--- title: "DNS and certificates: zones that follow your resources · Frazer" description: "Public DNS zones on Frazer's own name servers and two anycast providers. Records that follow your gateways and load balancers, DNSSEC with one switch, certificates through DNS, and every change a plan you can restore." url: https://frazer.ai/network/dns index: https://frazer.ai/llms.txt tokens: 3039 --- > For agents: every page on frazer.ai is indexed at https://frazer.ai/llms.txt. # DNS and certificates: zones that follow your resources · Frazer **DNS and certificates** frazer.ai # DNS that follows your resources. Certificates included. Every change a plan. Host your zones on Frazer's own name servers and two anycast providers. A record can point at a gateway or load balancer and follow its addresses, and certificates for your hostnames issue and renew through DNS. Every change is a plan with a diff, applied as one revision you can restore. [Create a zone](https://frazer.ai/start?product=dns) [Read the docs](https://frazer.ai/docs) *The Records tab of the zone acme.example in the Frazer console, demo organization Acme: 10 of its 42 record sets. 4 address records point at a gateway or a load balancer and show the addresses they answer with now; 4 records written by a gateway, the certificate manager and a child zone are locked to those controllers; 1 record still points at a deleted load balancer, answers empty and is raised as a finding.* A zone's records: names that point at a gateway answer with its current addresses product UI, demo organization 01 · How a change is served Fig. 1 ## From a plan to every name server. Serving means every address answers. A change runs as a plan first, commits as one serial and is signed once by a hidden signer. Frazer's own name servers and two anycast providers serve the same signed zone, and the change counts as serving only when probes from three places see it on every address. **Fig. 1** The path of one change, and the freshness it is designed for 02 · Records and changes Fig. 2 ## Records that follow your resources. Changes you check before they ship. A record can name a Frazer address, load balancer, gateway or endpoint instead of an IP. It answers with the resource's current addresses, works at the zone apex, and empties with a finding when the resource is deleted, so no record is left pointing at an address you no longer hold. - **Atomic.** A change applies completely or not at all, as one serial and one revision. - **Preconditions.** An etag on the zone and on each record set, so you never overwrite an edit you have not seen. - **Dry run.** `validate_only` returns the diff, lint findings, quota impact and any approval needed. - **Owned records.** What a gateway, the DNS controller or the certificate manager wrote refuses a person's edit unless forced. - **Restore.** Any revision comes back as a new change. ``` # Prove the domain once for the organization frazer dns verified-domains create acme.example --organization acme --hold domain-and-subdomains # A signed zone, shown as a plan first frazer dns managed-zones create apps --dns-name apps.acme.example. --dnssec \ --project acme-production --dry-run frazer dns managed-zones check-delegation apps # A record that follows the addresses of a resource frazer dns record-sets create @~A --zone apps \ --target projects/acme-production/locations/us-virginia1/addresses/web-ip frazer dns record-sets create www~A --zone apps --rrdatas 203.0.113.10 --ttl 300 # Wait until every name server answers the change frazer dns changes get 42 --zone apps --wait ``` ``` resource "frazer_dns_managed_zone" "apps" { project = "acme-production" name = "apps" dns_name = "apps.acme.example." dnssec { state = "ON" } } resource "frazer_dns_record_set" "www" { managed_zone = frazer_dns_managed_zone.apps.id name = "www" type = "A" ttl_seconds = 300 rrdatas = ["203.0.113.10"] } ``` *A pending change to the zone acme.example in the Frazer console, demo organization Acme: 3 edits, validated as a dry run, that apply as one serial and one revision and count as serving only when all 8 name-server addresses answer it. Revision 319, made by someone else 40 s ago, changed the same TXT record, so that edit no longer matches its etag while the other 2 still apply; the checks find no CNAME, NS or DS conflict, warn that SPF uses 9 of 10 lookups, and show the quota change.* **Fig. 2** A pending change that met a newer revision: one edit no longer matches its etag product UI, demo organization 03 · Certificates ## A certificate for every hostname. Wherever your DNS lives. Frazer issues and renews certificates over DNS-01. How the challenge record gets written depends on where your domain is answered. Three ways to keep your domain, and how certificates are issued for each | Your domain | Records | Certificates | | --- | --- | --- | | **Delegate a subdomain to Frazer** apps.acme.example NS … | Frazer keeps the records for your gateways and routes, bound to the resources they name. | DNS-01 inside the zone, through the certificate manager’s webhook. Its role can write only `_acme-challenge` TXT records. | | **Keep your DNS provider** DNS controller + certificate manager | The cluster’s DNS controller writes them at your provider with your token, kept in your project's secrets and limited to one zone. | DNS-01 at your provider. | | **Manage records yourself** the console shows each record | The console shows the exact A, AAAA or CNAME records to add wherever your zone lives. | One `_acme-challenge` CNAME into Frazer's challenge zone, once. No provider token. | - Every gateway also gets a default hostname under `frazer.run`, a domain kept apart from `frazer.ai`, with a wildcard certificate. - If the first certificate authority is down, issuance falls back to a second one. - A failed renewal or a certificate close to expiry emails the project's admins. 04 · DNSSEC ## DNSSEC with one switch. Keys never touch a public server. Switch One per zone, at no extra charge. The plan shows the DS record to publish. Keys Algorithm 13 (ECDSA P-256) only, a KSK and a ZSK. Keys live on a hidden signer, never on a public name server. Denial of existence NSEC3 with no extra iterations and no salt, with real NXDOMAIN answers. Plain NSEC on request. Key rolls The ZSK rolls every 30 days. The KSK rolls by itself where the parent reads CDS; elsewhere a guided roll waits until the new DS is seen. DS at the parent CDS and CDNSKEY on every zone, the same on every server, plus RFC 9615 signals for a new signed zone. Kept in sync when the parent zone is on Frazer too. Signatures Valid 14 days, refreshed 7 days ahead. A name server cut off from updates stops answering at 6 days, before any signature it holds expires. Validation Every zone is checked on every name-server address, and the console shows the result per server. Turning it off Guarded: the DS comes off the parent first, then the zone is unsigned. It needs a plan and an approval. 05 · What you get ## Everything a zone needs. Nothing to bolt on. - ### Verified domains Prove a domain once with a TXT record. A hold stops other organizations creating zones under it. - ### Import and export BIND or YAML in, as one change with a dry run. Export any zone at any time. - ### Restore and undelete Return a zone to any revision. A deleted zone comes back within 30 days. - ### Query analytics Queries by name, type, response code and site, free in the console. Query logs are opt-in. - ### Automatic private names `.internal` names for VMs, databases, endpoints and load balancers in your networks. - ### Kubernetes add-ons The DNS controller and certificate manager webhooks, with workload identity and no stored token. - ### Failover answers Health-checked failover and answers that list only healthy addresses. - ### Private zones and geo routing Private, forwarding and peering zones; weighted and geolocation answers. 06 · Controls ## Who may change what. With the defaults written down. ### Who may do what roles/dns.viewer Reads every zone, record and change, analytics included. Agents get this role and may run dry runs. roles/dns.recordEditor Edits record sets in the zones it is granted on, optionally only some names and types. No zone create or delete, no DNSSEC. roles/dns.admin Everything in DNS except verified domains. roles/dns.acmeSolver Only `_acme-challenge` TXT records, for the certificate manager. A leaked token can only answer challenges. roles/dns.domainOwner Verified domains, at the organization. ### What is logged - Every write, with its plan diff and who made it. - Every change as a revision: who, when, and when every name server served it. - Agent writes go through an approval; production projects follow the four-eyes rule. - Findings for lame delegations, DS mismatches, records left pointing at a deleted resource and CNAMEs to unclaimed outside names. ### At the cap - **1,000** zones per project and **10,000** record sets per zone by default. - One change holds up to 1,000 additions and 1,000 deletions, 1 MiB in all. - 600 writes a minute and 100 new zones a day per project. - A request over a quota is refused with `QUOTA_EXCEEDED`. Quotas are never zero. - Public queries have no quota. Attack traffic is dropped and never billed. 07 · Pricing ## Part of the server fee. DNSSEC never costs extra. DNS and certificates come with the servers you pay for, within an allowance pooled across your account. DNSSEC, verified domains and query analytics are included on every zone, and queries dropped as an attack are never billed. [See every price](https://frazer.ai/pricing#lines) Your servers **Included**: 25 zones and 25 million queries a month per server, pooled Above the allowance $0.10 per zone / month ($0.02 above 10,000) · $0.20 per million queries ($0.10 above a billion a month) · routing policies $0.40 per million Always included DNSSEC, CDS automation, verified domains, query analytics and certificates Attack queries Dropped and **never billed** Query logs Opt-in · billed as logs Health checks Count as uptime checks: 20 per server included, then $1 per check a month Questions ## DNS and certificates, answered. How do I move a zone from my current provider? Lower the TTLs at your current provider one TTL period ahead, then import the BIND zone file or YAML as one change with a dry run. Check the plan, run the delegation check and change the name servers at your registrar. The zone turns active when the parent points at Frazer. What happens to my zones if Frazer's API is down? They keep answering. The name servers serve copies of the zone and never call the control plane, so only changes wait. If the signer itself is lost, the name servers keep serving signed answers for about six days while it is restored. Can someone else claim my domain on Frazer? No. If your domain already points at Frazer name servers but no zone exists for it, a new zone stays pending verification and answers nothing until ownership is proved. A verified domain can also carry a hold, so no other organization can create zones for it or its subdomains. Do I have to move my DNS to Frazer to get certificates? No. Keep your provider and let the cluster’s DNS controller and certificate manager work there with a token limited to one zone, or add one `_acme-challenge` CNAME into Frazer's challenge zone and keep managing your records yourself. Does DNSSEC cost extra? No. It is one switch on any zone. The plan shows the DS record; where the parent reads CDS records it is published for you, and elsewhere the console shows the exact record to paste at your registrar. Which record types can I use? A, AAAA, CNAME, MX, TXT, SRV, CAA, PTR, NS for delegations, HTTPS, SVCB, DS, TLSA, SSHFP and NAPTR, with wildcards and flattening at the apex. Frazer manages the SOA and apex NS records; you can change the SOA timers. ## More in Network - [**VPC and firewall** Subnets, rules, NAT](https://frazer.ai/network) - [**Load balancers** L4 and L7, TLS included](https://frazer.ai/network/gateways) - [**Frazer Access and VPN** Private access for people, devices and agents](https://frazer.ai/network/access) ## Point a domain at Frazer. Records follow. Certificates renew. [Create a zone](https://frazer.ai/start?product=dns) [Read the docs](https://frazer.ai/docs)