Skip to content
Nearzero
Star us

Point the hostname at the server that runs the app

Delegate a managed zone to CoreDNS, or bring your own DNS. Traefik terminates HTTPS on the selected server when ports 80 and 443 are open.

01

Pick how DNS reaches the server

Recommended

Environment-bound zone

Nearzero writes a distinct authoritative A record for each service, pointing directly to its selected local or remote server.

Best for multi-server routing
Shared edge

Platform apex

A wildcard hostname can work only when an independently configured shared edge can route every generated hostname to the correct server.

Requires external routing
Bring your own

Manual domain

Add a hostname you control and create the required external DNS record using Nearzero’s target-IP validation guidance.

Operator-managed DNS
02

Delegate an application subzone

  1. 01
    Keep port 53 on the control-plane host

    Allow both TCP and UDP from public resolvers. Remote application servers do not run authoritative Nearzero DNS.

  2. 02
    Create the zone in Settings → DNS

    A dedicated subzone such as apps.example.com limits the blast radius for existing apex mail and other records.

  3. 03
    Delegate it at the parent provider

    Create NS records for the subzone. If nameservers live inside it, add registrar glue or host records pointing to the control-plane public IP.

  4. 04
    Publish and test externally

    Verify the authoritative response and public delegation before relying on the zone for production.

DNS and HTTPS checks 
dig +short NS apps.example.com
dig @<control-plane-ip> api.apps.example.com A
dig +short api.apps.example.com A
curl --fail --show-error --head https://api.apps.example.com
03

Bind the zone to an environment

Under Project → Domains, pick the managed zone and an optional prefix. When a service needs a domain, Nearzero creates the hostname, writes an A record for that server’s IP, and keeps the Traefik route in sync.

Managed DNS request flow from CoreDNS to the selected server and Traefik.
ResolverCoreDNS :53Authoritative A record
Selected hostServer :443Public application IP
IngressTraefikHostname → service port
04

What Let's Encrypt needs

  • 1
    Resolve to the selected server.

    The public A record must match the address receiving the request.

  • 2
    Allow TCP 80.

    Traefik uses it for HTTP-01 validation and redirects.

  • 3
    Allow TCP 443.

    This carries HTTPS application traffic. UDP 443 is optional HTTP/3.

  • 4
    Permit Let’s Encrypt in CAA.

    If the zone has CAA records, include an issue value for letsencrypt.org.

Certificate issuance occurs on the application server’s Traefik instance, not on the authoritative DNS host.

05

Production DNS limits

  • The generated CoreDNS configuration is authoritative-only and does not provide recursive resolution.
  • Nearzero does not enable public AXFR in its generated configuration.
  • Generated zones are not DNSSEC-signed; remove stale parent DS records or operate an external signing pipeline.
  • Apply network-level DNS rate limits suitable for expected traffic.
  • Republish active zones after upgrades that migrate the DNS volume or schema.

Questions this page answers

Does Nearzero support custom domains and Let's Encrypt?

Yes. Point the hostname at the selected server. Traefik requests Let's Encrypt certificates when ports 80 and 443 are reachable.

What is a Nearzero managed DNS zone?

A subzone you delegate to Nearzero CoreDNS on the control-plane host. Nearzero writes A records to the server that actually runs each service.