DNS

enum DNS is authoritative DNS hosting for domains you own. You create a zone for your domain, point your registrar’s nameservers at the pair enum assigns you, and manage records through the enum API, the enumctl CLI, or your dashboard. Zones are served from nameservers operated in Europe.

How it works

A zone is a domain you host on enum (for example example.com). Every zone is assigned a dedicated pair of nameservers. Your zone only goes live once your registrar delegates the domain to that pair, which proves you own the domain and prevents anyone else from claiming it.

1. Create a zone for your domain:

   enumctl dns zones create example.com

   enum assigns the zone a pair of nameservers and prints them:

   ✓ Zone example.com. created (dnszone-01m3pq0gpqe2x9v0dvw8css63s).
   
   ℹ Apex NS/SOA are already live on enum. Point your registrar nameservers to:
     curie.ns.enum.cloud
     planck.ns.enum.cloud
   
   ℹ You can edit records now; they publish to DNS once enum observes the delegation (enumctl dns zones verify).

2. Delegate the domain at your registrar: set the domain’s nameservers to the pair shown above. This step happens at your domain registrar, not on enum.

3. Wait for activation. enum checks for the delegation and activates the zone automatically once it sees your registrar pointing at the assigned pair. To check immediately instead of waiting:

   enumctl dns zones verify example.com

4. Manage records once the zone is active:

   enumctl dns records create www.example.com A 203.0.113.10

Note

Records you add before the zone is active are saved and published the moment the zone goes live, so the zone comes up fully populated. A record can only be resolved once the zone is active.

See the DNS CLI reference for every command and flag.

Zones

A zone must be a registrable root domain (an eTLD+1), such as example.com or example.co.uk. A public suffix (co.uk), a bare label (localhost), or a subdomain (api.example.com) is not a valid zone. Manage subdomains as records inside their parent zone.

The same domain can be claimed by more than one project, but only the project whose assigned nameservers the domain is actually delegated to gets an active zone. If a domain stops being delegated to enum for a sustained period, its zone is deactivated and the name is released for a new owner.

The apex NS and SOA records are managed by enum and cannot be edited. Everything else in the zone is yours.

Records

Records are grouped into record sets by name and type. A record set holds one or more values that share a TTL, for example two A values for round-robin, or several MX values.

Supported types

Type	Value example
A	203.0.113.10
AAAA	2001:db8::1
CNAME	target.example.net. (allowed at the apex; see flattening below)
MX	10 mail.example.com.
TXT	"v=spf1 include:_spf.example.com ~all"
NS	ns1.delegated.net. (subdomain delegation)
SRV	10 60 5060 sip.example.com.
CAA	0 issue "letsencrypt.org"

Rules

• A record’s name must fall within the zone (the apex or a subdomain of it).
• A name can hold at most one CNAME. Away from the apex, a CNAME cannot share a name with any other record type.
• At the zone apex, a CNAME is allowed and flattens to the target’s A/AAAA addresses when served. It may coexist with MX, TXT, and CAA at the apex, but not with A or AAAA.
• All values in a record set share one TTL. Duplicate values in the same set are rejected.
• Values are validated per type and stored in canonical form. Hostnames are compared case-insensitively.

Apex hostname (CNAME flattening)

Normally a CNAME cannot sit at the zone apex next to MX or other apex records. On enum you can still point the apex at another hostname by creating a CNAME on the apex itself:

enumctl dns records create example.com CNAME target.example.net.

enum keeps the CNAME in your zone configuration and serves the target’s current A/AAAA addresses to resolvers (CNAME flattening). The apex may also hold MX, TXT, and CAA records. It cannot hold A or AAAA at the same time as the apex CNAME.

If the target has no addresses, enum withdraws the apex addresses until the target has some again.

TTLs

If you create a record without a TTL, enum applies a per-type default:

Type	Default TTL	Allowed range
A, AAAA	300s	60s - 86400s
NS	86400s	3600s - 604800s
All other types	3600s	60s - 86400s

Import and export

You can bulk-load records from a standard BIND zone file, and export a zone back to one.

# Preview the changes without applying them
enumctl dns zones import example.com --file example.com.zone --dry-run

# Apply
enumctl dns zones import example.com --file example.com.zone

Import runs in one of three modes:

Mode	Behavior
merge (default)	Create or update the record sets in the file; leave everything else untouched.
replace	Like merge, and delete record sets that are not in the file.
prune	Delete every existing record set, then import the file.

The SOA and the apex NS in the file are ignored (enum manages them), and unsupported record types or names outside the zone are skipped with a warning.

enumctl dns zones export example.com --file example.com.zone

Note

Export requires an active zone.

Deletion protection

To guard a zone against accidental deletion, deletion protection is automatically enabled. A protected zone cannot be deleted until protection is removed.

# Create a zone with deletion protection disabled
enumctl dns zones create example.com --deletion-protection=false

# Turn on deletion protection for an existing zone
enumctl dns zones protect example.com

# Turn off deletion protection so the zone can be deleted
enumctl dns zones unprotect example.com

DNSSEC

enum can sign your zone with provider-managed online signing. Enable it on an active zone, then publish the handoff material at your registrar so the parent zone can validate lookups.

enumctl dns zones enable-dnssec example.com

enum prints both forms most registrars accept:

• DS records (key tag / algorithm / digest type / digest). Prefer digest type 2 (SHA-256) when the registrar takes only one.
• DNSKEY fields (key tag, flag, algorithm, public key) for registrars that take the key instead of a DS digest.

enumctl dns zones disable-dnssec example.com

Remove the parent DS (or key) at your registrar before disabling DNSSEC, or lookups that expect a signed zone will fail validation.

TLS certificates

Issue certificates, including wildcards, for domains on enum DNS with cert-manager and ACME DNS-01 validation. See TLS certificates with cert-manager.