DNS

See Resource references for accepted reference kinds, lookup scopes, canonical identities and exact list filters. DNS hosts authoritative zones for your domains. Every zone is signed with DNSSEC from the moment it exists, and a zone can be made private so it answers only inside your VPCs. The service is global — one endpoint, dns.basaltic.sh, no region segment. The public namespace is not regional.

Proving ownership

Delegating the domain, which is also how you prove it is yours — and how to move a live one without an outage.

Records

RRsets, the values array, and the one rule that breaks zones silently.

Zone files

Moving a zone in, and taking a copy before a bulk change.

Private zones

Zones that answer only inside the VPCs you attach to them.

DNSSEC

Always on. What to paste at your registrar to close the chain.

Permissions

Every IAM action the service checks, and which call needs it.

Creating a zone

Console
API
CLI
Go

Go to DNS and choose Create Zone. Under Zone details, enter the fully-qualified Name — example.com, not a hostname inside it.There is no DNSSEC switch to find — the create page describes itself as signed with DNSSEC by default and its summary row reads DNSSEC: Enabled. The one case that calls for an unsigned zone is hosting the domain at two providers at once, and that is done through the API.Existing records carries one switch: Import my existing records. Turn it on if you are moving a live domain and we will read its records from your current provider before you change anything at your registrar. See Moving a live domain.Once the zone exists, its Settings tab carries the Nameservers card with the names to copy into your registrar.

POST https://dns.basaltic.sh/v1/zones
{ "name": "example.com" }

Optional fields worth knowing about:

Field	Default	Use it when
`import_existing_records`	`false`	Moving a live domain — see below

basaltic dns zone create --name example.com

Add --import-existing-records when you are moving a live domain. Use the API for private zone VPC references.

cfg, err := basaltic.NewConfig(ctx,
    basaltic.WithClientCredentials(os.Getenv("BASALTIC_ACCESS_KEY_ID"), os.Getenv("BASALTIC_SECRET_ACCESS_KEY")),
)
if err != nil {
    log.Fatal(err)
}

zone, err := dns.New(cfg).CreateZone(ctx, &dns.ZoneCreateRequest{
    Name: "example.com",
})

DNS is global, so the config needs no region. zone.Nameservers carries the delegation to copy into your registrar.

The SOA and apex NS records are generated for you, and the zone is queryable on success. The response carries a nameservers array — that is what you copy into your registrar to delegate the domain, and it is unique to this zone.

A new zone with no zone above it on the platform does not resolve until you prove you own the domain. Creating it is not claiming it.

Limits and troubleshooting

The bounds the API enforces, and what to check when a name is not resolving the way you expect.

API reference

Every endpoint, with the IAM action each one requires.

Get started

Products

Platform

Help

Proving ownership

Records

Zone files

Private zones

DNSSEC

Permissions

Creating a zone

Next

Limits and troubleshooting

API reference

Proving ownership

Records

Zone files

Private zones

DNSSEC

Permissions

​Creating a zone

​Next

Limits and troubleshooting

API reference

Creating a zone

Next