DNS zone

GET /v1/orgs/{orgSlug}/dns/zones

The list of DNS zones this org operates on the Runlot nameservers (docs/domains.md §4). rrsets is not included, and is provided only in the single-item lookup. Available to viewer and above.

operationId listZones

POST /v1/orgs/{orgSlug}/dns/zones

Is idempotent — an existing zone comes back unchanged. A zone is born with an SOA (the generator builds it from serial) and an apex NS rrset, and that NS is locked in the editor because managed_by = system: if a user deletes it, the domain never resolves at all (§7).

Creating the zone alone does not yet make any name receive our answers. You must change the NS at the registrar to nameservers for delegation to take effect (the delegation badge reflects that state). Requires admin or higher. Audited as dns.zone.create.

operationId createZone

Request body: application/json · object

GET /v1/orgs/{orgSlug}/dns/zones/{zone}

Requires viewer or higher.

operationId getZone

DELETE /v1/orgs/{orgSlug}/dns/zones/{zone}

Deletes all records and the DNS zone file together. If delegation still points to Runlot nameservers, the domain will not connect properly. You must change the NS at the registrar before deleting. Admin or above. Audit dns.zone.delete.

operationId deleteZone

PUT /v1/orgs/{orgSlug}/dns/zones/{zone}/rrsets/{name}/{type}

Replaces one whole rrset (name + type) — this does not add a single value; records becomes the entire new content of that rrset.

Validation happens at save time (§4.3): a CNAME cannot sit at the apex and cannot coexist with another type on the same name, and A/AAAA, MX, SRV, and CAA are checked for shape. A TXT record over 255 bytes is split into chunks in the zone file. A record with managed_by set (project linking, ACME, or NS of a DNS zone) returns 409 managed_rrset.

Requires member or higher. Audited as dns.rrset.set.

operationId putRRset

Request body: application/json · object

DELETE /v1/orgs/{orgSlug}/dns/zones/{zone}/rrsets/{name}/{type}

A managed record returns 409 managed_rrset. To disconnect a project, disconnect it from the project's Domains screen instead of deleting the record (§7). Requires member or higher. Audit event dns.rrset.delete.

operationId deleteRRset

POST /v1/orgs/{orgSlug}/dns/zones/{zone}/dnssec

off → signing. Signing is performed by the nameserver (Knot), and key material is never stored in the CP (§4.5). Disabling the feature also deletes the recorded DS. Registering an old key's DS in the parent zone prevents the domain from validating correctly. Available to admin and above.

operationId setZoneDNSSEC

Request body: application/json · object

PUT /v1/orgs/{orgSlug}/dns/zones/{zone}/dnssec/ds

The CP does not query the parent zone. This value is the fact, reported by the operator (or D3's registrar sync), that the nameserver has created the DS record, and the state moves from signing → ds_pending. An empty list means "not yet", so it does not advance the state. Requires admin or higher.

operationId setZoneDS

Request body: application/json · object