# How DNS hosting works

> How Coritan hosts a domain's DNS zone, from nameservers and records to TTLs, the SOA record and proxied records.

Source: https://www.coritan.com/docs/websites/dns/

In the dashboard:

- /dashboard/websites/…/dns: https://www.coritan.com/dashboard/websites

A *DNS zone* holds the records for a domain and every name under it. When Coritan hosts a domain's zone, Coritan's nameservers answer every DNS query for it, and you manage its records on the domain's **DNS** tab or through the API.

## How a zone comes to exist

A zone is created when you:

- [add a domain you already own](/docs/websites/add-an-existing-domain/);
- [register a domain](/docs/websites/domains/register-a-domain/) with **Issue an SSL certificate** or **Set up a proxy route** on;
- [claim a free name](/docs/proxies/coritan-gg-names/) under `coritan.gg`.

Every new zone is signed with DNSSEC and starts with an `NS` record at `@` for each Coritan nameserver, `ns1.coritan.com` to `ns8.coritan.com`. The zone answers for the domain once the domain's registrar lists those nameservers.

## Records and names

A record has a name, a type, content and a TTL. Some types also take a priority, a weight or a port ([DNS record types](/docs/websites/dns/record-types/)).

Write a record's name relative to the zone. In the zone `example.com`, `www` stands for `www.example.com`, `@` for `example.com` itself and `*` for any name that has no records of its own. Coritan stores the name as you type it, so `www.example.com` in that zone would mean `www.example.com.example.com`.

Coritan's nameservers pick up a change as soon as you save it. A resolver that cached the old answer keeps it until the record's TTL runs out, so lower the TTL a while before a planned change.

## TTL

The TTL says how long, in seconds, resolvers may keep an answer. It ranges from 60 seconds to 86,400 seconds (one day). The dashboard starts new records at 5 minutes, and the API at 300 seconds when you leave it out.

## The SOA record

Every zone has a start of authority (SOA) record, which Coritan writes for you. It names `ns1.coritan.com` as the primary nameserver and the zone's contact address, `hostmaster@` the domain until you [change it](/docs/websites/settings/#dns-zone). Its *serial* goes up with every change, so secondary servers can tell when to fetch the zone again. The **DNS zone** card on the **Settings** tab shows the serial.

## Proxied records

An `A` or `AAAA` record can be *proxied*. Coritan then answers the name with the addresses of its edge, with a short TTL of its own, instead of your address. Visitors' requests reach the edge, which applies the WAF and forwards them to your address over HTTP on port 80. Coritan also requests a certificate for the name, so visitors can use HTTPS.

A proxied record's address must be public. To choose the port, the protocol or the error page, give the name a [web proxy](/docs/proxies/web-proxies/create-a-web-proxy/) of its own. [Web proxies and DNS records](/docs/proxies/web-proxies/#web-proxies-and-dns-records) explains how the two work together, and what deleting a proxied record does to a web proxy.

## How zones work with the rest of Coritan

- A [load balancer](/docs/websites/load-balancing/) owns its hostname: the zone answers that name from the load balancer's pools, and refuses `A`, `AAAA` and `CNAME` records there.
- A [web proxy](/docs/proxies/web-proxies/) serves a hostname once its DNS points at Coritan's edge.
- [Certificates](/docs/websites/ssl/) validated by DNS write their `TXT` records into the zone for you.

## Limits

- A zone holds up to 1,000 records, and an account up to 100 zones.
- A zone keeps at least two `NS` records at `@`.
- A `CNAME` cannot sit at `@`, and cannot share its name with any other record.

## Read a zone with the API

```bash
curl https://api.coritan.com/api/v1/dns/zones/42 \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

```json
{
  "id": 42,
  "domain": "example.com",
  "status": "active",
  "dnssec_enabled": true,
  "serial": 2026092507,
  "soa_email": "hostmaster",
  "record_count": 14,
  "created_at": "2026-09-16T10:04:00Z",
  "updated_at": "2026-09-25T08:12:00Z"
}
```

`soa_email` holds only `hostmaster` for the default address at the zone itself. A zone that is not on your account answers `403` with `Access denied`, and one that does not exist answers `404` with `Zone not found`.

## Related

- [Add, edit and delete DNS records](/docs/websites/dns/manage-dns-records/)
- [Set up DNSSEC](/docs/websites/dns/dnssec/)
- [Troubleshoot websites and DNS](/docs/websites/troubleshooting/)

## API

- `GET /api/v1/dns/zones/{zone_id}`: Get zone (https://www.coritan.com/docs/api/reference/client/dns/#op-get-api-v1-dns-zones-zone-id)