> ## Documentation Index
> Fetch the complete documentation index at: https://datum-4926dda5-docs-dns-guides.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS

> Authoritative DNS hosting for your domains, managed from the Datum Cloud portal, datumctl, or the API.

<Note>
  **Working with this resource via an AI agent?** Datum publishes a [DNS skill](/agents/skills/dns) that teaches agents the canonical patterns for this resource.
</Note>

Datum hosts authoritative DNS for the domains you own. You create a zone for a domain, prove that you control that domain, point the domain at Datum's nameservers at your registrar, and manage records from the portal, `datumctl`, or the API.

## What you get

* **Global authoritative DNS.** Datum serves answers from a globally distributed anycast network for performance and redundancy.
* **Zone management.** Add zones for any domain or subdomain, whether Datum hosts the DNS or another provider does, so you have one view of your DNS estate.
* **Modern record types.** A, AAAA, ALIAS, CNAME, MX, NS, PTR, TXT, SRV, CAA, TLSA, HTTPS, SVCB, and SOA. See [DNS records](/domain-dns/dns-records).
* **Apex ALIAS records.** Point the zone apex at a hostname and still return A and AAAA answers to clients. See [ALIAS records](/domain-dns/alias-records).
* **Bulk import and export.** Import a BIND zone file, or snapshot what a domain resolves to today. Export a zone back out at any time. See [Migrate a zone](/domain-dns/migrate-dns).
* **Audit log.** Every zone and record change is recorded with the user who made it and when. See [Activity logs](/platform/activity-logs).
* **Project scoped.** Zones live in a project and follow that project's role-based access control.

## Datum's nameservers

Datum serves your zones from:

* `ns1.datumdomains.net`
* `ns2.datumdomains.net`
* `ns3.datumdomains.net`
* `ns4.datumdomains.net`

Always delegate to the nameservers Datum assigns to your specific zone rather than typing this list from memory. The zone's detail page in the portal and `datumctl dns zone nameservers <domain>` both show the assigned set.

## How DNS on Datum works

<Steps>
  <Step title="Create a zone">
    Create a zone for the domain or subdomain you want Datum to serve, for example `example.com`. If the domain isn't tracked in your project yet, Datum adds it for you.

    A zone's domain name is fixed once the zone exists. To host a different name, create another zone.
  </Step>

  <Step title="Verify that you own the domain">
    Datum doesn't serve DNS for a domain until you prove you control it. You publish a TXT record at your current DNS provider, or serve a token over HTTP from the domain.

    This is a gate, not a formality: no nameservers are assigned and no records are served until verification succeeds. See [Verify domain ownership](/domain-dns/domain-verification).
  </Step>

  <Step title="Datum provisions the zone">
    Once the domain is verified, Datum provisions the zone, assigns its nameservers, and creates the zone's SOA record and its apex NS records for you. The zone is now live on Datum's nameservers, even though nothing on the internet is asking them yet.
  </Step>

  <Step title="Add your records">
    Add the records the domain needs — web, mail, verification tokens for other services. Do this before you delegate, so the domain keeps working through the cutover. See [DNS records](/domain-dns/dns-records).
  </Step>

  <Step title="Delegate at your registrar">
    Replace the domain's nameservers at your registrar with the ones Datum assigned. This is the moment the internet starts asking Datum for answers.

    Delegation happens at your registrar, not on Datum, so Datum can only observe it. See [Delegation](/domain-dns/dns-zones#delegation).
  </Step>

  <Step title="Records go live">
    Resolvers pick up the new delegation as the old records expire from their caches. Allow for the parent zone's TTL before you treat a delegation change as broken.
  </Step>
</Steps>

## Domains and DNS zones

A **domain** and a **DNS zone** are two different things in Datum, and the difference matters.

A [domain](/domain-dns/domains) is a record of a domain name you care about. It tracks registration details, the nameservers the name currently uses, and whether you've proven ownership — regardless of where the name is registered or who hosts its DNS. You can track a domain without Datum serving any DNS for it.

A **DNS zone** is DNS hosting for one name. It holds the records Datum serves and the nameservers Datum assigns. A zone always has a domain behind it: create a zone for a name that isn't tracked yet and Datum adds the domain automatically, then waits for that domain to be verified before provisioning anything.

The practical consequences:

* Verification belongs to the domain, not the zone. Verify a domain once and every zone for that name is unblocked.
* A domain name can be hosted by only one zone at a time. A second zone for the same name reports that the domain is already claimed and stays unprovisioned.
* Deleting a zone doesn't delete the domain. The domain stays tracked and verified.

## Concepts

**DNS zone** — The segment of the Domain Name System that holds the records for one domain or subdomain, managed as a single unit.

**DNS host** — The provider that stores and serves a domain's records, answering queries from the internet. Datum, Cloudflare, Amazon Route 53, and GoDaddy are all DNS hosts.

**Nameserver** — A server that answers DNS queries for a zone. A domain's registrar publishes which nameservers are authoritative for it.

**Registrar** — The company you registered the domain with. Delegation is changed at the registrar, not at the DNS host.

**DNS record** — One entry in a zone that maps a name to a resource: an IP address, a mail server, another hostname, or free text.

**Record set** — Every record with the same name and type, treated as a unit. `www` with two A records is one record set with two values.

**Zone apex** — The zone's own name, `example.com` rather than `www.example.com`. Written as `@` in zone files and in Datum's tools.

**Delegation** — The parent zone's NS records that say which nameservers are authoritative for your domain. Set at your registrar.

**TTL** — How long resolvers may cache an answer. Shorter TTLs propagate changes faster and cost more queries.

**BIND format** — The standard text format for zone files. Datum imports and exports it.

**Domain Connect** — An open standard that lets a web service configure DNS at a registrar on your behalf with a single authorization.

## Where to go next

<CardGroup cols={2}>
  <Card title="Verify domain ownership" icon="shield-check" href="/domain-dns/domain-verification">
    The gate every zone passes through before Datum serves it.
  </Card>

  <Card title="DNS zones" icon="layer-group" href="/domain-dns/dns-zones">
    Zone lifecycle, statuses, nameservers, and the records Datum manages.
  </Card>

  <Card title="DNS records" icon="list" href="/domain-dns/dns-records">
    Supported types, how to write names and values, TTLs, and record status.
  </Card>

  <Card title="ALIAS records" icon="arrows-turn-right" href="/domain-dns/alias-records">
    Apex-safe CNAME behavior, also known as CNAME flattening.
  </Card>

  <Card title="Migrate a zone" icon="right-left" href="/domain-dns/migrate-dns">
    Move DNS to Datum from another provider, or move it away.
  </Card>

  <Card title="DNS setup for an ALB" icon="server" href="/alb/dns-setup">
    Point a domain at an Application Load Balancer endpoint.
  </Card>

  <Card title="datumctl DNS plugin" icon="terminal" href="/datumctl/plugins/dns">
    Manage zones and records from your terminal.
  </Card>
</CardGroup>