Zone management
Managed zones
Manage DNS zones as saved drafts linked to live provider state. Learn zone status, provider assignments, record workflows, plan limits, and safe removal.
5 min read
On this page
A managed zone keeps a saved DNS draft, the providers that should receive it, and provider-specific previews and history. The key point is that the saved draft is intended state: previews, drift checks, backups, and pushes read providers, but only a confirmed push writes record changes.
Add a zone#
Open Zones and select Add zone. The Add a zone dialog offers three paths:
Import from a provider
Choose Import from a provider, select a Connection and Zone, then select Import zone. DNSMigrator reads the zone and starts a saved draft with the returned records, excluding SOA and apex NS. Import does not write to the provider.
Start empty
Choose Start empty, enter the Domain, and optionally select connections under Push to. Select Create zone. You can create it without a provider and add one later under Settings → Providers.
Load dnsconfig.js
Choose dnsconfig.js, paste a script or select Open file, then select Read the config. Review Zones in this config, map each DnsProvider key to a connection, and import. The Worker has no network access, stops after three seconds, and accepts a file up to 1 MB. See dnsconfig.js import and export.
If no DNS connection is available, Import from a provider links to Go to connections. Follow Connecting providers or a guide under Supported providers.
Understand the four states#
The workspace separates editing from provider I/O.
| State | Where it lives | What changes it |
|---|---|---|
| Browser draft | Open Records and draft sections of Settings | Add, edit, delete, load a config, or change a draft setting. Discard restores the saved zone. |
| Saved zone | Workspace database | Save changes increments the version and sets Unpushed changes. |
| Live state | Read from each provider for a job | Preview, drift, backup, and push jobs read it. It is not an editable copy. |
| Change plan | Changes | A preview stores each provider’s add, change, delete, unchanged, unsupported, and error results. |
The unsaved-change bar says: “Nothing changes at your providers until you save, preview and push.” Select Discard or Save changes. If another admin saved first, Someone else saved this zone offers Keep editing or Reload.
Push reads and recomputes every provider plan again. The release confirms that the saved zone version still matches the preview when the push is submitted, but the worker does not compare fresh provider operations or repeat the version check. Do not save zone edits or change providers while a push is queued or running. Each usable provider is backed up before its fresh plan is applied. Read Preview and push before production changes.
Read zone status#
The status is updated by imports, saves, provider-set changes, pushes, and drift checks. Creating a preview alone does not update it.
| Status | Release transition |
|---|---|
| In sync | Set after provider import, a fully successful push, or a drift check whose successful plans contain no changes. |
| Unpushed changes | Set after saving the draft or changing assigned providers. |
| Drifted | Set when a drift check finds at least one successful provider plan with changes. |
| Error | Set after any push failure or when every provider plan in a drift check records an error. |
| Not checked | Initial status for a newly created managed zone. |
Select Check for drift to queue a read-only comparison. Scheduled checks need a plan with drift monitoring; see Drift monitoring.
Work in the zone tabs#
- Records edits record sets and shows local lint results. See Record editor and Lint and validation.
- Settings assigns providers and controls defaults, DNSSEC intent, extra nameservers, deletion behavior, ignore rules, and import transforms.
- Changes contains the latest preview or push and up to 20 recent change rows.
- Backups shows manual, scheduled, and Before push snapshots. See Backups and restore.
- Config as code exports the saved zone and can load a matching
D()declaration into the editor. Unsaved changes are not exported.
Workspace Owner and Admin roles can create, edit, assign providers, preview through the current UI, and push. A Member can view zones and run Check for drift; record and settings controls are read-only.
Assign providers#
Under Settings → Providers, select Add a provider, choose a connection, select Add, then select Save providers. Provider assignment is saved separately and reloads the zone, so save record changes first.
Every assigned provider gets a separately planned view of the same saved records. The release managed-zone planner checks support but does not run the migration translator or clamp TTLs. Unsupported records appear under that provider and are omitted from its write plan.
Nameservers used accepts All or 0–4 and limits nameservers returned for that same provider when they are available. Extra nameservers are added to each provider plan’s candidate apex NS set. The deployed managed-zone path does not combine nameservers across all attached providers; see Multi-provider DNS.
A zone can have at most four provider connections, with each connection listed once. More than one requires Pro or Agency. A record push does not change parent delegation; use Nameserver cutover for that.
Know the limits#
| Plan | Managed zones | Scheduled backups | Scheduled drift checks | Providers per zone |
|---|---|---|---|---|
| Free | 3 | None | None | 1 |
| Pro | 25 | Daily | Hourly | Up to 4 |
| Agency | 250 | Hourly | Every 15 minutes | Up to 4 |
A saved zone is limited to 10,000 record sets and 500 values in one set. A dnsconfig.js action can import at most 100 zones, each counting toward the workspace limit. One-time migration tier limits are separate.
Stop managing a zone#
Under Settings → Delete zone, select Delete zone, type the zone name, and confirm. This deletes the managed-zone row and its Changes history. Backup rows keep the workspace, zone name, provider, and record data but are no longer reachable from the deleted zone’s UI unless a zone with that name is managed again.
Deleting a managed zone does not delete the provider’s zone or alter any live DNS record.