The platform includes a powerful authoritative DNS service built on BIND, one of the most widely-used DNS server implementations. This service allows you to host authoritative DNS zones for your domains directly within your tenant, providing complete control over domain name resolution.

Unlike simple DNS forwarding, authoritative DNS makes your network the definitive source for DNS records in the domains you control. This capability is essential for organizations that need to manage their own domain name resolution, implement split-horizon DNS configurations, or provide DNS services as part of their infrastructure offerings.

BIND Integration

The platform implements authoritative DNS through BIND, providing enterprise-grade DNS capabilities including:

Network-Level DNS Selection

DNS services are configured at the network level, giving you granular control over which networks provide DNS services. When editing a network, you can select from several DNS options:

Default Behavior and Recursion

When you enable BIND on a network, it becomes an authoritative DNS server by default with no recursion enabled. This means:

This design ensures clean separation between authoritative and recursive DNS functions while maintaining system-wide DNS connectivity.

DNS views are a powerful BIND feature that allows you to provide different DNS responses based on who is making the query. In your tenant, views act as intelligent traffic processors that determine how to handle DNS requests based on:





DNS views are processed in order, with the first matching view handling the request. This allows you to create specific rules for internal clients while having a catch-all rule for external traffic.

A DNS zone represents a domain or subdomain for which your tenant is authoritative. Each zone contains:



When configuring zones, you'll specify name servers that are authoritative for the domain. You have two main approaches:



When using in-domain name servers, you must configure glue records at your domain registrar. These A records tell the world the IP addresses of your name servers, breaking the circular dependency where someone needs to resolve ns1.company.com to find the authoritative server for company.com.



The platform follows standard DNS conventions for domain names:

The platform supports all standard DNS record types:



Within zones, record order can affect resolution, particularly when using relative names or special characters. Best practices include:

The platform supports standard DNS zone transfer mechanisms for redundancy.



Zone transfers occur over TCP port 53 and should be restricted to authorized secondary servers. The platform allows you to specify which IP addresses can request zone transfers, preventing unauthorized access to your DNS data.



When records change on the primary server, the platform automatically sends notifications to configured secondary servers, ensuring rapid propagation of DNS updates across your infrastructure.

Authoritative DNS requires specific network access.

Authoritative DNS is typically configured on external networks to provide public accessibility. However, you can run authoritative DNS on internal networks for private domains or split-horizon configurations.

Query Restriction

Access Control

Zone Transfer Security