DNS records

Records are the contents of a zone: the entries that turn a name into an address, a mail route, or a piece of text. You can manage them from the Datum Cloud portal, from datumctl, or through the API.

Record sets

Datum groups records the way DNS does. Every record with the same name and the same type forms one record set, and all of its values share a TTL.

www   A   300   203.0.113.10
www   A   300   203.0.113.11

That’s one record set — www, type A — with two values. Adding a second address adds a value to the existing set rather than creating a competing record, and resolvers return both.

Supported record types

Type	What it does	Value
`A`	Points a name at an IPv4 address	`203.0.113.10`
`AAAA`	Points a name at an IPv6 address	`2001:db8::1`
`CNAME`	Makes a name an alias for another hostname	A hostname
`ALIAS`	Apex-safe alias: points at a hostname but answers with addresses. See ALIAS records	A hostname
`MX`	Routes mail for the domain	A preference number and a mail exchange hostname
`TXT`	Holds free text — SPF, DKIM, DMARC, and service verification tokens	A text string
`NS`	Delegates a subdomain to other nameservers	A nameserver hostname
`SRV`	Advertises the host and port for a service	Priority, weight, port, and target
`CAA`	States which certificate authorities may issue for the domain	A flag, a tag, and a value
`TLSA`	Binds a certificate or key to a name for DANE	Usage, selector, matching type, and certificate data
`HTTPS`	Advertises connection parameters for HTTPS clients, such as HTTP/3 support	Priority, target, and parameters
`SVCB`	The general form of `HTTPS`, for other protocols	Priority, target, and parameters
`PTR`	Maps an address back to a name	A hostname
`SOA`	The zone’s authority record. Datum manages this one	Managed for you

The apex NS records and the SOA record are written by Datum. See Records Datum manages for you.

Write names

Record names are relative to the zone. In a zone for example.com:

You want	You write
`www.example.com`	`www`
`example.com` itself	`@`
`api.staging.example.com`	`api.staging`
Anything not otherwise matched	`*`
`_dmarc.example.com`	`_dmarc`

The most common mistake is writing the full name. www.example.com inside a zone for example.com creates a record for www.example.com.example.com. Underscore labels like _dmarc, _acme-challenge, and DKIM selectors are ordinary names — write them as they appear in the instructions you were given, minus the zone.

Write values

Values that name another host must be absolute: end them with a dot.

mail.example.com.      correct
mail.example.com       ambiguous
mail                   wrong

A missing trailing dot makes the value relative to the zone, so mail.example.com becomes mail.example.com.example.com and resolution fails. This applies to CNAME, ALIAS, NS, MX exchanges, SRV targets, and PTR values. Two rules cover almost every mistake:

Names are relative. www, not www.example.com.
Targets are absolute. mail.example.com., with the dot.

Set TTLs

The TTL is how long resolvers may cache an answer. Every record set has one. Leave it unset and the record uses Auto, which resolves to five minutes — short enough that mistakes are cheap to fix, long enough to be efficient for most sites. Set it explicitly when you have a reason:

Before a planned change, lower the TTL well in advance so the old answer expires quickly when you make the cut.
After things settle, raise it for records that rarely change.

Datum doesn’t round TTLs to preset options. A TTL of 240 seconds stays 240 seconds.

Rules DNS itself imposes

A few limits come from DNS, not from Datum, and every provider enforces them:

A CNAME can’t share a name with other records. If www is a CNAME, it can’t also have an A record or a TXT record.
The apex can’t be a CNAME. The apex already has SOA and NS records, so a CNAME there is illegal. Use an ALIAS record instead.
Only one SOA per zone, and Datum owns it.

Record status

Each record set reports a status.

Status	What it means
Programmed	The record is live on Datum’s nameservers.
Pending	The write is in flight. This is normal for a few moments after any change.
Conflict	Something else already occupies that name. Most often the name accidentally includes the zone — check for `www.example.com` where `www` was meant.
Not owner	Another record set already owns that name and type. Change the record through whatever owns it, or remove that owner first.
Error	Datum couldn’t program the record. The record’s detail view carries the message.
Rejected	The value was refused as invalid for its type.

A record stuck at Pending for more than a moment is worth inspecting; the detail view for the record carries the underlying message.

Programmed means Datum is serving the record. It doesn’t mean the world can see it — that also needs the domain delegated to Datum, and it needs any previously cached answer to expire.

Managing records from the terminal

The datumctl DNS plugin covers records in full, including entering multi-part values, bulk-applying a zone file, and filtering by status:

datumctl dns record create example.com www A 203.0.113.10
datumctl dns record list example.com

ALIAS records

Point the apex at a hostname and still answer with addresses.

DNS zones

Zone status, delegation, and managed records.

Migrate a zone

Import records in bulk from another provider.

DNS setup for an ALB

A worked example with an apex ALIAS and a subdomain CNAME.

Documentation

TLDR

Platform

ALB

Connectors

Galactic VPC

Domains & DNS

Agents

Tools

Record sets

Supported record types

Write names

Write values

Set TTLs

Rules DNS itself imposes

Record status

Managing records from the terminal

ALIAS records

DNS zones

Migrate a zone

DNS setup for an ALB

​Record sets

​Supported record types

​Write names

​Write values

​Set TTLs

​Rules DNS itself imposes

​Record status

​Managing records from the terminal

​Related

ALIAS records

DNS zones

Migrate a zone

DNS setup for an ALB

Record sets

Supported record types

Write names

Write values

Set TTLs

Rules DNS itself imposes

Record status

Managing records from the terminal

Related