Manage private DNS settings in a network

Last update: November 03 2026Open in Markdown

You can manage private DNS settings in a private network of the cloud platform:

• add a network to a DNS zone so that type A and AAAA DNS records update automatically, and remove a network from a DNS zone;
• connect a network to a DNS resolver so that devices in the network can resolve domain names from private DNS zones, and disconnect from a DNS resolver;
• enable a recursor on a DNS resolver so that devices in the network can resolve public domains.

You can manage private DNS settings in a private network of the cloud platform via the control panel, Terraform, or the Private DNS API. You can enable the recursor for resolving public domains only via Terraform or the Private DNS API.

Add a network to a DNS zone

When you add a network to a DNS zone, A or AAAA records in this zone are automatically created for the network ports. If new ports are added to the network or existing ones are modified, A or AAAA records for them will also be added or modified automatically. Such automatically managed records are marked with the Auto tag.

If you change the port domain name manually, the record in the zone will update automatically.

The fully qualified domain name of the port (FQDN) in the record is generated as <server_hostname>.<zone_domain_name>., where <server_hostname> is the server hostname, <zone_domain_name> is the zone domain name.

1. In the control panel, from the top menu, click Products and select Cloud Servers.
2. Go to Private DNS.
3. Go to the DNS Resolvers tab.
4. In the network row, click .
5. Under the DNS zone field, select the Add to zone checkbox.
6. Select a zone or click New zone to create a new zone.
7. If you clicked New zone in step 6, enter the zone domain or leave the default domain. The domain can contain numbers, Latin letters, and hyphens. The domain cannot be a top-level domain, such as example.
8. Click Save.

Remove a network from a DNS zone

If you remove a network from a DNS zone, the A and AAAA records of this network's ports with the Auto tag will be removed from the zone. You can add the network to the DNS zone again to create the records again.

1. In the control panel, from the top menu, click Products and select Cloud Servers.
2. Go to Private DNS.
3. Go to the DNS Resolvers tab.
4. In the network row, click .
5. Under the DNS zone field, select the Remove from zone checkbox.
6. Enter the network name to confirm deletion.
7. Click Save.

Connect a network to a DNS resolver

If a network is connected to a DNS resolver, servers in this network can resolve domain names of all private DNS zones within their pool and project.

1. In the control panel, from the top menu, click Products and select Cloud Servers.

2. Go to Private DNS.

3. Go to the DNS Resolvers tab.

4. In the network row, click .

5. Under the DNS resolver field, select the Connect to DNS resolver checkbox.

6. Click Save.

7. Specify the resolver IP addresses in the subnet settings of this network. Use the Change DNS servers in a private subnet section of the Private networks and subnets instructions.

   You can view the DNS resolver IP addresses in the network in the control panel: from the top menu, click Products → Cloud Servers → Private DNS → DNS Resolvers tab → network row → DNS resolver field.

8. Optional: so that devices in the network can resolve public domains, enable the recursor on the DNS resolver.

Disconnect a network from a DNS resolver

If you disconnect a network from a DNS resolver, servers in this network will stop resolving domain names of private DNS zones.

1. In the control panel, from the top menu, click Products and select Cloud Servers.

2. Go to Private DNS.

3. Go to the DNS Resolvers tab.

4. In the network row, click .

5. Under the DNS resolver field, select the Disconnect from DNS resolver checkbox.

6. Enter the network name to confirm disconnection.

7. Click Save.

8. Remove the resolver IP addresses from the subnet settings of this network. Use the Change DNS servers in a private subnet section of the Private networks and subnets instructions.

   You can view the DNS resolver IP addresses in the network in the control panel: from the top menu, click Products → Cloud Servers → Private DNS → DNS Resolvers tab → network row → DNS resolver field.

Enable a recursor on a DNS resolver

A recursor is a DNS resolver feature for recursive domain lookup that allows devices in a private network to resolve public domains. By default, the recursor feature is disabled.

For the recursor to work, the subnet where the device is located must have internet access.

To enable the recursor:

1. Make sure that the network is connected to the DNS resolver: in the control panel, from the top menu, click Products → Cloud Servers → Private DNS → DNS Resolvers tab → in the network row, view the connection information in the DNS resolver field.

2. Make sure that the private subnet for whose devices you need to configure public domain resolution has internet access:

   • via a cloud router — the subnet is connected to a cloud router with internet access;
   • or via one of the devices in the subnet — internet access is configured for the device, and a static route to the internet via this device is configured on the subnet.

3. If internet access for the subnet is configured via a cloud server, check the security groups on the server's internet port:

   3.1. View the list of security groups on the server's internet port.

   3.2. Make sure that the rules do not block outgoing and incoming UDP traffic through port 53.

4. Enable the recursor via Terraform or using the Update service method in the Private DNS API.