---
title: "Manage private DNS settings in a network"
sidebar_label: "Manage private DNS settings in a network"
sidebar_position: 6
description: "How to add a network to a DNS zone and remove a network from a DNS zone, how to connect a network to a DNS resolver, and other instructions"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'
import EditIcon from '@selectel/docux/icons/edit'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Manage private DNS settings in a network

You can manage private DNS settings in a private network in the Cloud platform:

* [add a network to a DNS zone](#add-network-to-dns-zone) to have A and AAAA DNS records updated automatically, and [remove a network from a DNS zone](#delete-network-from-dns-zone);
* [connect a network to a DNS resolver](#connect-network-to-dns-resolver) so that devices in the network can resolve domain names from private DNS zones, and [disconnect from the DNS resolver](#disconnect-network-from-dns-resolver);
* [enable a recursor on the DNS resolver](#enable-recursor-on-dns-resolver) so that devices in the network can resolve public domains.

You can manage private DNS settings in a private network in the Cloud platform through the [Control panel](https://my.selectel.ru/vpc/default/private-dns/), Terraform, or [Private DNS API](https://docs.selectel.ru/api/private-dns/). You can enable a recursor for public domain resolution only via Terraform or Private DNS API.

## Add a network to a DNS zone \{#add-network-to-dns-zone}

When you add a network to a DNS zone, A or AAAA records are automatically created for the network ports in that zone. If new ports are added to the network or existing ones are changed, A or AAAA records for them will also be added or updated automatically. Such automatically managed records are marked with the Auto tag.

If you [change a port's domain name](/cloud-servers/private-dns/manage-records/change-port-domain-name.mdx) manually, the record in the zone will update automatically.

The fully qualified domain name (FQDN) of a port in a record is formed as `<server_hostname>.<zone_domain_name>.`, where `<server_hostname>` is the server hostname and `<zone_domain_name>` is the zone domain name.

1. In the [Control panel](https://my.selectel.ru/vpc/default/private-dns/), from the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Private DNS** section.
3. Open the **DNS Resolvers** tab.
4. In the network line, click <EditIcon />.
5. Below the **DNS Zone** field, select the **Add to zone.**..
6. Select a zone or click **New zone** to create a new one.
7. If you clicked **New zone** in step 6, enter the zone domain or leave the default one. The domain can contain digits, Latin letters, and hyphens. The domain cannot be a top-level domain, for example `example`.
8. Click **Save**.

## Remove a network from a DNS zone \{#delete-network-from-dns-zone}

If you remove a network from a DNS zone, the A and AAAA records of that network's ports with the Auto tag will be removed from the zone. You can [add the network to the DNS zone](#add-network-to-dns-zone) again to recreate the records.

1. In the [Control panel](https://my.selectel.ru/vpc/default/private-dns/), on the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Private DNS** section.
3. Open the **DNS Resolvers** tab.
4. In the network line, click <EditIcon />.
5. Below the **DNS Zone** field, select the **Remove from zone.**..
6. Enter the network name to confirm the deletion.
7. Click **Save**.

## Connect a network to a DNS resolver \{#connect-network-to-dns-resolver}

If a network is connected to a DNS resolver, the servers in this network can resolve domain names of all private DNS zones within their [pool](/infrastructure/locations.mdx#pool) and [project](/access-control/projects/).

1. In the [Control panel](https://my.selectel.ru/vpc/default/private-dns/), on the top menu, click **Products** and select **Cloud Servers**.

2. Go to the **Private DNS** section.

3. Open the **DNS Resolvers** tab.

4. In the network line, click <EditIcon />.

5. Below the **DNS Resolver** field, select the **Connect to DNS resolver.**..

6. Click **Save**.

7. Specify the resolver IP addresses in the subnet settings of this network. Use the [Change DNS servers in a private subnet](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#change-dns-servers-on-private-subnet) subsection of the [Private networks and subnets](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx) guide.

   The DNS resolver IP addresses in a network can be viewed in the [Control panel](https://my.selectel.ru/vpc/default/private-dns/resolvers): from the top menu, click **Products** → **Cloud Servers** → **Private DNS** → **DNS Resolvers** tab → network line → **DNS Resolver** field.

8. Optional: to allow devices in the network to resolve public domains, [enable the recursor on the DNS resolver](#enable-recursor-on-dns-resolver).

## Disconnect a network from a DNS resolver \{#disconnect-network-from-dns-resolver}

If you disconnect a network from a DNS resolver, servers in this network will stop resolving domain names for private DNS zones.

1. In the [Control panel](https://my.selectel.ru/vpc/default/private-dns/), on the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Private DNS** section.
3. Open the **DNS Resolvers** tab.
4. In the network line, click <EditIcon />.
5. Below the **DNS Resolver** field, select the **Disconnect from DNS resolver.**..
6. Enter the network name to confirm the disconnection.
7. Click **Save**.
8. Remove the resolver IP addresses from the subnet settings of this network. Use the [Change DNS servers in a private subnet](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#change-dns-servers-on-private-subnet) subsection of the [Private networks and subnets](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx) guide.

   The DNS resolver IP addresses in a network can be viewed in the [Control panel](https://my.selectel.ru/vpc/default/private-dns/resolvers): from the top menu, click **Products** → **Cloud Servers** → **Private DNS** → **DNS Resolvers** tab → network line → **DNS Resolver** field.

## Enable a recursor on a DNS resolver \{#enable-recursor-on-dns-resolver}

A recursor is a DNS resolver function for recursive domain lookups; it allows devices in a private network to resolve public domains. The recursor function is disabled by default.

For the recursor to work, the subnet where the device is located must have internet access.

To enable a recursor:

1. Ensure that the network is [connected to a DNS resolver](#connect-network-to-dns-resolver): in the Control panel, on the top menu, click **Products** → **Cloud Servers** → **Private DNS** → **DNS Resolvers** tab → in the network line, in the **DNS Resolver** field, check the connection information.

2. Ensure that the private subnet for whose devices you want to configure public domain resolution has internet access:

   * via a cloud router — the subnet is [connected to a cloud router with internet access](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#connect-private-subnet-to-cloud-router);
   * or via one of the devices in the subnet — the device is [configured for internet access](/cloud-servers/cloud-networks/configure-access-to-internet.mdx), and a [static route to the internet](/cloud-servers/cloud-networks/static-routes.mdx#configure-static-routing-on-subnet) is configured in the subnet via this device.

3. If internet access for the subnet is configured through a cloud server, check the security groups on the server's internet port:

   3.1. [View the list of security groups](/cloud-servers/security-groups/manage-groups/view-security-groups-on-ports.mdx) on the server's internet port.

   3.2. Ensure that the rules do not block outgoing and incoming UDP traffic on port 53.

4. Enable the recursor via [Terraform](/terraform/selectel-provider-reference/resources/private_dns_service_v1/) or using the [Update service](https://docs.selectel.ru/api/private-dns/#tag/Services/operation/updateServiceById) method in the [Private DNS API](https://docs.selectel.ru/api/private-dns/).

<Formbricks />