Private DNS service overview

Private DNS is a service for managing port domain names in Cloud Platform private networks. It allows you to access cloud servers and Managed Kubernetes cluster nodes in private networks by domain names, as well as resolve public domains.

The service cannot be used as a public DNS service. If you need public DNS, use DNS hosting.

Private DNS can also be used for dedicated servers; for details, see the guide Configure DNS in a dedicated server private network.

You can work with the service in the control panel, using the API, and Terraform.

The service supports user roles and types.

Records of operations with Private DNS are saved in audit logs.

How it works

Network resource records are stored in a private DNS zone. You create the zone and records manually. For records of types A and AAAA, you can enable automatic updates by adding the network to the zone. You can add multiple networks to one zone. If a network is added to a zone, A and AAAA records will be created and updated automatically when ports in the network are created or changed. In the control panel, such records are displayed with the Auto label.

To allow devices in a private network to resolve domain names from private DNS zones, you need to connect the network to the DNS resolver. Networks connected to the DNS resolver have access to the records of all private DNS zones within their pool and project. Connecting a network to the DNS resolver does not automatically grant access to servers in another private network by domain names: networks must be interconnected at L3, for example, via a global router.

For devices in a private network to resolve public domains, the network must be connected to the DNS resolver, and the recursor (recursive search function) must be enabled for it. The subnet where the device is located must have internet access.

Each network in a pool is served by two DNS resolvers located in the same pool, but on different hardware. When connecting a network to the DNS resolver, two resolver service ports are created in it. If one of the DNS resolvers fails, the other will continue to process requests. In a multi-zone pool, DNS resolvers are located in different availability zones: if a data center in one of the availability zones fails completely, the other will continue to operate.

The DNS service operates independently of subnet DHCP settings: DNS resolver IP addresses are not configured on devices automatically, even if DHCP is enabled on the network. When connecting a network to the DNS resolver, the resolver IP addresses must be manually specified in the subnet settings.

Available private DNS record types

A	Maps a domain name to a server IP address in an IPv4 network
AAAA	Maps a domain name to a server IP address in an IPv6 network
MX	Points to a server for receiving incoming mail for the domain. If the domain has multiple mail servers, an MX record must be created for each server specifying the priority for load balancing
TXT	Contains any text information to be added to the domain settings. For example, it can store a DKIM key for outgoing email mailings
CNAME	Aliases an additional domain to the primary (canonical) domain so that both point to the primary domain IP address. A CNAME record cannot be added for a second-level domain. A domain with a CNAME record cannot have other resource records

Limits

Within a single pool in a project, you can:

connect no more than 10 networks to the private DNS resolver;
create no more than 100 DNS zones.

The maximum number of DNS records in a zone is 1,000.

Domain name resolution request rate is 5,000 RPS. Resolution time for a single query:

for private domains — no more than 1 ms;
for public domains — no more than 1 ms for cached domains.

Pricing

You can create DNS zones and records in them for free.

Connecting a network to the private DNS resolver is subject to a fee. You can check the connection prices on selectel.ru.