DNS

Manage your authoritative DNS zones through CNX's Git server. Your team edits and approves configuration; CNX validates, deploys, and signs the zones.

Start with Getting started to set up access and clone your zones repository. If your domain is already hosted elsewhere, continue with Migrating an existing domain. For a new zone or a routine record update, use Managing zone changes.

Delegation and DS records are published through your registrar. Nameserver setup covers custom names and glue; Publishing DS records completes the DNSSEC chain of trust. Daily reports and continuous telemetry are available where your subscription includes them.

Start and access

• Getting started

  Set up Git access, clone your zones repository, and choose the next step for a new or existing domain.

• Identity and access

  How GitLab access is federated, for UAT and for production.

• Migrating an existing domain to CNX DNS

  Pulling an existing live domain onto CNX DNS with no forced downtime.

Zone management

• Managing zone changes

  The branch, merge-request, and validation workflow for any zone change.

• Zones repository format

  The zones repository's directory layout and what each file is for.

• contacts.yaml format

  Exact contacts.yaml fields and what each one controls.

• zone.conf format

  Exact BIND zone-file format and the standard record template.

Nameservers and aliases

• Using your own nameserver names

  Use nameservers under your own domain while continuing to use CNX's authoritative DNS infrastructure.

• Setting up aliases.yml

  Configure CNAME flattening for names that point to an external hostname rather than fixed IP addresses.

• aliases.yml format

  Exact aliases.yml syntax and CNX CNAME-flattening rules.

• In-bailiwick nameservers

  Why in-bailiwick nameservers require glue records, and how glue removes an otherwise separate nameserver-address lookup from the cold DNS path.

• CNAME flattening

  How CNAME flattening makes alias targets usable at the zone apex and can remove an additional DNS lookup from any configured alias.

DNSSEC

• Publishing and updating DS records

  Publishing a zone's first DS record, and updating it during a KSK rollover.

• DNSSEC

  Why every zone is signed automatically, and what needs your action versus CNX's.

Reports and telemetry

• The compliance evidence package

  What's in the daily compliance evidence package and why it exists.

• Reports repository format

  The reports repository's file layout and the schema of each report.

• Verifying report integrity

  Independently verifying the KSK attestation and the daily RFC 3161 timestamp.

• DNS telemetry

  Continuous DNS event and query feeds for your SIEM or analytics platform.