Managing your DNS records

Managing your DNS records

Your domains' DNS zone is managed from the domain detail page, DNS tab. This applies to domains registered on the platform as well as to domains bought elsewhere whose nameservers point to us.

Adding a record

Each record has a type, a subdomain (empty or @ for the root) and a value:

Common cases

Connecting the domain to one of your services: no need to create records by hand. Add the domain in the service panel (guide) and the required records are shown and checked automatically.

Verifying domain ownership (Google Search Console, transactional email…):

Type: TXT   Name: @   Value: google-site-verification=xxxx

Receiving email with an external provider:

Type: MX   Name: @   Value: 10 mx1.provider.com
Type: TXT  Name: @   Value: v=spf1 include:provider.com ~all

Flattening: a CNAME at the root

Flattening lets you have a CNAME record on the root of your domain (my-site.com, without a subdomain), which DNS normally doesn't allow. Handy to point your domain to a service that only gives you a hostname (Netlify, Vercel…): just create a CNAME on @ and flattening turns on by itself.

Only catch: if the target service stops answering, so does your domain.

Flattening is reserved for the root. For a subdomain (www, app…), a regular CNAME already does the job.

SRV to an IP address

An SRV normally has to target a hostname. You can still enter an IP address as the target: it is served through our mirror domain, and 203.0.113.10 becomes 203.0.113.10.fwd.nd0.net, which answers with that IP. IPv6 works too. The dashboard keeps showing the IP you entered.

CAA: who may issue your certificates

A CAA record lists the authorities allowed to issue certificates for your domain. The form offers the main ones: ZeroSSL/Sectigo, Let's Encrypt, DigiCert, Google Trust Services, Amazon, GlobalSign…

Webgune issues your certificates through ZeroSSL, under the identifier sectigo.com. If you add a CAA to a domain linked to a service, also add:

Type: CAA   Name: @   Value: 0 issue "sectigo.com"

Without it, your services' HTTPS can't be renewed. The DNS tab recommendations warn you when that's the case. Without any CAA, every authority is allowed.

Activation and propagation

A record you add, edit or delete first shows as pending: the write is queued, applied to the zone, then read back for confirmation before switching to active. This takes a few seconds and the status updates on its own, without reloading the page. No need to resubmit the form if the row isn't active immediately.

Then comes propagation, which no longer depends on us: resolvers refresh their cache according to the TTL, usually within a few minutes, sometimes up to a few hours. Test with:

dig mysite.com A +short

Nameservers and SOA

The root NS and SOA records appear at the top of the list, with a lock: they are part of the zone, but are not edited from the DNS tab.

• NS: for a domain bought elsewhere, we are not its registrar. Its nameservers are set in your registrar's customer area (guide). For a domain bought on the platform, they are edited from the Nameservers tab.
• SOA: only our support team can change it. Open a ticket.

If you point the nameservers elsewhere, the zone managed here stops being authoritative.