DNS records

A domain on the ITSH nameservers has a zone you edit in the DNS Records section of the domain page. Everything here assumes that; a domain pointed at nameservers of your own is edited wherever those live.

An empty list on a new domain is correct

A freshly registered domain starts with no records at all. No DNS records available is the expected first screen, not a provisioning failure. The domain resolves nowhere until you add something.

Record types

26 types are accepted. NS and SOA are managed for you and are not in the type list, so 24 are yours to write. They still appear in the record table, marked This record is managed by the provider.

Group	Types
Common	A, AAAA, CNAME, TXT, ALIAS, PTR
Mail	MX, RP
Security	CAA, TLSA, SSHFP, SMIMEA, OPENPGPKEY, CERT
Advanced	SRV, URI, HTTPS, SVCB, NAPTR, AFSDB, HINFO, IPSECKEY, LOC, URL

Use ALIAS where you want CNAME-like behaviour at the apex, which a CNAME cannot legally give you. ANAME is not a synonym here; it is not accepted.

Name, value, TTL and priority

Name is the label relative to the zone. The placeholder says @ or subdomain, and an empty field means the same as @. Typing the full name also works: www.example.com in the zone example.com is stored as www rather than becoming www.example.com.example.com.

Content is required. For MX and CNAME a value with no dot in it is completed to a fully qualified name with a trailing dot before it is saved.

TTL is a dropdown with six values and no free-text entry:

Option	Seconds
5 minutes	300
15 minutes	900
30 minutes	1800
1 hour	3600 (default)
4 hours	14400
24 hours	86400

A record that arrived by import can carry some other TTL. It is kept and shown as it is, and editing the record leaves it alone unless you open the dropdown, at which point your only choices are the six above.

Lower the TTL before you change something, not after

A resolver holding the old answer keeps serving it for the remaining TTL, and lowering the TTL at the moment you make the change does nothing about the copies already cached. Drop it to 300 a day ahead, make the change, then put it back.

Priority is a separate field on MX, SRV, URI, HTTPS, SVCB and NAPTR, defaulting to 10. SRV and URI also take a Weight, and SRV a Port. Those two are packed into the value when the record is saved, so an SRV row reading 10 5060 sip.example.com. is weight, port and target, with the priority held separately.

A record identical to one that already exists is refused:

A DNS record with this name, type, and content already exists.

Templates

Templates stages a set of records for you to review before anything is written. Five are built in: a basic website, Google Workspace, Microsoft 365, a self-hosted mail server, and a set of subdomain aliases. Applying one adds to the zone rather than replacing it, so check for conflicts with what is already there.

A template you save yourself lives in that browser

Custom templates are stored in the browser you created them in. They do not follow you to another machine, another browser or a private window, and clearing site data removes them. The five built-in ones are always present.

Import and export

Export downloads the current zone as a .zone file. Import takes one back, which is the fastest way to rebuild a zone after transferring a domain in: export at the old provider, import here.

Both work on the whole zone. Export before a bulk change, so a mistake is one import away from being undone.

Bulk actions

Bulk opens a grid for creating many records at once. Selecting rows in the table instead gives you bulk delete and a bulk TTL change.

Partial success is reported as such, for example 8 records deleted, 2 failed. Read the count rather than assuming the whole batch went through.

DynDNS

A DynDNS token lets a router or a script keep an A or AAAA record pointed at a changing address. Create one under DynDNS on the domain: pick the hostname and whether it maintains IPv4 only, IPv6 only or IPv4 + IPv6. The portal then generates a ready-made configuration for Fritz!Box, ddclient, curl, OpenWrt and Synology.

Limit	Value
Tokens per domain	25
TTL on a DynDNS record	300 seconds, fixed

The token is shown once:

Save this token now - it will not be shown again!

Rotating a token invalidates the old one immediately.

DynDNS records are protected from you

A record a token maintains is hidden from the record list, and any attempt to create, edit or delete it by hand is refused with This record is managed by DynDNS and cannot be modified manually. A hostname missing from the list but resolving is not a bug: it has a token on it. Manage it under DynDNS.

Creating a token on a hostname that already has records is refused rather than silently taking them over. A wildcard hostname is allowed, with the consequence you would expect:

Wildcard entries (*.domain.tld) will override all subdomains without explicit
DNS records.

Kubernetes Auto-DNS

A domain verified for a Kubernetes namespace can have Auto-DNS switched on, after which the records for your HTTPRoutes are created and kept up to date from the routes themselves. Where the switch is and what it means for routing is on Gateway API.

Two things about it belong here, because they are about this editor.

Auto-DNS records are not protected from you

Unlike DynDNS, records written by Auto-DNS look exactly like records you made. They are listed, they are editable, and nothing stops you deleting one. The next sync recreates it or overwrites your edit, so a hand-edit of an Auto-DNS record is silently reverted rather than refused. Change the HTTPRoute instead, or turn Auto-DNS off for that domain and take the zone over yourself.

Auto-DNS only ever writes A, AAAA and TXT, with a TTL of 300 seconds. Your MX, CAA and everything else are left alone, so switching it on will not disturb mail. It also steps around DynDNS: a hostname with a token on it is skipped rather than fought over.

Using your own nameservers

Nameservers on the domain has one toggle, Use external nameservers. Off means the ITSH nameservers and the editor above. On means you list your own, at least 2 and at most 4.

Switching is confirmed first, and the dialog is worth reading:

Changing nameservers can take up to 48 hours for changes to propagate worldwide.
When switching to external nameservers, DNS records in this panel will no longer
be used.

Once external nameservers are in use:

• The record editor is disabled, with External nameservers active and DNS records cannot be edited because external nameservers are being used. Manage the DNS records with your external nameserver provider.
• DynDNS disappears from the domain, because there is no zone here for a token to write into.
• Kubernetes Auto-DNS has nothing to write into either, so it stops maintaining anything even where the domain is still verified.

The records already in the zone here are not deleted. Switch back and they are live again, subject to the same propagation delay.

What's next

• Gateway API for pointing a domain at a Kubernetes workload
• Troubleshooting if a change is not taking effect