CNX Documentation

Managing zone changes

Changes to your DNS zones are made by editing files in the zones repository and opening a merge request. Validation runs automatically on every push, completing within about 30 seconds and posting the result as a status check. Once a Checker merges the request, deployment is automatic too — the change is live within about 120 seconds.

Adding a zone

Create a new directory named after the zone apex, with a zone.conf inside it, using the template in zone.conf format as your starting point.

To try this out before touching a real zone, do it once with example.com exactly as shown below — the platform recognizes this specific name, runs it through the same validation as any real zone, and never deploys it.

git switch -c add-example-com
mkdir example.com

Edit example.com/zone.conf:

  • Set $ORIGIN to example.com.
  • Update the SOA hostmaster to match contacts.yaml
  • Add your records
git add example.com/zone.conf
git commit -m "add zone example.com"
git push origin add-example-com

When you're ready to add a real zone, repeat these steps with your own domain name instead. Once the zone deploys, check the reports repository (where your subscription includes it) — a new zone gets its own DNSSEC key automatically, and its first DS record will be waiting for you to publish at your registrar. See Publishing and updating DS records.

Making a change

The same flow applies to any change to an existing zone — for example, adding a record:

git switch -c add-vpn-record

Open the zone's zone.conf in your editor and add your record(s), for example:

vpn  IN A  203.0.113.50
git add example.com/zone.conf
git commit -m "add vpn A record for example.com"
git push origin add-vpn-record

Opening the merge request

The Maker who pushed the branch opens the merge request: log in to git.cnx.net.kh and open it against your branch. A Checker (see Identity and access) then reviews the diff and the status check, and approves and merges.

If validation fails, push another commit to the same branch — don't open a new merge request. The pipeline re-validates automatically on the new push.

The zone file is always named zone.conf, and CNX's NS records at the top of it shouldn't be modified — see zone.conf format for the full template. If a name needs to point at a CDN, SaaS platform, or anything else that only gives you a CNAME, use aliases.yml to flatten it — it works for any record, not just the apex.