Skip to main content

Manage private DNS settings in a network

You can manage private DNS settings in a Cloud Platform private network:

You can manage private DNS settings in a Cloud Platform private network via the Control panel, Terraform, or the Private DNS API. You can enable a recursor for resolving public domains only via Terraform or the Private DNS API.

Add a network to a DNS zone

When you add a network to a DNS zone, A or AAAA records in this zone are automatically created for network ports. If new ports are added to the network or existing ones are changed, A or AAAA records for them will also be added or changed automatically. Such automatically managed records are marked with the Auto tag.

If you change the port domain name manually, the record in the zone will update automatically.

The fully qualified domain name (FQDN) of a port in a record is generated as <server_hostname>.<zone_domain_name>., where <server_hostname> is the server hostname and <zone_domain_name> is the zone domain name.

  1. In the Control panel, in the top menu, click Products and select Cloud Servers.
  2. Go to Private DNS.
  3. Open the tab DNS resolvers.
  4. In the network row, click .
  5. Under the DNS Zone field, select the Add to zone....
  6. Select a zone or click New zone to create a new zone.
  7. If you clicked New zone in step 6, enter the zone domain or leave the default domain. The domain can contain digits, Latin letters, and hyphens. The domain cannot be top-level, for example, example.
  8. Click Save.

Remove a network from a DNS zone

If you remove a network from a DNS zone, the A and AAAA records of this network's ports with the Auto tag will be deleted from the zone. You can add the network to the DNS zone again to recreate the records.

  1. In the Control panel, in the top menu, click Products and select Cloud Servers.
  2. Go to Private DNS.
  3. Open the tab DNS resolvers.
  4. In the network row, click .
  5. Under the DNS Zone field, select the Remove from zone....
  6. Enter the network name to confirm deletion.
  7. Click Save.

Connect a network to a DNS resolver

If the network is connected to a DNS resolver, servers in this network can resolve domain names of all private DNS zones within their pool and project.

  1. In the Control panel, in the top menu, click Products and select Cloud Servers.

  2. Go to Private DNS.

  3. Open the tab DNS resolvers.

  4. In the network row, click .

  5. Under the DNS Resolver field, select the Connect to DNS resolver....

  6. Click Save.

  7. Specify the resolver IP addresses in the subnet settings of this network. Use the subsection Change DNS servers on a private subnet of the instructions Private networks and subnets.

    You can view the IP addresses of the DNS resolver in the network in the Control panel: in the top menu, click Products → Cloud Servers → Private DNS → DNS resolvers tab → network row → DNS resolver.

  8. Optional: to allow devices in the network to resolve public domains, enable a recursor on the DNS resolver.

Disconnect a network from a DNS resolver

If you disconnect the network from the DNS resolver, servers in this network will stop resolving domain names of private DNS zones.

  1. In the Control panel, in the top menu, click Products and select Cloud Servers.

  2. Go to Private DNS.

  3. Open the tab DNS resolvers.

  4. In the network row, click .

  5. Under the DNS Resolver field, select the Disconnect from DNS resolver....

  6. Enter the network name to confirm disconnection.

  7. Click Save.

  8. Remove the resolver IP addresses from the subnet settings of this network. Use the subsection Change DNS servers on a private subnet of the instructions Private networks and subnets.

    You can view the IP addresses of the DNS resolver in the network in the Control panel: in the top menu, click Products → Cloud Servers → Private DNS → DNS resolvers tab → network row → DNS resolver.

Enable a recursor on a DNS resolver

A recursor is a DNS resolver feature for recursive domain lookups that allows devices in a private network to resolve public domains. By default, the recursor feature is disabled.

For the recursor to work, the subnet where the device is located must have internet access.

To enable the recursor:

  1. Make sure that the network is connected to a DNS resolver: in the Control panel, in the top menu, click Products → Cloud Servers → Private DNS → DNS resolvers tab → in the network row, in the DNS resolver field, check the connection information.

  2. Make sure that the private subnet whose devices need public domain resolution configured has internet access:

  3. If internet access for the subnet is configured via a cloud server, check the security groups on the server's internet port:

    3.1. View the list of security groups on the server's internet port.

    3.2. Make sure that the rules do not block outgoing and incoming UDP traffic on port 53.

  4. Enable the recursor via Terraform or using the Update service method in the Private DNS API.