the domain itself.
3. Select Save contact.

A load balancer answers one hostname in the zone with the address of a healthy origin, chosen from its origin pools. It works as Load balancing describes for websites. Open the zone, then Load balancing.

Create a pool first:

1. Select New pool….
2. Enter a Name and, if you like, a Description.
3. Choose an Algorithm: Weighted round robin spreads queries across the healthy origins by weight, and Failover by priority answers with the healthy origin that has the lowest priority number.
4. Set the TTL in seconds, the Session affinity and, for proximity steering, the Primary location, then select Create pool. The pool opens in a panel.
5. Select Add origin…. Enter the origin's Address, its Weight and Priority, and choose a Health check: No check, HTTP, HTTPS or TCP connect. Select Add origin.

Then create the load balancer:

1. Select New load balancer….
2. Enter a Name and the Hostname it answers, such as www.
3. Choose the Steering: Off answers from the Default pools in order, Random picks one of them for each query, Geographic sends a PoP, a country or a region to pools of its own, and Proximity ranks the pools by distance from the resolver.
4. Add the Default pools in the order to try them. If you like, choose a Fallback pool, which answers when no pool above it has a healthy origin. For geographic steering, select Add rule for each place that gets pools of its own.
5. Set the TTL in seconds, from 5 to 3,600, then select Create load balancer.

With Enabled cleared, the load balancer stops answering and the zone's ordinary records for the hostname answer instead.

To see what a resolver would get, open the load balancer's menu and choose Preview answer…. Choose a PoP in From PoP, or enter a Resolver IP, then select Preview answer. The dialog shows the Answer, the Pool it came from and, under Chosen by, the rule that picked that pool. A preview changes nothing, and every member can run one.

Select a pool's row to open its panel. It shows the pool's settings, the load balancers that use it, and each origin with its health. The button with the pulse icon next to an origin checks its health now. You cannot delete a pool that a load balancer uses, so take it out of the load balancer first. To delete a pool, choose Delete pool… in its menu and type the pool's name.

Open the zone, then Query stats. The switch in the Queries card chooses 24 hours, 7 days or 30 days, and the period stays in the page's address. The card shows how many Queries the zone had, and how many of them were Answered, got Name not found or ended in Server failures, each with its share of the queries. By record type shows which kinds of record resolvers asked for, and Busiest hours lists the ten hours with the most queries, in your time zone. New counts arrive within the hour.

The zone page says No zone has this ID

The zone was deleted, or the link belongs to another organization's zone. Select All zones to go back to your list.

"Domain already registered"

The domain already has a zone on Coritan, in your organization or somewhere else.

"This domain is reserved by the platform"

Coritan keeps this domain for itself. Choose another.

"Zone limit reached"

Your organization holds as many zones as it may. Delete one you no longer use, or contact support.

"Proxied origin targets a private or reserved network"

A proxied record must answer with a public address, because Coritan's edge connects to it. Enter the origin's public address, or untick Proxy through Coritan.

"proxied is only valid for A/AAAA records"

Only A and AAAA records can go through the proxy. Through the API, send proxied as false for every other type.

The domain does not resolve

Check that the domain's nameservers at your registrar match the NS records at @. Resolvers pick up a nameserver change only as their caches expire.

Delete pool… is greyed out

A load balancer still uses the pool. Edit the load balancer and take the pool out of it first.

• How DNS hosting works
• Import and export a zone file
• Load balancing

Reads take any member's access token; changes take the owner or admin role. The paths below are under /api/v1/orgs/acme/dns.

Create a zone, then add a record to it:

curl -X POST "https://api.coritan.com/api/v1/orgs/acme/dns/zones" \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

curl -X POST "https://api.coritan.com/api/v1/orgs/acme/dns/zones/{zone_id}/records" \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "www", "record_type": "A", "content": "203.0.113.10", "ttl": 300}'

A record takes name, record_type, content, ttl (60 to 86400 seconds, 300 by default), priority, weight, port, proxied and comment. record_type is one of A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, PTR, SVCB, HTTPS and DS.

Zones and records:

Load balancing, on the zone's Load balancing section:

The older /zones/{zone_id}/lb-pools paths take the same requests as /pools.