Managing DNS records - Nebius AI Cloud

In a custom DNS zone, you can create DNS records that resolve from inside the network attached to the zone. This page shows how to create, update and delete DNS records.

Prerequisites

Web console
CLI

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.
Create a custom DNS zone to add records to.

Install and configure the Nebius AI Cloud CLI.
Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.
Create a custom DNS zone to add records to.

Record types

A record stores its data in the --data parameter as the RDATA part of the record in the presentation (zonefile) format. For example, for a www 600 IN A 192.0.2.10 resource record in a zonefile, the record data is 192.0.2.10. You can create the following record types in a custom DNS zone:

Type	Example `--data` value	Format
`a`	`192.0.2.10`	IPv4 address
`mx`	`10 mail.my.example.`	Priority and mail server domain name
`txt`	`"v=spf1 -all"`	One or more quoted text strings
`srv`	`10 5 5060 sip.my.example.`	Priority, weight, port and target domain name
`caa`	`0 issue "letsencrypt.org"`	Flags, tag and quoted value
`svcb`	`1 backend.my.example. port=8080`	Priority, target domain name and service parameters
`https`	`1 backend.my.example. alpn=h2`	Priority, target domain name and service parameters

The following record types are restricted:

ns: Custom DNS zones do not support delegation. Nebius AI Cloud creates an NS record at the zone apex together with the zone. You cannot create, update or delete NS records.
soa: Each zone contains exactly one SOA record that Nebius AI Cloud creates together with the zone. You cannot create additional SOA records or delete the existing one. To control how long resolvers cache a “record not found” response, set the zone’s negative caching time-to-live (TTL). This value appears in the last field of the SOA record data.
cname: CNAME records are not supported. Instead of an alias, create a record of the required type directly at that name: for example, an a record with the target’s IP address.
aaaa: AAAA records are not supported in custom DNS zones.

Creating DNS records

Web console
CLI

In the sidebar, go to Networking → Virtual Networks.
On the DNS tab, select the zone that you want to add records to.
Click Create record.
In Relative domain name, enter the zone-relative name of the record, for example, www for www.<zone_domain_name>. Use @ to create the record at the zone apex. Use * as the leftmost label to create a wildcard record that answers queries for names that do not otherwise exist in the zone.
In Record type, select the record type and fill the fields that appear:
A
- IPv4 address: IPv4 address to which the name resolves.
MX
- Hostname: Hostname of the mail server.
- Priority: Priority of the mail server.
TXT
- Value: Text to store in the record.
For email records such as DMARC and SPF, split text longer than 255 characters into multiple quoted blocks of 1–255 characters each.
SRV
- Target: Hostname of the target server.
- Priority: Priority of the target host.
- Weight: Relative weight of the target host among records with the same priority.
- Port: Port on which the service is available.
- (Optional) Protocol: Protocol used by the service, for example, _tcp or _udp.
- (Optional) Service: Name of the service.
CAA
- Value: Value associated with the selected tag.
- Flag: CAA record flag.
- Tag: Tag type. Select issue, issuewild or iodef.
SVCB
- Target: Hostname of the service endpoint.
- Priority: Priority of the service endpoint.
- (Optional) Parameters: Service parameters.
HTTPS
- Target: Hostname of the HTTPS service endpoint.
- Priority: Priority of the HTTPS service endpoint.
- (Optional) Parameters: Service parameters.
(Optional) In TTL, enter how long DNS resolvers can cache the record, in seconds.
(Optional) Enable Delete protection to protect the record from accidental deletion.
Click Create record.

To create a DNS record, run the following command:

nebius dns record create \
  --parent-id <DNS_zone_ID> \
  --name <name> \
  --relative-name <relative_name> \
  --type <record_type> \
  --data <record_data> \
  --ttl <TTL>

In the command, specify the following parameters:

--parent-id: ID of the DNS zone to create the record in. To get zone IDs, run nebius dns zone list.
--name (optional): Name of the record resource. This is not the domain name of the record: the resource name identifies the record in Nebius AI Cloud and lets you look the record up by name. The name must be unique within the zone. Records that Nebius AI Cloud creates automatically have no resource name.
--relative-name: Zone-relative name of the record, for example, www for www.<zone_domain_name>. Use @ to create the record at the zone apex. Use * as the leftmost label to create a wildcard record that answers queries for names that do not otherwise exist in the zone. You cannot change the relative name after the record is created.
--type: Record type. You cannot change the type after the record is created.
--data: Record data in the format that corresponds to the record type. Each record holds one value: to serve several values for the same name, for example, several IP addresses in round robin, create several records with the same relative name and type. Their data must differ: creating a record that repeats the relative name, type and data of an existing record fails with an AlreadyExists error. Write domain names in --data in fully qualified form with a trailing dot, for example service.my.example.. For TXT records, enclose the values in double quotes. For SVCB and HTTPS records, specify the target as a domain name: the . shorthand for the record’s own name is not supported.
--ttl (optional): Time-to-live in seconds: how long resolvers cache the record before querying again. Default: 600. Give records that share a relative name and type the same TTL, because resolvers handle a set with mixed TTLs inconsistently.
--labels (optional): Labels in the key=value format.

The output looks like the following:

metadata:
  id: dnsrecord-e00**
  parent_id: dnszone-e00**
  name: www-a-record
  resource_version: "126446"
  created_at: "2026-07-08T14:15:01.805225Z"
  updated_at: "2026-07-08T14:15:01.805225Z"
spec:
  relative_name: www
  type: A
  ttl: "600"
  data: 192.0.2.10
status:
  zone_domain_name: my.example.
  effective_fqdn: www.my.example.

The returned resource shows the parameters you specified and the following:

status.effective_fqdn is the absolute domain name that the record resolves at: the relative name joined with the zone domain name. You need this value to verify the DNS record.
metadata.resource_version is the current version of the record. If you later update or delete the record, you can pass this value in --resource-version to make sure that the command applies only to this version of the record.

To protect a record from accidental deletion, add the --deletion-protection parameter:

nebius dns record create \
  --parent-id <DNS_zone_ID> \
  --name spf-record \
  --relative-name "@" \
  --type txt \
  --data '"v=spf1 -all"' \
  --ttl 3600 \
  --deletion-protection

With --deletion-protection enabled, you can delete a protected record only with the --force parameter.

Verifying DNS records

DNS records resolve only from the DNS zone’s network. To verify a record, query its fully qualified domain name (FQDN) from a virtual machine (VM) attached to one of the network’s subnets.

Web console
CLI

In the sidebar, go to Networking → Virtual Networks.
On the DNS tab, find the zone that contains the record you want to verify. The Network column shows the zone’s network.
Click the network name to view its subnets.
Return to the DNS tab and select the DNS zone.
Find the record and click next to its FQDN.
Connect to a VM attached to one of the network’s subnets.
Query the copied FQDN from the VM, for example:
dig www.my.example.

To verify a record in a custom DNS zone, connect to a VM attached to a subnet of the zone’s network and query the FQDN from the record’s status.effective_fqdn:

dig www.my.example.

The VM resolves the name through the network resolver at 169.254.169.2 without additional configuration. The output contains the record data in the answer section:

;; ANSWER SECTION:
www.my.example.    600    IN    A    192.0.2.10

A newly created record becomes visible within a minute. If you queried the name before creating the record, the resolver keeps returning the cached “record not found” response until the zone’s negative caching TTL expires, which takes 15 minutes by default.

Updating DNS records

Web console
CLI

In the sidebar, go to Networking → Virtual Networks.
On the DNS tab, select the zone that contains the record you want to update.
Find the record and click .
Change the record data, TTL or Delete protection.
Click Save changes.

Get the ID of the record that you want to update. List the records in the zone:
nebius dns record list \ --parent-id <DNS_zone_ID>
Find the record you want to update and take its ID from the .metadata.id parameter. To list every record in one response instead of the first 100, add the --all parameter. If you set a resource name for the record when you created it, you can look it up by that name instead:
nebius dns record get-by-name \ --parent-id <DNS_zone_ID> \ --name <record_name>
Here --name is the record’s resource name from metadata.name, not its domain name.
Update the record:
nebius dns record update <record_ID> \ --data <record_data> \ --ttl <TTL>
Specify the record ID you got in the previous step as <record_ID>. In the command, you can specify the following parameters to update them:
- --data (optional): Record data in the format that corresponds to the record type.
- --ttl (optional): Record TTL in seconds.
- --name (optional): Name of the record resource.
- --deletion-protection (optional): Protect the record from deletion without the --force parameter, or set to false to remove the protection.
- --labels (optional): Replace all labels with the specified labels, in the key=value format.
- --labels-add (optional): Add labels, in the key=value format, without replacing the existing labels.
- --labels-remove (optional): Remove existing labels by key.
- --resource-version (optional): Current version of the record from metadata.resource_version. If the record changed and has a different version, the command fails.

The relative name and type of a record cannot be updated. To move a record to a different name or change its type, delete the record and create a new one. An updated record becomes visible within a minute, and resolvers can serve the previous value until the record’s TTL expires.

Deleting DNS records

Web console
CLI

In the sidebar, go to Networking → Virtual Networks.
On the DNS tab, select the zone that contains the record you want to delete.
If the record has deletion protection:
1. Next to the record, click .
2. Disable Delete protection and click Save changes.
Find the record and click → Delete.
Confirm the deletion.

Get the ID of the record that you want to delete. List the records in the zone:
nebius dns record list \ --parent-id <DNS_zone_ID>
Find the record you want to delete and take its ID from the .metadata.id parameter. To list every record in one response instead of the first 100, add the --all parameter.
Delete the record:
nebius dns record delete <record_ID>
If the record is protected from deletion, the command fails with a FailedPrecondition error. To delete a protected record, add the --force parameter:
nebius dns record delete <record_ID> \ --force

You cannot delete the zone’s SOA record or the NS record at the zone apex. These records are deleted when you delete the zone.

​Prerequisites

​Record types

​Creating DNS records

​Verifying DNS records

​Updating DNS records

​Deleting DNS records

Prerequisites

Record types

Creating DNS records

Verifying DNS records

Updating DNS records

Deleting DNS records