DNS zones

GET /v1/orgs/{orgSlug}/dns/zones

The DNS zones this organization runs on runlot nameservers (docs/domains.md §4). rrsets is not included; it is provided on the single-zone lookup only. Requires viewer or above.

operationId listZones

POST /v1/orgs/{orgSlug}/dns/zones

Idempotent — a zone that already exists comes back as it is. A zone is born with an SOA (the generator builds it with serial) and an apex NS rrset, and that NS is managed_by = system, so it is locked in the editor: if a user deleted it, the whole domain would stop resolving (§7).

Creating the zone alone does not yet make any name take our answers. Delegation stands only once you change NS to nameservers at the registrar (the delegation badge shows that state). Requires admin or above. Audit event dns.zone.create.

operationId createZone

Request body: application/json · object

GET /v1/orgs/{orgSlug}/dns/zones/{zone}

Requires viewer or above.

operationId getZone

DELETE /v1/orgs/{orgSlug}/dns/zones/{zone}

It deletes every record together with the DNS zone file. If delegation still points at runlot nameservers, that domain will not resolve. Change NS at the registrar before deleting. Requires admin or above. Audit event dns.zone.delete.

operationId deleteZone

PUT /v1/orgs/{orgSlug}/dns/zones/{zone}/rrsets/{name}/{type}

It replaces one rrset (name + type) wholesale — it does not add a single value; records is the entire new contents of that rrset.

Validation happens at save time (§4.3): CNAME cannot sit at the apex and cannot coexist with another type at the same name, and A/AAAA·MX·SRV·CAA are checked for shape. A TXT longer than 255 bytes is split into chunks in the zone file. A record that has managed_by (project links, ACME, the DNS zone's NS) returns 409 managed_rrset.

Requires member or above. Audit event dns.rrset.set.

operationId putRRset

Request body: application/json · object

DELETE /v1/orgs/{orgSlug}/dns/zones/{zone}/rrsets/{name}/{type}

A managed record returns 409 managed_rrset. To break a project link, do not delete the record — disconnect it from the project's domain screen (§7). Requires member or above. Audit event dns.rrset.delete.

operationId deleteRRset

POST /v1/orgs/{orgSlug}/dns/zones/{zone}/dnssec

off → signing. The nameserver (Knot) does the signing, and no key material is stored on CP (§4.5). Turning the feature off also deletes the recorded DS. If you register an old key's DS with the parent zone, the domain will not resolve correctly. Requires admin or above.

operationId setZoneDNSSEC

Request body: application/json · object

PUT /v1/orgs/{orgSlug}/dns/zones/{zone}/dnssec/ds

CP does not query the parent zone. This value is a fact reported by an operator (or by D3's registrar sync) about the DS the nameserver produced, and the state moves signing → ds_pending. An empty list means "not yet", so it does not push the state forward. Requires admin or above.

operationId setZoneDS

Request body: application/json · object