DNS

enum DNS is authoritative DNS hosting for domains you own. You create a zone for your domain, point your registrar’s nameservers at the pair enum assigns you, and manage records through the enum API, the enumctl CLI, or your dashboard. Zones are served from nameservers operated in Europe.

How it works

A zone is a domain you host on enum (for example example.com). Every zone is assigned a dedicated pair of nameservers. Your zone only goes live once your registrar delegates the domain to that pair, which proves you own the domain and prevents anyone else from claiming it.

1. Create a zone for your domain:

   enumctl dns zones create example.com

   enum assigns the zone a pair of nameservers and prints them:

   Point your domain's registrar nameservers to:
     curie.ns.enum.co
     planck.ns.enum.co

2. Delegate the domain at your registrar: set the domain’s nameservers to the pair shown above. This step happens at your domain registrar, not on enum.

3. Wait for activation. enum checks for the delegation and activates the zone automatically once it sees your registrar pointing at the assigned pair. To check immediately instead of waiting:

   enumctl dns zones verify example.com

4. Manage records once the zone is active:

   enumctl dns records create www.example.com A 203.0.113.10

Note

Records you add before the zone is active are saved and published the moment the zone goes live, so the zone comes up fully populated. A record can only be resolved once the zone is active.

See the DNS CLI reference for every command and flag.

Zones

A zone must be a registrable root domain (an eTLD+1), such as example.com or example.co.uk. A public suffix (co.uk), a bare label (localhost), or a subdomain (api.example.com) is not a valid zone. Manage subdomains as records inside their parent zone.

The same domain can be claimed by more than one project, but only the project whose assigned nameservers the domain is actually delegated to gets an active zone. If a domain stops being delegated to enum for a sustained period, its zone is deactivated and the name is released for a new owner.

The apex NS and SOA records are managed by enum and cannot be edited. Everything else in the zone is yours.

Records

Records are grouped into record sets by name and type. A record set holds one or more values that share a TTL, for example two A values for round-robin, or several MX values.

Supported types

Type	Value example
A	203.0.113.10
AAAA	2001:db8::1
CNAME	target.example.net.
MX	10 mail.example.com.
TXT	"v=spf1 include:_spf.example.com ~all"
NS	ns1.delegated.net. (subdomain delegation)
SRV	10 60 5060 sip.example.com.
CAA	0 issue "letsencrypt.org"

Rules

• A record’s name must fall within the zone (the apex or a subdomain of it).
• A CNAME cannot share a name with any other record type, and a name can hold at most one CNAME. A CNAME is not allowed at the zone apex.
• All values in a record set share one TTL. Duplicate values in the same set are rejected.
• Values are validated per type and stored in canonical form. Hostnames are compared case-insensitively.

TTLs

If you create a record without a TTL, enum applies a per-type default:

Type	Default TTL	Allowed range
A, AAAA	300s	60s - 86400s
NS	86400s	3600s - 604800s
All other types	3600s	60s - 86400s

Import and export

You can bulk-load records from a standard BIND zone file, and export a zone back to one.

# Preview the changes without applying them
enumctl dns zones import example.com --file example.com.zone --dry-run

# Apply
enumctl dns zones import example.com --file example.com.zone

Import runs in one of three modes:

Mode	Behavior
merge (default)	Create or update the record sets in the file; leave everything else untouched.
replace	Like merge, and delete record sets that are not in the file.
prune	Delete every existing record set, then import the file.

The SOA and the apex NS in the file are ignored (enum manages them), and unsupported record types or names outside the zone are skipped with a warning.

enumctl dns zones export example.com --file example.com.zone

Note

Export requires an active zone.

Deletion protection

To guard a zone against accidental deletion, deletion protection is automatically enabled. A protected zone cannot be deleted until protection is removed.

# Create a zone with deletion protection disabled
enumctl dns zones create example.com --deletion-protection=false

# Turn on deletion protection for an existing zone
enumctl dns zones protect example.com

# Turn off deletion protection so the zone can be deleted
enumctl dns zones unprotect example.com