Working with this resource via an AI agent? Datum publishes a DNS skill that teaches agents the canonical patterns for this resource.
datumctl, or the API.
What you get
- Global authoritative DNS. Datum serves answers from a globally distributed anycast network for performance and redundancy.
- Zone management. Add zones for any domain or subdomain, whether Datum hosts the DNS or another provider does, so you have one view of your DNS estate.
- Modern record types. A, AAAA, ALIAS, CNAME, MX, NS, PTR, TXT, SRV, CAA, TLSA, HTTPS, SVCB, and SOA. See DNS records.
- Apex ALIAS records. Point the zone apex at a hostname and still return A and AAAA answers to clients. See ALIAS records.
- Bulk import and export. Import a BIND zone file, or snapshot what a domain resolves to today. Export a zone back out at any time. See Migrate a zone.
- Audit log. Every zone and record change is recorded with the user who made it and when. See Activity logs.
- Project scoped. Zones live in a project and follow that project’s role-based access control.
Datum’s nameservers
Datum serves your zones from:ns1.datumdomains.netns2.datumdomains.netns3.datumdomains.netns4.datumdomains.net
datumctl dns zone nameservers <domain> both show the assigned set.
How DNS on Datum works
1
Create a zone
Create a zone for the domain or subdomain you want Datum to serve, for example
example.com. If the domain isn’t tracked in your project yet, Datum adds it for you.A zone’s domain name is fixed once the zone exists. To host a different name, create another zone.2
Verify that you own the domain
Datum doesn’t serve DNS for a domain until you prove you control it. You publish a TXT record at your current DNS provider, or serve a token over HTTP from the domain.This is a gate, not a formality: no nameservers are assigned and no records are served until verification succeeds. See Verify domain ownership.
3
Datum provisions the zone
Once the domain is verified, Datum provisions the zone, assigns its nameservers, and creates the zone’s SOA record and its apex NS records for you. The zone is now live on Datum’s nameservers, even though nothing on the internet is asking them yet.
4
Add your records
Add the records the domain needs — web, mail, verification tokens for other services. Do this before you delegate, so the domain keeps working through the cutover. See DNS records.
5
Delegate at your registrar
Replace the domain’s nameservers at your registrar with the ones Datum assigned. This is the moment the internet starts asking Datum for answers.Delegation happens at your registrar, not on Datum, so Datum can only observe it. See Delegation.
6
Records go live
Resolvers pick up the new delegation as the old records expire from their caches. Allow for the parent zone’s TTL before you treat a delegation change as broken.
Domains and DNS zones
A domain and a DNS zone are two different things in Datum, and the difference matters. A domain is a record of a domain name you care about. It tracks registration details, the nameservers the name currently uses, and whether you’ve proven ownership — regardless of where the name is registered or who hosts its DNS. You can track a domain without Datum serving any DNS for it. A DNS zone is DNS hosting for one name. It holds the records Datum serves and the nameservers Datum assigns. A zone always has a domain behind it: create a zone for a name that isn’t tracked yet and Datum adds the domain automatically, then waits for that domain to be verified before provisioning anything. The practical consequences:- Verification belongs to the domain, not the zone. Verify a domain once and every zone for that name is unblocked.
- A domain name can be hosted by only one zone at a time. A second zone for the same name reports that the domain is already claimed and stays unprovisioned.
- Deleting a zone doesn’t delete the domain. The domain stays tracked and verified.
Concepts
DNS zone — The segment of the Domain Name System that holds the records for one domain or subdomain, managed as a single unit. DNS host — The provider that stores and serves a domain’s records, answering queries from the internet. Datum, Cloudflare, Amazon Route 53, and GoDaddy are all DNS hosts. Nameserver — A server that answers DNS queries for a zone. A domain’s registrar publishes which nameservers are authoritative for it. Registrar — The company you registered the domain with. Delegation is changed at the registrar, not at the DNS host. DNS record — One entry in a zone that maps a name to a resource: an IP address, a mail server, another hostname, or free text. Record set — Every record with the same name and type, treated as a unit.www with two A records is one record set with two values.
Zone apex — The zone’s own name, example.com rather than www.example.com. Written as @ in zone files and in Datum’s tools.
Delegation — The parent zone’s NS records that say which nameservers are authoritative for your domain. Set at your registrar.
TTL — How long resolvers may cache an answer. Shorter TTLs propagate changes faster and cost more queries.
BIND format — The standard text format for zone files. Datum imports and exports it.
Domain Connect — An open standard that lets a web service configure DNS at a registrar on your behalf with a single authorization.
Where to go next
Verify domain ownership
The gate every zone passes through before Datum serves it.
DNS zones
Zone lifecycle, statuses, nameservers, and the records Datum manages.
DNS records
Supported types, how to write names and values, TTLs, and record status.
ALIAS records
Apex-safe CNAME behavior, also known as CNAME flattening.
Migrate a zone
Move DNS to Datum from another provider, or move it away.
DNS setup for an ALB
Point a domain at an Application Load Balancer endpoint.
datumctl DNS plugin
Manage zones and records from your terminal.