How DNS hosting works

A DNS zone holds the records for a domain and every name under it. When Coritan hosts a domain's zone, Coritan's nameservers answer every DNS query for it, and you manage its records on the domain's DNS tab or through the API.

A zone is created when you:

• add a domain you already own;
• register a domain with Issue an SSL certificate or Set up a proxy route on;
• claim a free name under coritan.gg.

Every new zone is signed with DNSSEC and starts with an NS record at @ for each Coritan nameserver, ns1.coritan.com to ns8.coritan.com. The zone answers for the domain once the domain's registrar lists those nameservers.

A record has a name, a type, content and a TTL. Some types also take a priority, a weight or a port (DNS record types).

Write a record's name relative to the zone. In the zone example.com, www stands for www.example.com, @ for example.com itself and * for any name that has no records of its own. Coritan stores the name as you type it, so www.example.com in that zone would mean www.example.com.example.com.

Coritan's nameservers pick up a change as soon as you save it. A resolver that cached the old answer keeps it until the record's TTL runs out, so lower the TTL a while before a planned change.

The TTL says how long, in seconds, resolvers may keep an answer. It ranges from 60 seconds to 86,400 seconds (one day). The dashboard starts new records at 5 minutes, and the API at 300 seconds when you leave it out.

Every zone has a start of authority (SOA) record, which Coritan writes for you. It names ns1.coritan.com as the primary nameserver and the zone's contact address, hostmaster@ the domain until you change it. Its serial goes up with every change, so secondary servers can tell when to fetch the zone again. The DNS zone card on the Settings tab shows the serial.

An A or AAAA record can be proxied. Coritan then answers the name with the addresses of its edge, with a short TTL of its own, instead of your address. Visitors' requests reach the edge, which applies the WAF and forwards them to your address over HTTP on port 80. Coritan also requests a certificate for the name, so visitors can use HTTPS.

A proxied record's address must be public. To choose the port, the protocol or the error page, give the name a web proxy of its own. Web proxies and DNS records explains how the two work together, and what deleting a proxied record does to a web proxy.

• A load balancer owns its hostname: the zone answers that name from the load balancer's pools, and refuses A, AAAA and CNAME records there.
• A web proxy serves a hostname once its DNS points at Coritan's edge.
• Certificates validated by DNS write their TXT records into the zone for you.

• A zone holds up to 1,000 records, and an account up to 100 zones.
• A zone keeps at least two NS records at @.
• A CNAME cannot sit at @, and cannot share its name with any other record.

curl https://api.coritan.com/api/v1/dns/zones/42 \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "id": 42,
  "domain": "example.com",
  "status": "active",
  "dnssec_enabled": true,
  "serial": 2026092507,
  "soa_email": "hostmaster",
  "record_count": 14,
  "created_at": "2026-09-16T10:04:00Z",
  "updated_at": "2026-09-25T08:12:00Z"
}

soa_email holds only hostmaster for the default address at the zone itself. A zone that is not on your account answers 403 with Access denied, and one that does not exist answers 404 with Zone not found.

• Add, edit and delete DNS records
• Set up DNSSEC
• Troubleshoot websites and DNS