Skip to content
TebibHost Docs

DNS zones

A DNS zone holds the records for one domain you own, such as example.co.ke: where www points, which servers take your mail, what your SPF and DKIM say. TebibHost’s nameservers, ns1.tebibhost.com and ns2.tebibhost.com, answer for it on the internet.

A zone is billed by the hour while our nameservers serve it. A zone waiting for verification is free, and DNS queries are free.

Create a zone

Section titled “Create a zone”

Networking → DNS zones, type the domain and Add zone.

The zone starts as pending verification: nothing is served yet.

Prove the domain

Section titled “Prove the domain”

We only serve a zone once you show the domain is yours. Do one of these.

Delegate the domain to us. At your registrar, set the domain’s nameservers to ns1.tebibhost.com and ns2.tebibhost.com. Add your records first (or import a zone file, below), so nothing goes missing when the change takes effect.

Or add a TXT record where the domain is hosted now. The zone page (and tebib dns zone show) gives a name and a value, for example:

_tebib-verify.example.co.ke.  TXT  "tebib-verify=3f9c..."

This proves the domain before you move it. Once the zone is active, change the nameservers at your registrar, and remove the TXT record when you like.

We check by ourselves: every minute at first, then every few minutes, then twice an hour. Check now on the zone page (or the command below) checks at once:

Terminal window
tebib dns zone verify <ZONE ID> --wait

If the domain pointed at TebibHost before under another account, only the TXT record counts: a leftover delegation proves nothing about who owns the domain now. If another account serves the domain and you control it, the TXT record moves it to you.

Records

Section titled “Records”

A record set is every value of one type at one name, with one TTL: for example www, type A, values 192.0.2.10 and 192.0.2.11. Names are relative to the zone; @ is the domain itself.

Type Value, one per record Notes
A 192.0.2.10 An IPv4 address.
AAAA 2001:db8::10 An IPv6 address.
CNAME app.example.net Exactly one. Not at @, and nothing else at the same name.
MX 10 mail.example.co.ke Priority, then the mail server.
TXT v=spf1 include:_spf.example.net -all Quotes are added for you; long values are split.
SRV 10 5 5060 sip.example.co.ke Priority, weight, port, target. The name is _service._protocol.
CAA 0 issue "letsencrypt.org" Which certificate authorities may issue for the domain.
NS ns1.other-provider.net Delegates a name below the zone (not @).

Targets are full names; the final dot is optional, and a single word means a name in the zone (mail is mail.example.co.ke). TTLs are 60 seconds to one day (default one hour). The zone’s SOA and its own NS records are ours.

Open the zone, fill in Add a record set (name, type, TTL, one value per line). Edit and Delete are on each row.

Changes reach the nameservers within seconds. Resolvers may keep an old answer for up to its TTL: lower the TTL a day before a planned change.

Point a name at a VM

Section titled “Point a name at a VM”

Point a name at a VM on the zone page (or tebib dns record vm) sets A and AAAA records to the VM’s public IPv4 and public IPv6 addresses as they are now:

Terminal window
tebib dns record vm -z <ZONE ID> --vm <VM ID> -n www

It is a copy: if you move the public IP to another VM, change the record too.

Move from another provider

Section titled “Move from another provider”

Export the zone file from your current DNS provider, then import it:

Terminal window
tebib dns zone import <ZONE ID> example.co.ke.zone

The file’s SOA and its @ NS records are skipped (we serve our own), as are record types we don’t host; the result lists what was skipped. By default existing record sets the file doesn’t have are kept; --replace deletes them. tebib dns zone export <ZONE ID> writes the zone back out as a zone file.

Delete a zone

Section titled “Delete a zone”

Deleting a zone stops our nameservers answering for the domain and deletes its record sets. Move the domain to other nameservers first if it is in use.

Limits

Section titled “Limits”
  • 10 zones per project and 500 record sets per zone by default; your account’s tier sets the total across projects.
  • Both nameservers are in one data centre for now. A second site comes with the Nairobi region.
  • Not yet: DNSSEC, reverse DNS (PTR) for public IPs, zone transfers to other providers.

Permissions: dns:* actions, see IAM policies. Project members can change records but not create or delete zones.