How DNS hosting works

A DNS zone holds the records for a domain and every name under it. When Coritan hosts a domain's zone, Coritan's nameservers answer every DNS query for it, and you manage its records on the domain's DNS tab or through the API. The public DNS page describes the product.

Coritan creates a zone when you:

• add a domain you already own;
• register a domain, which starts on Coritan's nameservers;
• point a domain you registered with Coritan at Coritan's nameservers while it has no zone;
• claim a free name under coritan.gg.

A domain you register, or point at Coritan's nameservers, uses your account's zone of the same name when you have one. When another account holds that zone, Coritan creates none and the domain does not resolve. Contact support to move the zone to your account.

Every new zone is signed with DNSSEC and starts with an NS record at @ for each Coritan nameserver, ns1.coritan.com to ns8.coritan.com. The zone answers for the domain once the domain's registrar lists those nameservers. The Nameservers card on the DNS tab says whether it does (Check the nameservers).

A record has a name, a type, content and a TTL. Some types also take a priority, a weight or a port (DNS record types).

Write a record's name relative to the zone. In the zone example.com, www stands for www.example.com, @ for example.com itself and * for any name that has no records of its own. You can also give the full name, such as www.example.com, on the DNS tab or through the API: Coritan stores it as www, and example.com as @, so a name never ends in the domain twice. A name that ends in a domain above the zone is refused, such as www.example.com in the zone app.example.com, because that zone does not hold it. Add such a record in the zone of the domain it belongs to.

Coritan's nameservers pick up a change as soon as you save it. A resolver that cached the old answer keeps it until the record's TTL runs out, so lower the TTL a while before a planned change.

The TTL says how long, in seconds, resolvers may keep an answer. It ranges from 60 seconds to 86,400 seconds (one day). The dashboard starts new records at 5 minutes, and the API at 300 seconds when you leave it out.

Every zone has a start of authority (SOA) record, which Coritan writes for you. It names ns1.coritan.com as the primary nameserver and the zone's contact address, hostmaster@ the domain until you change it. Its serial goes up with every change, so secondary servers can tell when to fetch the zone again. The DNS zone card on the Settings tab shows the serial.

An A or AAAA record can be proxied, which the DNS tab shows as Proxied in the Proxy status column. Coritan then answers the name with our network's addresses, with a short TTL of its own, instead of your address. Visitors reach our network, which protects the site with the WAF, your own rules and DDoS filtering, gives it HTTPS with a certificate that Coritan requests for the name, serves files from its cache and forwards each request to the address in the record. Your server's address stays private. A DNS only record sends visitors straight to its address, so none of this applies to it.

A name's first proxied record gives it a web proxy with the default settings, unless the name has one already. The tabs that set up our network work on that web proxy, one hostname at a time:

• SSL/TLS: the encryption mode, HTTPS redirects, HSTS and the certificate (Choose an encryption mode).
• Security: the WAF, Under attack mode, hotlink protection and rules of your own (Protect a website).
• Caching: the cache and clearing it (Speed up a website with the cache).
• Rules: redirects and headers (Redirect visitors and set headers).
• Origin: the addresses requests go to, the port and the error page (Manage a website's origin).

On the DNS tab, a proxied record's row has a Hostname settings button before Edit, which opens the name's Origin tab. The Overview tab lists every hostname with how visitors reach it, and the row menu of a hostname on our network has quick actions such as Clear cache… and Turn on Under attack mode… (Quick actions for a hostname).

Deleting a name's last proxied record, or turning its proxy off, deletes its web proxy with all these settings, and the record form says so before you save (Delete a record). Renaming a proxied record does the same at the old name, and the new name gets a web proxy with the default settings unless it has one.

Our network reaches your server the way Cloudflare's does:

• Every proxied A and AAAA record at a name is an origin. Each request goes to the origin with the fewest requests in progress, and a request that cannot reach one origin is tried on the next. Turning Proxied off for one of them, or deleting it, takes only that address out.
• Our network starts on HTTP to port 80. Shortly after a record is proxied, Coritan tries HTTPS on port 443 at each origin, and once every one of them answers, our network connects over HTTPS on port 443. An origin that sends HTTP visitors to HTTPS, as most hosts do, then serves the site without a loop of redirects. A proxied address added later is reached the same way, so it must answer HTTPS on port 443 too. The encryption mode on the SSL/TLS tab changes this (Choose an encryption mode).
• Over HTTPS our network sends the visitor's hostname, such as www.example.com, so a server that hosts many sites on one address serves the right one. It does not check the server's certificate, as in Cloudflare's Full mode, so a self-signed certificate works.
• A proxied record imported as a proxied CNAME reaches the CNAME's target by its hostname instead (Proxied records in a file).

One proxied A or AAAA record puts the whole name on our network. The nameservers then answer both A and AAAA queries for the name with our network's addresses, and never with an address from your records, so a DNS only A or AAAA record at that name is not published. A CNAME that points at the name, and the extra addresses sent with an MX or SRV answer, follow the same rule.

Once our network has IPv6 addresses, the nameservers answer AAAA queries for a proxied name with those addresses, and visitors on IPv6 networks reach the name over IPv6. While our network has no IPv6 address, a proxied name has no AAAA answer, and visitors on IPv6 networks reach it over IPv4. A name whose only record is a proxied AAAA still gets A answers with our network's addresses, so visitors on IPv4 networks reach it too, and Coritan forwards their requests to the address in the record.

A proxied record's address must be public. Web proxies and DNS records explains how a web proxy you create in Game Shield and a proxied record work together.

• A load balancer owns its hostname: the zone answers that name from the load balancer's pools, and refuses A, AAAA and CNAME records there.
• A web proxy serves a hostname once its DNS points at our network.
• Certificates validated by DNS write their TXT records into the zone for you.

• A zone holds up to 1,000 records, and an account up to 100 zones.
• A zone keeps at least two NS records at @.
• A CNAME cannot sit at @, and cannot share its name with any other record.

curl https://api.coritan.com/api/v1/dns/zones/42 \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "id": 42,
  "domain": "example.com",
  "status": "active",
  "dnssec_enabled": true,
  "serial": 2026092507,
  "soa_email": "hostmaster",
  "record_count": 14,
  "record_limit": 1000,
  "created_at": "2026-09-16T10:04:00Z",
  "updated_at": "2026-09-25T08:12:00Z"
}

soa_email holds only hostmaster for the default address at the zone itself, and record_limit is how many records the zone may hold. A zone that is not on your account answers 403 with Access denied, and one that does not exist answers 404 with Zone not found.

• Add, edit and delete DNS records
• Set up DNSSEC
• Troubleshoot websites and DNS