DNS for every domain you own
Authoritative DNS for your domains with every common record type, DNSSEC and load balancing, managed in the dashboard or through the API.
DNS is the address book that points your domain at your site and your email. Host it on our nameservers with every common record type, DNSSEC (signatures that show each answer is genuine) and load balancing, in the dashboard or through the API.
- 8 anycast nameservers, ns1 to ns8.coritan.com
- 12 record types, SVCB and HTTPS among them
- DNSSEC on every zone, signed with ECDSA P-256
- 1,000 records in one zone
DNS on each plan
DNS hosting comes with every plan. Your plan sets how many websites and load balancers you can have.
Free
Every record type and DNSSEC for your first domains.
- 3 websites
- 1 load balancer
- Every common record type
- DNSSEC signing on every zone
Pro
More domains and load balancers, and 30 days of query history.
- 10 websites
- 5 load balancers
- 30 days of query history
- 3 team members, you included
- Everything in Free
Business
For a team with many domains.
- 50 websites
- 25 load balancers
- Unlimited team members
- Everything in Pro
The Free plan’s websites include DNS, certificates and protection on our network. The site itself runs on a server you pay for, on hosting you already have, or as a static site on our edge.
Compare every plan · Talk to sales about Enterprise
Technical specifications
What our nameservers answer and how, on every plan unless a row names one.
| Nameservers | |
|---|---|
| Nameservers | ns1.coritan.com to ns8.coritan.com, on anycast addresses |
| Changes | Answered as soon as you save them |
| SOA record | Written for you, with ns1.coritan.com as the primary nameserver and a serial that rises with every change |
| Records | |
| Record types | A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, PTR, SVCB, HTTPS and DS |
| TTL | 60 seconds to 1 day, 5 minutes by default |
| Proxied records | A and AAAA, served through Edge Proxy |
| Zone files | Import and export in the BIND format |
| DNSSEC | |
| Algorithm | Algorithm 13, ECDSAP256SHA256 |
| Keys | A key-signing key that stays the same, and a zone-signing key that we replace every 10 days |
| When a key is replaced | The new zone-signing key takes over at once, with no overlap. The DS record at your registrar does not change. |
| Signatures | Valid for 14 days, and renewed soon after a third of that time has passed |
| DS digests | SHA-256 (type 2) and SHA-384 (type 4) |
| DS record at the registry | You add it at the domain’s registrar. We do not send one for a domain registered with us. |
| Load balancing | |
| Choosing an origin | Weighted round-robin with weights from 1 to 100, or failover by priority |
| Health checks | HTTP, HTTPS or TCP connect, once a minute, from one place, so a check shows whether our checker reaches the origin and not what visitors in each region see |
| IPv6 origins | Not checked while our checker has no IPv6 route: the origin stays in the pool |
| Steering | Off, random, geographic or proximity |
| Session affinity | By client IP, which keeps a resolver on one origin |
| TTL of an answer | 5–3,600 seconds |
| Statistics and API | |
| Query history | 24 hours on Free, 30 days on Pro and up |
| Client API | Zones, records, pools and load balancers over HTTPS with an API token |
What DNS hosting includes
Each feature says whether every plan includes it or which plan adds it.
Zones and records
- Every common record type. Included. A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, PTR, SVCB, HTTPS and DS records, each checked before we save it. Each record has a TTL (how long resolvers may keep it) from 60 seconds to 1 day.
- DNSSEC signing. Included. We sign every zone from the moment you add it. Resolvers check the signatures once you add the zone’s DS record at the domain’s registrar. We do not send a DS record to the registry for a domain registered with us, so resolvers treat that zone as unsigned. A free coritan.gg name needs no step from you.
- Proxied records. Included. Turn on the proxy for an A or AAAA record, and visitors reach that name through Edge Proxy, with its firewall and a free certificate. Edge Proxy
- Zone files in and out. Included. Copy records in from a BIND zone file when you move a domain here, or download a zone’s records as one. An import adds only the records the zone does not have yet, so you can run it again.
Load balancing
- Load balancers. Included. Answer a name with the servers in your pools that pass their health checks, and fall back to another pool when one is down. The Free plan includes 1 load balancer, Pro 5 and Business 25.
- Health checks. Included. Give an origin an HTTP, HTTPS or TCP connect check. We run it once a minute, from one place, and queries skip an origin that fails. An IPv6 origin is not checked while our checker has no route to IPv6 addresses, and it stays in the pool.
- Steering. Included. Order the pools at random, by country or region, or by how close each pool is to the nameserver that answered.
Insight
- Query statistics. Included. See how many queries each zone answered, by hour and by response code. The Free plan keeps the last 24 hours of query history.
- 30 days of query history. Pro and up. Read a zone’s queries over 48 hours, 7 days or 30 days.
How a load balancer answers a query
Each answer holds one address, chosen in this order.
- Steering orders the pools. The load balancer puts its pools in order for this query: as you numbered them, at random, by location or by distance.
- Unhealthy pools are skipped. We go down the order and skip disabled pools and pools with no healthy origin.
- A pool chooses an origin. The first pool left chooses one origin by weight or by priority, and the answer carries its address.
- The fallback pool tries. If no pool in the order can answer, the fallback pool tries.
- The name keeps resolving. If that fails too, we answer with one of the enabled origins anyway.
What customers build with DNS
Move a domain’s DNS from another provider
Export the zone from your old provider as a BIND zone file and import it here. Then set the nameservers at your registrar to ns1.coritan.com to ns8.coritan.com.
Uses: DNS and a domain you own
Import records from a zone file
Failover between two data centres
Put a server from each data centre in one pool, with failover by priority and a health check. When the first stops answering, queries get the second server’s address.
Uses: Two servers and a DNS load balancer
Visitors sent to the nearest server
Give each pool a primary location and turn on proximity steering. Each query then gets the pool closest to the nameserver that answered it.
Uses: Servers in several locations and a DNS load balancer
DNSSEC for a domain registered elsewhere
Add the domain here, then copy its DS record to your registrar. Resolvers that validate DNSSEC then refuse forged answers for the domain.
Uses: DNS and your registrar
Publish the DS record at your registrar
Limits
The fixed limits of a zone and its load balancers, whatever your plan.
| Websites | |
|---|---|
| What counts as a website | Each DNS zone is one. A web proxy for a name outside your zones is one more. www.example.com under your own example.com zone is not another. |
| An example | Two zones, example.com and example.org, with a proxy on shop.example.com count as two websites. A proxy for a name outside both zones makes three, which is the Free plan’s limit. |
| A free coritan.gg name | Its zone counts as a website too |
| Zones | |
| Records in one zone | 1,000 |
| Zones on one account | 100, within what your plan allows |
| NS records at @ | At least two |
| CNAME records | Not at @, and never on a name that has another record |
| Load balancing | |
| Origin pools in one zone | 50 |
| Origins in one pool | 20 |
| Load balancers in one zone | 50, within what your plan allows |
| Pool entries in one load balancer | 200 |
| What an answer holds | One address. Visitors then connect straight to that origin, outside Edge Proxy. |
Add-ons
An add-on raises one limit without a change of plan.
- Websites Pack: 10 more websites for your account, without a change of plan.
Guides for DNS
Our docs explain each record type and setting.
- How DNS hosting works: Zones, nameservers, records, TTLs and proxied records.
- Add a domain you already own: Host the DNS for a domain registered elsewhere, then point its nameservers here.
- Add, edit and delete DNS records: Change a zone’s records on the DNS tab or through the API.
- DNS record types: Each record type a zone accepts, and what it takes.
- Set up DNSSEC: Read a zone’s DS records and publish them at your registrar.
- How DNS load balancing works: Pools, health checks, steering by location and failover.
Move your DNS to Coritan
Add your first domain on the Free plan, with every record type and DNSSEC.
Frequently asked questions
Does DNS hosting cost extra?
DNS hosting comes with every plan at no extra charge. Each domain in our DNS counts as one of your websites, and so does a web proxy for a name outside your domains: 3 websites on Free, 10 on Pro and 50 on Business. A web proxy for a name under one of your domains, such as www.example.com, is not another website.
Can I keep my domain at another registrar?
Keep it where it is: add the domain to our DNS, then set its nameservers at your registrar to ours, ns1.coritan.com to ns8.coritan.com.
How fast do changes take effect?
Our nameservers answer with a change as soon as you save it. A resolver that kept the old answer uses it until the record’s TTL runs out, so lower the TTL a while before a planned change.
Can I manage records through the API?
You can add, change and delete records through the API as well as on the DNS tab. The dashboard also imports and exports a whole zone as a standard zone file.
What does a load balancer do?
It answers a name with the servers in your pools that pass their health checks, can steer visitors by where they are, and falls back to another pool when one is down. The Free plan includes 1, Pro 5 and Business 25.
Is DNSSEC on for every zone?
We sign every zone from the moment you add it, with algorithm 13 (ECDSAP256SHA256). Resolvers check the signatures once the zone’s DS record is at the domain’s registrar, which you add yourself. We do not send one to the registry for a domain registered with us, so resolvers treat that zone as unsigned. We replace the zone-signing key every 10 days, and the DS record does not change.
Which record types can a zone hold?
A zone holds A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, PTR, SVCB, HTTPS and DS records, up to 1,000 of them. A CNAME cannot sit at the domain itself (@), so give the domain an A or AAAA record instead.
How often do health checks run?
We check every enabled origin that has a health check once a minute, over HTTP, HTTPS or a TCP connection, from one place. Queries skip an origin that fails until it passes again. A new origin counts as healthy until its first check, and an IPv6 origin is not checked while our checker has no IPv6 route.
