DNS Zone Management
On this page 6 sections
Control Panel → DNS brings together your account’s DNS zones, global routing, verification status and record editing. Use it to inspect where an origin resolves and maintain custom DNS records alongside platform-managed routing.
To move a domain to Spook Systems for the first time, follow DNS Delegation & Global Routing.
Select a domain and origin
Choose a DNS zone in the Domain dropdown. The list is scoped to your account and includes zones being migrated as well as delegated zones. The migration panel shows the selected domain’s stage:
| Stage | Meaning and next step |
|---|---|
| Verify ownership | Add the supplied TXT record at the current provider, then use Check delegation. |
| Ownership verified | Import the current zone and review its records. |
| Ready to delegate | The zone is imported. Complete the registrar nameserver change and check delegation. |
| Delegated | The parent delegation matches Spook Systems. Generate or review global routing policies. |
A zone can contain several origins, such as example.com and api.example.com, with different routing policies. Use the Origin dropdown to inspect the one you need. Before routing is generated, the map has no regional policies to display; imported records are still available in the editor.
Read the global routing map
The map shows approximate geographic coverage for the selected origin’s published regional endpoints. Tap a location or choose a Routing region to inspect it. Where locations overlap, use the nearby-region buttons to select the endpoint.
- Resolving to lists the selected endpoint’s IP addresses.
- A load-balancer hostname appears when the endpoint comes from a node group.
- Nodes identifies the endpoint’s member nodes by the first eight characters of their UUIDs.
- Healthy · DNS verified means delegation is confirmed, the endpoint passed current health and HTTPS checks, and recent regional DNS verification succeeded.
- Awaiting verification means that full set of conditions is not currently confirmed. Staged · awaiting delegation indicates the registrar delegation is incomplete.
Green coverage reflects verified regional routing; it is not a traffic heatmap. It does not show live visitor counts or promise that every resolver in a shaded area will return the same answer. Resolver location, EDNS Client Subnet and cached answers affect what clients receive.
The view refreshes periodically, with more frequent updates while a change is running. Use Refresh to reload the current state. Read any warning or failed-job message before making further changes.
Inspect the complete zone
At the bottom of the global routing card, expand Current zone · … record sets. This shows the current records, their names, types, TTLs and values. A record set groups values with the same name and type, so its count is not necessarily the number of individual addresses or text values.
Edit zone sits beside this expander. It opens the zone editor, including custom records and records marked Service managed. On a narrow screen, records are shown with their field labels to keep the editor usable on mobile.
Add, edit or delete a record set
- Select the correct domain, then choose Edit zone.
- Choose Add record, or Edit beside a custom record set.
- Enter the name, record type, TTL in seconds, and values, one per line. When editing, the existing name and type are fixed; add a new record set if either must change.
- Choose Validate and save. Resolve any validation error before retrying.
- Review the updated record list. To remove a custom set, open it, choose Delete this record set, then confirm the deletion. This removes all values in that set.
Use @ for the zone apex, a relative name such as www or _dmarc, or a fully qualified name ending in a dot, such as www.example.com.. A name without a final dot is treated as relative to the selected zone.
| Type | Example value | Format |
|---|---|---|
| A | 192.0.2.10 | One IPv4 address per line. This is a documentation example; use your actual address. |
| AAAA | 2001:db8::10 | One IPv6 address per line. Replace this example with your actual address. |
| CNAME | target.example.net. | One fully qualified target. Cannot be used at the zone apex or coexist with other data at the same name. |
| MX | 10 mail.example.com. | Priority followed by the mail server hostname. |
| TXT | "verification=value" | Quote text using DNS zone-file syntax. |
| SRV | 10 5 443 service.example.com. | Priority, weight, port and target hostname. |
The record type field accepts supported IANA types beyond the suggestions, including types such as CAA, HTTPS, SVCB and TLSA. Generic types can use TYPE followed by the type number with RFC 3597 data. Protocol operations and service-managed types cannot be entered as custom records.
Validation and concurrent changes
Validation checks that names stay inside the selected zone, values match their DNS type, TTLs are whole seconds, and record combinations are allowed. TTLs may range from 0 to 2147483647 seconds. Each editable set accepts 1–100 values; CNAME and DNAME require a single target.
Validation catches malformed records, but it cannot confirm that a mail server, verification token or application target is the one you intended. Check the destination service’s instructions as well as the record syntax.
If someone changes the same record set while you are editing, the service rejects the stale update rather than overwriting it. Refresh the zone, reopen the record and review the latest values before saving again. DNS resolvers may continue returning an earlier value until its previous TTL expires.
Custom records and managed routing
SOA, apex nameservers, signing records and generated routing policies are maintained by the service and cannot be edited as ordinary custom records. The editor displays these as Service managed. Displaying signing-related record types does not mean the current service enables DNSSEC signing.
To change where a managed origin routes, update its origins, nodes or Load-balancer groups under Infrastructure, then return to DNS to generate and review the appropriate routing plan. Do not try to replace managed routing with a competing address record in the zone editor.
Automatic health reconciliation updates only routing records owned by the platform. Other custom records remain outside that process. A routing preview explicitly lists existing address records it proposes replacing at matched origin names; review that list before publishing.
If a managed record is changed outside the console, or an origin is removed, automatic routing updates pause for review. A warning also appears when no healthy verified endpoint remains; the last published route is retained. Restore health or review the configuration, then refresh and generate a new routing preview as needed.
For delegation, node groups and failover behaviour, see DNS Delegation & Global Routing. For the platform’s health signals, see Metrics & Health.