Add, edit and delete DNS records

A zone's records say where each name under the domain points: its website, its mail servers, the values other services ask you to publish. Manage them on the domain's DNS tab. Coritan's nameservers answer with a change as soon as you save it.

The domain's DNS must be hosted on Coritan. If the DNS tab says No DNS zone for this domain, add the domain as an existing domain first.

1. In the dashboard, go to Domain Management, open the domain and select the DNS tab.

2. Select Add record…. The form opens at the top of the DNS records card, with its fields on one row.

3. Enter the Name: www for www.example.com, or @ for the domain itself. You can also type the full name, such as www.example.com; Coritan stores it as www, and the field says Saved as www.. A name that ends in a domain above the zone, such as example.com in the zone app.example.com, is refused: the zone holds only names that end in app.example.com.

4. Choose the record's Type: A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, PTR, SVCB, HTTPS or DS. The fields beside it change with the type.

5. Fill in the fields the type takes (DNS record types gives each format):

   • A: the IPv4 address, such as 203.0.113.10.
   • AAAA: the IPv6 address, such as 2001:db8::10.
   • CNAME: the Target, the name this one is an alias of.
   • MX: the Mail server and its Priority. Lower numbers are tried first.
   • TXT: the Content, up to 2,048 characters.
   • SRV: an optional Name below the domain, the Service (such as _minecraft) and the Protocol (TCP, UDP or TLS), then on the next row Priority, Weight, Port and the Target server. The hint shows the record name these make, such as _minecraft._tcp.play.
   • NS: the Nameserver.
   • CAA: the Tag and the Certificate authority, such as letsencrypt.org, or the Report address for Send reports of refused requests to. To make an authority that does not understand the tag refuse to issue, open Record attributes and tick Critical.
   • PTR: the Domain name.
   • SVCB and HTTPS: the Content, which starts with the priority, such as 1 . alpn="h3,h2".
   • DS: the Key tag, the Algorithm, the Digest type and, on the next row, the Digest, as the child zone's DNS provider lists them.

   In a target, @ stands for the domain itself.

6. For an A or AAAA record, set the Proxy status. With the switch on, the record shows Proxied: visitors reach our network, which protects the site, gives it HTTPS and the cache, keeps your server's address private and forwards each request to the address in the record (Proxied records). A note under the fields says what saving does, such as Saving puts www.example.com on our network and requests its certificate, with its settings on the SSL/TLS, Security, Caching, Rules and Origin tabs. Leave the switch off, DNS only, for mail, game and other servers that are not websites. A wildcard record, whose name is *, cannot be proxied (nor can *.shop): it answers every name in the zone that has no record of its own, and a web proxy serves one full hostname.

7. Choose the TTL, from 1 min to 1 day: how long resolvers keep the answer before they ask again. A proxied record shows Auto, because the name answers with the network's own short TTL.

8. Optionally, open Record attributes and add a Comment to remind you what the record is for. It shows in the table's Comment column.

9. Select Add record, or press Enter.

The dashboard checks the record before it sends it, such as an address in the right form or a CNAME at a name that already has records, and shows what to fix under the field. The API's own refusal shows above the form's buttons, and the form keeps what you typed. Esc or Cancel closes the form.

To start a record from an existing one, select Edit on its row, then Duplicate record…. The add form opens with its values.

1. On the DNS tab, select the record's row, or Edit at the end of it. Its editor opens under the row, with the same fields as the add form, and the row's Edit reads Close.

2. Change any field, the Name and the Type included. A new name or type is checked as a new record's is, and a type that takes no priority, weight or port drops them.

   While a record is proxied, a new address also becomes an origin of the name's web proxy, in place of the old one. A change to the proxy status or the name also changes the name's web proxy, and a note under the fields says how before you save:

   • Turning the proxy on puts the name on our network. When the name has no web proxy, the note reads Saving puts … on our network and requests its certificate. When it has one, the note says what happens to it: a web proxy that follows the name's records takes the record's address as an origin, and any other keeps sending visitors where it does now, such as Saving puts staging.example.com on our network, where its web proxy sends visitors to 203.0.113.58:3000.
   • Turning the proxy off, or choosing a type that cannot be proxied, shows Saving deletes the web proxy for … when the record is the name's last proxied A or AAAA record: saving deletes that web proxy and its settings, as deleting the record does. When other proxied records are left at the name, it shows Saving takes … out of the web proxy for … instead, and the web proxy stays with their addresses.
   • A new name for the name's last proxied record shows Saving deletes the web proxy for … too. The old name's web proxy goes with its settings, and the new name gets a web proxy with the default settings, or keeps the one it has. When other proxied records are left at the old name, its web proxy stays.

3. Select Save record. Cancel, Close or Esc closes the editor without saving.

1. On the DNS tab, select Edit on the record's row, then Delete record… in its editor.
2. Select Delete record to confirm.

A zone keeps at least two NS records at @, so Delete record… is unavailable on the last two.

1. Tick the box at the start of each record's row, or the box in the header to select every record on the page.
2. The bar above the table shows how many records are selected. Select Delete selected… to delete them, or Export selected to download them as a zone file named after the domain, such as example.com.selection.zone.
3. The confirmation lists the records and names each web proxy that goes with them, because no proxied record is left at its name. Confirm with the button that repeats the count, such as Delete 3 records.

The dashboard deletes them as one change, so either every record goes or none does, and then reports how many it deleted. When it leaves out NS records at @ so that two remain, the confirmation says so. Clear selection unticks every row. The boxes are on wider screens only; on a phone, delete records one at a time.

• The search box matches names, full names, content, comments and types.
• All types chooses one record type, with how many records each has. Load balancers have an entry of their own when the zone has one.
• Any proxy status chooses Proxied or DNS only records.
• Select a column heading (Name, Type or Content) to sort by it. Select it again to reverse the order.
• The table shows 50 records to a page. When the zone has more, the pager under the table moves between pages and shows 25, 50 or 100 a page.

The search, the filters, the sort and the page stay in the page's address, so a reload or a link you share opens the table as you left it. When nothing matches, Reset filters clears them.

The dashboard confirms each change, such as A record for www added.. The table shows one line a record: its full name, with the zone's own part in grey, its Type, its Content and its Proxy status, and on a wide screen its TTL and its Comment. A value too long for its column ends in an ellipsis; hold the pointer over it, or open the record, to see all of it. Above the table, the card says how many records the zone holds of the most it may, such as You have used 16 of 1,000 DNS records in this zone. A DNS only A or AAAA record shows Not published when another A or AAAA record for its name is proxied, because Coritan then answers for the whole name (Proxied records). A load balancer shows as a row of type LB for its hostname, with Manage to open the Load balancing tab. A proxied record's row has a Hostname settings button before Edit, which opens its name's Origin tab (Where a proxied name's settings are).

Check a record from a terminal, straight from a Coritan nameserver:

dig @ns1.coritan.com www.example.com A +short

A record gets a warning sign beside its content when the rest of the zone makes it a problem. Hold the pointer over the sign, or open the record, to read why:

• Shows the address of a proxied name, so anyone can reach that server without our network. A DNS only A or AAAA record has the same address as a proxied one. Anyone who looks it up can skip Coritan's network and its WAF. Proxy the record too, or give the server another address.
• Points at a proxied name, which answers with our network's addresses. Mail cannot be delivered there. An MX record names a proxied name in the zone. Coritan's network carries only web traffic, so point the MX record at a DNS only name, such as mail.
• Points at a proxied name, which answers with our network's addresses. Our network only carries web traffic. The same for an SRV record, such as a game server's.
• Shares its name with other records, which a CNAME cannot. Resolvers may answer with either. A zone file import can add a CNAME beside other records. Delete the CNAME or the others.
• This nameserver is not ours. Resolvers that ask it get another DNS host's answers, so delete it unless you run it. An NS record at @ names a nameserver other than Coritan's, such as one an earlier zone file import kept from Cloudflare. Delete it, unless you run that nameserver as a copy of this zone.

Above the records, the tab names what the zone is missing, each with a button that opens the add form filled in:

• example.com does not point anywhere, with Add A record…, when @ has no A or AAAA record and no load balancer.
• www.example.com does not resolve, with Add CNAME record…, when www has no record, no load balancer and the zone has no * record.
• example.com has no mail records, with Add SPF record…, when @ has no MX record and no SPF record. If the domain sends no mail, the v=spf1 -all it adds tells receivers to turn away mail that claims to come from it. To get mail at the domain, add it under Mail Services.
• Mail from example.com has no DMARC policy, with Add DMARC record…, when the domain has mail records and no TXT record at _dmarc (DMARC).

The button beside each one dismisses it in this browser.

When the domain does not use Coritan's nameservers yet, a banner above the records says so, and Show nameservers leads to the Nameservers card at the bottom of the tab (Check the nameservers).

The dashboard shows these under the field, before it sends the record:

Enter a name, or @ for the domain itself.

The Name is empty.

… is not in the zone …. Names in this zone end in …

The name ends in a domain above the zone, or is a full name with a trailing dot outside it. Type it relative to the zone, or add the record in the zone of the domain it belongs to. The API answers the same, with 422.

Use letters, digits, hyphens and underscores, with dots between the parts, such as www or _dmarc. Only the first part can be *.

The name has a character DNS does not take, such as a space.

Enter an IPv4 address, such as 203.0.113.10. or Enter an IPv6 address, such as 2001:db8::10.

The address does not fit the type. An A record takes an IPv4 address and an AAAA record an IPv6 address.

That is an IPv4 address written as IPv6. Use an A record for …

An AAAA record's content is an IPv4 address in IPv6 form, such as ::ffff:203.0.113.10. Clients cannot reach the IPv4 server through it. Add an A record with the IPv4 address instead.

Enter a hostname, such as mail.example.com.

A CNAME, MX, NS, SRV or PTR record takes a hostname.

A CNAME record cannot be at @. Use an A or AAAA record for the domain itself.

A CNAME cannot sit at @.

… already has other records, and a CNAME cannot share its name. or … has a CNAME record, which cannot share its name.

A name with a CNAME has no other records. Delete the other records, or use a different name.

The load balancer … answers for …

A load balancer owns that name. Change its pools on the Load balancing tab (Create a load balancer).

The zone already has this record.

A record with the same name, type and content (and priority, weight and port) exists. Edit that one instead.

Enter a whole number from 0 to 65,535.

An MX record needs a Priority, and an SRV record a Priority, a Weight and a Port.

The API answers these, and the form shows them above its buttons:

Proxied origin targets a private or reserved network

A proxied record must point at a public address. Turn the proxy off, or use your server's public address.

A wildcard record cannot be proxied. Turn Proxied off, or add a record for each name.

The record's name is * or has a * label, such as *.shop, and proxied is on. The API answers 422 when you add such a record or edit one into it. Leave the record DNS only, or add a proxied record for each hostname. A DNS only wildcard record shows your server's address to anyone who looks it up.

Cannot delete this NS record. A zone needs at least 2 NS records.

The zone keeps at least two NS records at @.

Record limit reached (1000)

The zone holds as many records as it may. Delete records it no longer needs.

TTL must be between 60 and 86400 seconds

The API takes a ttl from 60 to 86,400 seconds. The TTL list on the DNS tab offers only times in that range.

• How DNS hosting works
• DNS record types
• Import and export a zone file

Add a record. The body takes name, record_type, content and ttl (300 when you leave it out), and, where the type needs them, priority, weight and port. proxied (for A and AAAA only) and comment are optional. Send name relative to the zone (www, or @) or in full (www.example.com); the answer carries the name Coritan stored, www.

curl -X POST https://api.coritan.com/api/v1/dns/zones/42/records \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "@", "record_type": "MX", "content": "mail.example.com", "priority": 10, "ttl": 3600}'

The answer is 201 with the record:

{
  "id": 311,
  "zone_id": 42,
  "name": "@",
  "record_type": "MX",
  "content": "mail.example.com",
  "ttl": 3600,
  "priority": 10,
  "weight": null,
  "port": null,
  "proxied": false,
  "comment": null,
  "created_at": "2026-09-25T09:30:00Z",
  "updated_at": "2026-09-25T09:30:00Z"
}

The API does not refuse a record identical to one the zone has; the dashboard does.

List records with GET /api/v1/dns/zones/42/records, sorted by name and type. Filter with record_type and name (exact, such as name=www or name=www.example.com), and page with page and per_page (100 by default, up to 1,000). Read one record with GET /api/v1/dns/zones/42/records/311.

Change a record with PUT, sending only the fields to change: name, record_type, content, ttl, priority, weight, port, proxied or comment. A new name is read as POST reads one, and a new name or type is checked as a new record's is: a CNAME beside other records answers 409, and moving one of the last two NS records at @ answers 422. A new type that takes no priority, weight or port drops them, and only A and AAAA stay proxied. Renaming a proxied record deletes the web proxy at the old name when no proxied record is left there, and the new name gets a web proxy with the default settings unless it has one.

curl -X PUT https://api.coritan.com/api/v1/dns/zones/42/records/311 \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ttl": 300}'

Delete a record with DELETE /api/v1/dns/zones/42/records/311, which answers 204.

Delete several at once with bulk-delete, which takes up to 1,000 record ids:

curl -X POST https://api.coritan.com/api/v1/dns/zones/42/records/bulk-delete \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"record_ids": [311, 312, 318]}'

{ "deleted": 3, "record_ids": [311, 312, 318] }

It deletes every record or none. When an id is not a record of the zone, it answers 404 with the ids it could not find, and when it would leave fewer than two NS records at @, it answers 422. A zone takes 30 bulk deletes in 10 minutes, then answers 429.