Getting started

CNX hosts your DNS configuration in a zones repository on git.cnx.net.kh. Your team proposes changes through merge requests, and CNX validates and deploys the approved configuration. CNX supplies your repository URL during onboarding; the URLs below are examples.

1. Set up access

Follow Identity and access to sign in and confirm your Maker or Checker role. Coordinate with your internal identity and CNX access team for production SSO access. Makers also register an SSH key to push changes from their workstation.

2. Clone your zones repository

git clone git@git.cnx.net.kh:customers/example-org/dns/zones.git
cd zones

The repository contains contacts.yaml and one directory per zone. Each zone directory contains zone.conf and, optionally, aliases.yml. See Zones repository format for the layout.

3. Set your contacts and confirm the change workflow

Complete contacts.yaml with your hostmaster, technical, and billing contacts. Submit the update through the zone-change workflow, including validation and Checker approval.

You can also use the documented example.com practice zone to exercise that workflow. CNX validates this specific name but never deploys it.

4. Add or migrate your domain

For an existing domain, follow Migrating an existing domain to prepare and verify the zone before changing delegation.
For a new zone, follow Adding a zone. After deployment, publish the nameserver delegation through your registrar.
To use nameserver names under your domain, follow Using your own nameserver names before delegation.

Every deployed zone is signed automatically. Follow Publishing and updating DS records to publish its DS record at your registrar and complete the DNSSEC chain of trust.

Reports and continuous telemetry

Where your subscription includes it, mirror reports to your own infrastructure on a schedule that suits your retention requirements — a nightly pull after 01:00 ICT will have the previous day's report ready before your business day begins:

git clone git@git.cnx.net.kh:customers/example-org/dns/reports.git
# then, e.g. nightly:
git -C reports pull --ff-only

See Reports repository format for what each file contains, and Verifying report integrity to check the timestamp and key attestation. Reports are included where your subscription provides the compliance evidence package.

For continuous SIEM ingestion, use CNX Telemetry Feeds. Its catalog and connection instructions cover DNS log and query feeds.

Getting help

For operational issues, contact CNX via the support channel in your service agreement. For billing and subscription changes, contact your CNX account manager.