DNS zone

GET /v1/orgs/{orgSlug}/dns/zones

The DNS zones this org runs on the runlot nameservers. rrsets is omitted here and is returned only when you fetch a single zone. Requires viewer or higher.

operationId listZones

POST /v1/orgs/{orgSlug}/dns/zones

Idempotent — an existing zone comes back unchanged. A new zone is created with an SOA record and an apex NS rrset. That NS rrset is managed by runlot and cannot be edited; without it the domain would not resolve at all.

Creating the zone does not by itself make any name resolve through runlot. Change the NS records at your registrar to the values in nameservers for delegation to take effect — the delegation field reflects that state. Requires admin or higher. Recorded in the audit log as dns.zone.create.

operationId createZone

Request body: application/json · object

GET /v1/orgs/{orgSlug}/dns/zones/{zone}

Requires viewer or higher.

operationId getZone

DELETE /v1/orgs/{orgSlug}/dns/zones/{zone}

Deletes all records and the zone itself. If delegation still points at the runlot nameservers, the domain will stop resolving — change the NS records at your registrar before deleting. Requires admin or higher. Recorded in the audit log as dns.zone.delete.

operationId deleteZone

PUT /v1/orgs/{orgSlug}/dns/zones/{zone}/rrsets/{name}/{type}

Replaces one whole rrset (name + type). This does not append a single value — records becomes the entire new content of that rrset.

Values are validated when you save: a CNAME cannot sit at the apex and cannot coexist with another type on the same name, and A/AAAA, MX, SRV, and CAA are checked for shape. A TXT record over 255 bytes is split into chunks in the zone file. A record managed by runlot (project linking, certificate issuance, or a zone's NS) returns 409 managed_rrset.

Requires member or higher. Recorded in the audit log as dns.rrset.set.

operationId putRRset

Request body: application/json · object

DELETE /v1/orgs/{orgSlug}/dns/zones/{zone}/rrsets/{name}/{type}

Requires member or higher. A record that Runlot manages for you returns 409 managed_rrset — to remove one, disconnect the project from its Domains screen rather than deleting the record here. Audit event dns.rrset.delete.

operationId deleteRRset

POST /v1/orgs/{orgSlug}/dns/zones/{zone}/dnssec

Moves the zone from off to signing. Signing is performed by the nameserver, and key material is never stored by Runlot. Turning DNSSEC off also clears the recorded DS. Leaving an old key's DS registered in the parent zone stops the domain from validating. Requires admin or higher.

operationId setZoneDNSSEC

Request body: application/json · object

PUT /v1/orgs/{orgSlug}/dns/zones/{zone}/dnssec/ds

Runlot does not query the parent zone. Send this value once the DS record exists in the parent zone; the zone then moves from signing to ds_pending. An empty list means "not yet" and does not advance the state. Requires admin or higher.

operationId setZoneDS

Request body: application/json · object