DNS

Manage supported DNS zones and records with native BIND or Cloudflare.

The DNS workspace manages structured DNS zones. DNS is separate from Site hostname attachment: a Site can have a hostname without Control owning its DNS zone, and a DNS zone can contain records unrelated to a Site.

In this section

DNS recordsCreate and change the structured DNS record types supported by Control.Native BIND DNSCreate and maintain authoritative DNS zones on the Control server using BIND.Cloudflare DNSConnect a scoped Cloudflare API token and manage supported records without exposing a broad provider console.DNSSECEnable, publish and verify DNSSEC for supported authoritative zones.

Control supports native BIND zones and a limited Cloudflare provider integration.

Common record types include A, AAAA, CNAME, NS, MX, TXT, CAA and SRV. Use DNSSEC where supported when you are prepared to publish the required DS record at the domain registrar.

Cloudflare provider prerequisite

Import Cloudflare stays available even before a provider credential exists. If needed, Control opens the scoped Cloudflare API-token workflow first and then continues into zone import after the provider is verified.

Hostname readiness

For direct/DNS-only ingress, Check hostname compares public A/AAAA answers with this Control host’s public ingress addresses. READY means all usable answers point to this host. A stale A/AAAA record, including a stray IPv6 answer, keeps the hostname NOT_READY.

For a hostname behind a configured Cloudflare proxy, public DNS intentionally returns Cloudflare edge addresses instead of the origin. Control therefore verifies the exact proxied Cloudflare A/AAAA record through the configured provider. If that record’s origin is this Control host, readiness reports READY · Cloudflare proxied; if the configured origin points elsewhere, it remains NOT_READY.