Manage private DNS settings in a network

You can manage private DNS settings in a private network in the Cloud platform:

add a network to a DNS zone to have A and AAAA DNS records updated automatically, and remove a network from a DNS zone;
connect a network to a DNS resolver so that devices in the network can resolve domain names from private DNS zones, and disconnect from the DNS resolver;
enable a recursor on the DNS resolver so that devices in the network can resolve public domains.

You can manage private DNS settings in a private network in the Cloud platform through the Control panel, Terraform, or Private DNS API. You can enable a recursor for public domain resolution only via Terraform or Private DNS API.

Add a network to a DNS zone

When you add a network to a DNS zone, A or AAAA records are automatically created for the network ports in that zone. If new ports are added to the network or existing ones are changed, A or AAAA records for them will also be added or updated automatically. Such automatically managed records are marked with the Auto tag.

If you change a port's domain name manually, the record in the zone will update automatically.

The fully qualified domain name (FQDN) of a port in a record is formed as <server_hostname>.<zone_domain_name>., where <server_hostname> is the server hostname and <zone_domain_name> is the zone domain name.

In the Control panel, from the top menu, click Products and select Cloud Servers.
Go to the Private DNS section.
Open the DNS Resolvers tab.
In the network row, click .
Below the DNS zone field, select the Add to zone checkbox....
Select a zone or click New zone to create a new one.
If you clicked New zone in step 6, enter the zone domain or leave the default one. The domain can contain digits, Latin letters, and hyphens. The domain cannot be a top-level domain, for example, example.
Click Save.

Remove a network from a DNS zone

If you remove a network from a DNS zone, A and AAAA records for ports in that network with the Auto tag will be removed from the zone. You can add the network to the DNS zone again to recreate the records.

In the Control panel, from the top menu, click Products and select Cloud Servers.
Go to the Private DNS section.
Open the DNS Resolvers tab.
In the network row, click .
Below the DNS zone field, select the Remove from zone checkbox....
Enter the network name to confirm the deletion.
Click Save.

Connect a network to a DNS resolver

If a network is connected to a DNS resolver, servers in this network can resolve domain names of all private DNS zones within their pool and project.

In the Control panel, from the top menu, click Products and select Cloud Servers.
Go to the Private DNS section.
Open the DNS Resolvers tab.
In the network row, click .
Below the DNS resolver field, select the Connect to DNS resolver checkbox....
Click Save.
Specify the resolver IP addresses in the subnet settings of this network. Use the Change DNS servers on a private subnet subsection of the Private networks and subnets guide.

You can view the DNS resolver IP addresses for a network in the Control panel: from the top menu, click Products → Cloud Servers → Private DNS → DNS Resolvers tab → network row → DNS resolver field.
Optional: to allow devices in the network to resolve public domains, enable a recursor on the DNS resolver.

Disconnect a network from a DNS resolver

If you disconnect a network from a DNS resolver, servers in this network will stop resolving domain names for private DNS zones.

In the Control panel, from the top menu, click Products and select Cloud Servers.
Go to the Private DNS section.
Open the DNS Resolvers tab.
In the network row, click .
Below the DNS resolver field, select the Disconnect from DNS resolver checkbox....
Enter the network name to confirm the disconnection.
Click Save.
Remove the resolver IP addresses from the subnet settings of this network. Use the Change DNS servers on a private subnet subsection of the Private networks and subnets guide.

You can view the DNS resolver IP addresses for a network in the Control panel: from the top menu, click Products → Cloud Servers → Private DNS → DNS Resolvers tab → network row → DNS resolver field.

Enable a recursor on a DNS resolver

A recursor is a DNS resolver function for recursive domain lookups; it allows devices in a private network to resolve public domains. The recursor function is disabled by default.

For the recursor to work, the subnet where the device is located must have internet access.

To enable a recursor:

Ensure that the network is connected to a DNS resolver: in the Control panel, from the top menu, click Products → Cloud Servers → Private DNS → DNS Resolvers tab → in the network row, view the connection information in the DNS resolver field.
Ensure that the private subnet for whose devices you want to configure public domain resolution has internet access:
- via a cloud router — the subnet is connected to a cloud router with internet access;
- or via one of the devices in the subnet — the device has internet access configured and a static route to the internet configured in the subnet through this device.
If internet access for the subnet is configured through a cloud server, check the security groups on the server's internet port:

3.1. View the list of security groups on the server's internet port.

3.2. Ensure that the rules do not block outgoing and incoming UDP traffic on port 53.
Enable the recursor via Terraform or by using the Update service method in the Private DNS API.