Authoritative DNS

Live

ns1/ns2.vappcdn.com

Your own nameservers, with DNSSEC signing on every zone.

Every zone and record is auditable, with a full history of what changed and when.
DNSSEC with online signing, on by default for every zone.
Two nodes, both authoritative. Either one can carry the whole load.
REST API for zone and record CRUD — scriptable from day one.

Try it nowlive

elapsed

—

records

—

dnssec

—

The lookup goes through a public recursive resolver, not our own machines. Asking ours would answer for any zone we hold, which proves nothing.

Usage guide

1 · Point your domain at our nameservers

Change the nameservers at your registrar. Both nodes are authoritative — lose one and the other answers everything.

dnsns1.vappcdn.com
ns2.vappcdn.com

2 · Create the zone and its records

Add the zone in the dashboard, or call the API if you would rather script it. Ownership is verified before a zone goes live.

textDashboard → Zones → Add zone
  example.com

Ownership is confirmed either by the delegation
itself, or by a TXT record we give you:

  _vappcdn-challenge.example.com  TXT  "vappcdn-verify=<token>"

3 · Verify it

Ask a public resolver, not our own machines — that is the answer your users actually get.

bashdig NS example.com @1.1.1.1 +short
dig example.com @1.1.1.1 +dnssec +short

# DNSSEC chain, validated end to end
dig example.com @1.1.1.1 +dnssec | grep -E 'flags:.* ad'

Supported records

DNSSEC is on by default for every zone, signed online. Every change keeps an auditable history.

name	accepts	notes
A / AAAA	address	IPv4 and IPv6, fully dual-stack.
CNAME	alias	An alias pointing at another name.
MX	mail	Mail routing, with priority.
TXT	text	SPF, DKIM, DMARC and ownership verification.
SRV	service	Service discovery by port and protocol.
CAA	policy	Restricts which CAs may issue for your domain.
NS	delegation	Delegating a subzone.
DS	dnssec	Links the DNSSEC chain of trust to the parent.

Try it Other services