DNS

The cloud runs two kinds of DNS:

Server	Answers	For
Authoritative, on the node’s LAN address, port 53	The cloud’s public names under the parent domain: the API, load balancers, instances with a floating IP, public hosted zones	The LAN, through a forward of the parent domain
VPC resolver, at each subnet’s .3	Everything for instances: the cloud’s names, private hosted zones, compute.internal, and the rest of the world through the upstream servers	Instances

The authoritative server is not a recursive resolver: it refuses every other name. Never make it a machine’s only DNS server.

Hosted zones

Tenants create zones in their projects. Zone names end with a dot. A public zone is served by the authoritative server; one named under the parent domain is covered by the LAN’s forward of that domain. A private zone (--visibility private --vpc-id ...) answers only inside its VPC.

stratumctl dns zones create app.cloud.internal. --visibility public --project p-web
stratumctl dns record-sets create zone-abc123 --name www.app.cloud.internal. --type A \
  --records 172.16.1.20 --project p-web

Names of your own

An alias record points at a Stratum resource and follows it:

Alias target	The record answers
lb	The load balancer’s address.
fip	The floating IP’s address, wherever it is associated.
instance	The instance’s private address, plus public.<name> for its floating IP while it has one.

stratumctl dns record-sets create zone-abc123 --name web.app.cloud.internal. --type A \
  --alias-target-type fip --alias-target-id fip-abc123 --project p-web

Upstream DNS servers

The VPC resolvers forward names the cloud does not serve to the upstream servers, set at install and changeable at any time. With none, they resolve from the internet’s root servers, which needs DNS access to the internet.

stratumctl admin dns upstream-servers get
stratumctl admin dns upstream-servers set 192.0.2.53 192.0.2.54
stratumctl admin dns upstream-servers set --none

Up to 4 IPv4 addresses, tried in order, none of them the node itself. A change reaches every resolver within a minute, with no restart; get shows each server’s health and how far the change has got.

Fallback

By default, when every upstream server fails, a lookup fails: the outage is visible, and names only your resolvers know never leak to public DNS. The fallback resolves from the root servers instead:

stratumctl admin dns upstream-servers fallback on     # or off

It needs DNS access to the internet, cannot resolve names only your resolvers serve, and hides a dead upstream. Leave it off unless that trade is wanted.

Resolving private names from the LAN

Private zones and compute.internal answer only inside a VPC. A resolver inbound endpoint puts a VPC’s resolver on a floating IP, so a LAN DNS server can forward to it:

stratumctl floating-ips allocate --project p-web
stratumctl dns resolver-inbound-endpoints create --project p-web \
  --vpc vpc-abc123 --floating-ip fip-abc123 --allowed-cidr 192.0.2.0/24

--allowed-cidr names the networks queries come from; without it the resolver refuses them. One endpoint per VPC.