Skip to main content

General information about private DNS

Private DNS is a service for managing port domain names in private networks of the cloud platform. It allows you to address cloud servers and Managed Kubernetes cluster nodes in private networks using domain names, and also resolve public domains.

This service cannot be used as a public DNS service. If you need public DNS, use DNS hosting.

Private DNS can also be used for dedicated servers, more details can be found in the guide [Set up DNS in a dedicated server private network].

You can work with the service in the control panel, using the API, and Terraform.

The service supports user roles and permissions.

Records of private DNS operations are saved in audit logs.

Operating principle

Network resource records are stored in a private DNS zone. You create the zone and records manually. For records of type A and AAAA, you can enable automatic updates; to do this, you need to add the network to the zone. You can add multiple networks to one zone. If a network is added to a zone, A and AAAA records will be created and updated automatically when ports are created or modified in the network. In the Control Panel, such records are displayed with the Auto label.

To allow devices in a private network to resolve domain names from private DNS zones, you must connect the network to a DNS resolver. Networks connected to the DNS resolver have access to records of all private DNS zones within their pool and project. Connecting a network to the DNS resolver does not automatically provide access to servers in another private network via domain names — the networks must be connected at the L3 level, for example using a global router.

To allow devices in a private network to resolve public domains, you must connect the network to a DNS resolver and enable a recursor for it — a recursive search function. The subnet where the device is located must have internet access.

Each network in a pool is served by two DNS resolvers located in the same pool but on different hardware. When a network is connected to the DNS resolver, two service ports for the resolvers are created in it. If one of the DNS resolvers fails, the other will continue to handle requests. In a multi-zone pool, DNS resolvers are located in different availability zones: if a data center in one of the availability zones fails completely, the other will continue to operate.

The DNS service operates independently of the subnet DHCP settings — DNS resolver IP addresses are not configured on devices automatically, even if DHCP is enabled in the network. When connecting a network to the DNS resolver, you must manually specify the resolver IP addresses in the subnet settings.

Available private DNS record types

AMaps a domain name to an IPv4 network server IP address
AAAAMaps a domain name to an IPv6 network server IP address
MXPoints to a server for receiving incoming mail for a domain. If a domain has multiple mail servers, an MX record must be created for each server, specifying the priority for load balancing
TXTContains any text information that needs to be added to the domain settings. For example, it can store a DKIM key for outgoing email newsletters
CNAMEMaps an additional domain to a primary (canonical) domain so that both lead to the IP address of the primary domain. A CNAME record cannot be added for second-level domains. A domain with a CNAME record cannot have other resource records

Limits

Within a single pool in a project you can:

  • connect no more than 10 networks to a private DNS resolver;
  • create no more than 100 DNS zones.

The maximum number of DNS records in a zone is 1000.

The domain name resolution request processing speed is 5 000 RPS. Resolution time for a single request:

  • for private domains — no more than 1 ms;
  • for public domains — no more than 1 ms for cached domains.

Pricing

You can create DNS zones and records in them for free.

Connecting a network to a private DNS resolver is a paid service. You can view connection prices at servercore.com.