Zones and records

A zone is the Edge DNS object that holds one domain, and a record is one name, type, and set of values inside a zone. Edge DNS answers queries for the zone’s domain from Azion’s three nameservers once the domain’s registrar delegates it to them. Each table below names a field’s Azion Console label, Azion API field, and Azion CLI flag side by side. The value format of each record type is on Record types, and signing a zone is on DNSSEC.

Zone fields

A zone carries a name for your own reference, the domain it serves, and an active state. In the Console, the fields sit on the Create Zone page and on the zone’s Main Settings tab.

A zone’s domain cannot change after creation: an update that sends domain is refused with 19036, and the Console locks Domain Name on the Main Settings tab. To serve another domain, create another zone.

An inactive zone is not answered: its names are answered REFUSED. Deactivation, like any change, can take a few minutes to reach every nameserver, which serve cached answers until then. For the cache behind that delay, refer to How Edge DNS works.

The API adds three read-only fields to a zone: id, the zone’s identifier; nameservers, the three Edge DNS nameservers; and product_version, which reads 2.0. azion describe dns-zone --zone-id <zone-id> prints the same values as ID:, Nameservers:, and Product Version:.

In the Console, the Delete action sits on the zone’s row in the Zones list, and the edit page has no delete control. The dialog warns that the zone is deleted with all its associated settings and that the action cannot be reversed, and it asks you to type the zone’s name. For the full procedure, refer to Create, edit, or delete a zone.

Record fields

A record belongs to one zone: the API creates it under that zone’s path, and the Console lists it on that zone’s Records tab, in the Create Record and Edit Record drawers. A POST with {"name":"www","type":"A","rdata":["192.0.2.1"],"ttl":3600} stores the record below, and the API fills in the fields the request leaves out:

The API also returns id, the record’s read-only identifier, which the record’s CLI commands take as --record-id.

A record name is relative to the zone, so Edge DNS adds the zone’s domain to whatever you type. For example, in a zone whose domain is example.com, a record named www.example.com answers for www.example.com.example.com, and a query for www.example.com gets no answer from it. The Console shows the domain as a suffix after the Name field for that reason.

The Record Type dropdown names each type with a short description. Each type’s value format and rules are on its Record types entry:

To delegate a subdomain to other nameservers, add an NS record on the subdomain’s name.

A name and type hold one simple record. A second record with the same name and type as a simple record is refused with 19004; to answer with several values, put them all in one record’s value. A CNAME also blocks every other type on its name, and a record of another type there is refused with 19018.

A saved zone or record needs no deployment step, but its answers reach the nameservers through a cache. A name that nobody queried before you created it answers within seconds. A name queried before it existed is answered NXDOMAIN for up to one hour, the SOA minimum. A change to an existing record can take a few minutes to reach every nameserver. For the details, refer to How Edge DNS works.

Nameservers and SOA

Every zone is served by the same three Edge DNS nameservers and carries a start of authority (SOA) record that Azion writes. To make Edge DNS authoritative for a domain, delegate the domain to all three at its registrar.

The nameservers are read-only. The API returns them in the zone’s nameservers array, and the zone’s Main Settings tab lists them under Configure your Nameserver, each with a copy button. On the Zones list, Copy Nameserver Values copies all three as one string joined by semicolons: ns1.aziondns.net;ns2.aziondns.com;ns3.aziondns.org.

The SOA record names a zone’s primary nameserver and contact, and sets its timers. You cannot write one: the API refuses SOA as a record type with 10039. A query for a zone’s SOA at ns1.aziondns.net returns these values:

The minimum is how long a negative answer, such as NXDOMAIN for a name that does not exist, may be cached, and Azion’s nameservers cache it too, for up to one hour. For what that means when you add a record, refer to How Edge DNS works.

Permissions

Two account permissions control Edge DNS. View Edge DNS grants access to view the zones on the account, without creating or removing them. Edit Edge DNS grants access to create, edit, and remove zones, and it requires View Edge DNS. For how permissions are granted, refer to Teams permissions.

API and CLI

The API base URL is https://api.azion.com/v4. Every request carries the header Authorization: Token [TOKEN VALUE], with a personal token of the account. The Azion CLI runs the same operations:

A PATCH changes only the fields you send. A PUT replaces the object: a zone takes name and active, and a record takes name, type, and rdata. A create or an update returns {"state":"executed","data":{…}}, a read returns {"data":{…}}, and a delete returns {"state":"executed"}.

A list returns count, total_pages, page, page_size, and the objects in results. A list page holds up to 100 items, set with the page_size query parameter; the CLI takes --page and --page-size, with 50 items per page by default.

Write a CLI boolean with an equals sign: --active=true, --active=false, --enabled=true, --enabled=false.

Errors

The API refuses each request below with HTTP 400 and changes nothing, except 10001 and 10002, which return 401, and 10004, which returns 404. Each entry of the errors array carries the code, the title, a detail sentence, and a source that names the field, such as /data/name.

Related resources