DNS that follows your resources.
Certificates included. Every change a plan.
Host your zones on Frazer's own name servers and two anycast providers. A record can point at a gateway or load balancer and follow its addresses, and certificates for your hostnames issue and renew through DNS. Every change is a plan with a diff, applied as one revision you can restore.
From a plan to every name server.
Serving means every address answers.
A change runs as a plan first, commits as one serial and is signed once by a hidden signer. Frazer's own name servers and two anycast providers serve the same signed zone, and the change counts as serving only when probes from three places see it on every address.
Records that follow your resources.
Changes you check before they ship.
A record can name a Frazer address, load balancer, gateway or endpoint instead of an IP. It answers with the resource's current addresses, works at the zone apex, and empties with a finding when the resource is deleted, so no record is left pointing at an address you no longer hold.
- Atomic. A change applies completely or not at all, as one serial and one revision.
- Preconditions. An etag on the zone and on each record set, so you never overwrite an edit you have not seen.
- Dry run.
validate_onlyreturns the diff, lint findings, quota impact and any approval needed. - Owned records. What a gateway, the DNS controller or the certificate manager wrote refuses a person's edit unless forced.
- Restore. Any revision comes back as a new change.
# Prove the domain once for the organization
frazer dns verified-domains create acme.example --organization acme --hold domain-and-subdomains
# A signed zone, shown as a plan first
frazer dns managed-zones create apps --dns-name apps.acme.example. --dnssec \
--project acme-production --dry-run
frazer dns managed-zones check-delegation apps
# A record that follows the addresses of a resource
frazer dns record-sets create @~A --zone apps \
--target projects/acme-production/locations/us-virginia1/addresses/web-ip
frazer dns record-sets create www~A --zone apps --rrdatas 203.0.113.10 --ttl 300
# Wait until every name server answers the change
frazer dns changes get 42 --zone apps --waitresource "frazer_dns_managed_zone" "apps" {
project = "acme-production"
name = "apps"
dns_name = "apps.acme.example."
dnssec { state = "ON" }
}
resource "frazer_dns_record_set" "www" {
managed_zone = frazer_dns_managed_zone.apps.id
name = "www"
type = "A"
ttl_seconds = 300
rrdatas = ["203.0.113.10"]
}A certificate for every hostname.
Wherever your DNS lives.
Frazer issues and renews certificates over DNS-01. How the challenge record gets written depends on where your domain is answered.
| Your domain | Records | Certificates |
|---|---|---|
| Delegate a subdomain to Frazerapps.acme.example NS … | Frazer keeps the records for your gateways and routes, bound to the resources they name. | DNS-01 inside the zone, through the certificate manager’s webhook. Its role can write only _acme-challenge TXT records. |
| Keep your DNS providerDNS controller + certificate manager | The cluster’s DNS controller writes them at your provider with your token, kept in your project's secrets and limited to one zone. | DNS-01 at your provider. |
| Manage records yourselfthe console shows each record | The console shows the exact A, AAAA or CNAME records to add wherever your zone lives. | One _acme-challenge CNAME into Frazer's challenge zone, once. No provider token. |
- Every gateway also gets a default hostname under
frazer.run, a domain kept apart fromfrazer.ai, with a wildcard certificate. - If the first certificate authority is down, issuance falls back to a second one.
- A failed renewal or a certificate close to expiry emails the project's admins.
DNSSEC with one switch.
Keys never touch a public server.
- Switch
- One per zone, at no extra charge. The plan shows the DS record to publish.
- Keys
- Algorithm 13 (ECDSA P-256) only, a KSK and a ZSK. Keys live on a hidden signer, never on a public name server.
- Denial of existence
- NSEC3 with no extra iterations and no salt, with real NXDOMAIN answers. Plain NSEC on request.
- Key rolls
- The ZSK rolls every 30 days. The KSK rolls by itself where the parent reads CDS; elsewhere a guided roll waits until the new DS is seen.
- DS at the parent
- CDS and CDNSKEY on every zone, the same on every server, plus RFC 9615 signals for a new signed zone. Kept in sync when the parent zone is on Frazer too.
- Signatures
- Valid 14 days, refreshed 7 days ahead. A name server cut off from updates stops answering at 6 days, before any signature it holds expires.
- Validation
- Every zone is checked on every name-server address, and the console shows the result per server.
- Turning it off
- Guarded: the DS comes off the parent first, then the zone is unsigned. It needs a plan and an approval.
Everything a zone needs.
Nothing to bolt on.
Verified domains
Prove a domain once with a TXT record. A hold stops other organizations creating zones under it.
Import and export
BIND or YAML in, as one change with a dry run. Export any zone at any time.
Restore and undelete
Return a zone to any revision. A deleted zone comes back within 30 days.
Query analytics
Queries by name, type, response code and site, free in the console. Query logs are opt-in.
Automatic private names
.internalnames for VMs, databases, endpoints and load balancers in your networks.Kubernetes add-ons
The DNS controller and certificate manager webhooks, with workload identity and no stored token.
Failover answers
Health-checked failover and answers that list only healthy addresses.
Private zones and geo routing
Private, forwarding and peering zones; weighted and geolocation answers.
Who may change what.
With the defaults written down.
Who may do what
- roles/dns.viewer
- Reads every zone, record and change, analytics included. Agents get this role and may run dry runs.
- roles/dns.recordEditor
- Edits record sets in the zones it is granted on, optionally only some names and types. No zone create or delete, no DNSSEC.
- roles/dns.admin
- Everything in DNS except verified domains.
- roles/dns.acmeSolver
- Only
_acme-challengeTXT records, for the certificate manager. A leaked token can only answer challenges. - roles/dns.domainOwner
- Verified domains, at the organization.
What is logged
- Every write, with its plan diff and who made it.
- Every change as a revision: who, when, and when every name server served it.
- Agent writes go through an approval; production projects follow the four-eyes rule.
- Findings for lame delegations, DS mismatches, records left pointing at a deleted resource and CNAMEs to unclaimed outside names.
At the cap
- 1,000 zones per project and 10,000 record sets per zone by default.
- One change holds up to 1,000 additions and 1,000 deletions, 1 MiB in all.
- 600 writes a minute and 100 new zones a day per project.
- A request over a quota is refused with
QUOTA_EXCEEDED. Quotas are never zero. - Public queries have no quota. Attack traffic is dropped and never billed.
Part of the server fee.
DNSSEC never costs extra.
DNS and certificates come with the servers you pay for, within an allowance pooled across your account. DNSSEC, verified domains and query analytics are included on every zone, and queries dropped as an attack are never billed.
See every priceDNS and certificates, answered.
How do I move a zone from my current provider?
Lower the TTLs at your current provider one TTL period ahead, then import the BIND zone file or YAML as one change with a dry run. Check the plan, run the delegation check and change the name servers at your registrar. The zone turns active when the parent points at Frazer.
What happens to my zones if Frazer's API is down?
They keep answering. The name servers serve copies of the zone and never call the control plane, so only changes wait. If the signer itself is lost, the name servers keep serving signed answers for about six days while it is restored.
Can someone else claim my domain on Frazer?
No. If your domain already points at Frazer name servers but no zone exists for it, a new zone stays pending verification and answers nothing until ownership is proved. A verified domain can also carry a hold, so no other organization can create zones for it or its subdomains.
Do I have to move my DNS to Frazer to get certificates?
No. Keep your provider and let the cluster’s DNS controller and certificate manager work there with a token limited to one zone, or add one _acme-challenge CNAME into Frazer's challenge zone and keep managing your records yourself.
Does DNSSEC cost extra?
No. It is one switch on any zone. The plan shows the DS record; where the parent reads CDS records it is published for you, and elsewhere the console shows the exact record to paste at your registrar.
Which record types can I use?
A, AAAA, CNAME, MX, TXT, SRV, CAA, PTR, NS for delegations, HTTPS, SVCB, DS, TLSA, SSHFP and NAPTR, with wildcards and flattening at the apex. Frazer manages the SOA and apex NS records; you can change the SOA timers.