Managing DNS zones - Nebius AI Cloud

Nebius AI Cloud creates a system-managed DNS zone for each virtual network automatically, but you can also create custom DNS zones and manage them. Custom zones are private. Names in them resolve only from workloads inside the network the zone is attached to.

System-managed zones, for example, <network_ID>.compute.internal., are read-only and cannot be modified or deleted.

Prerequisites

Web console
CLI

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Install and configure the Nebius AI Cloud CLI.
Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Creating DNS zones

If you want to set a name for the zone or configure the negative caching time-to-live (TTL), use a different interface. The web console doesn’t support these settings.

Web console
CLI

In the sidebar, go to Networking → Virtual Networks.
Click Actions → Create DNS zone.
In the window that opens, enter a fully qualified domain name (FQDN) that ends with a dot (.), for example, my.example.. Single-label names, such as example., and reserved names, such as console.nebius., aren’t allowed. Learn more in Zone domain name restrictions.
Select the network to attach the DNS zone to.
Click Create DNS zone.

You cannot change the domain name or attached network after creating the zone. To use another domain name or network, delete the zone and create a new one.

Run the following command:

nebius dns zone create \
  --domain-name <domain_name> \
  --parent-id <project_ID> \
  --name <name> \
  --labels <key>=<value>,<key2>=<value2> \
  --soa-spec-negative-ttl <negative_TTL> \
  --vpc-primary-network-id <network_ID>

In the command, specify the following parameters:

--domain-name: Domain name for the zone. Use a fully qualified domain name (FQDN) that ends with a dot (.), for example, my.example.. You cannot change the domain name after the zone is created. Top-level domains such as example. and some names that are reserved for internal use, such as console.nebius., aren’t allowed. Learn more in Zone domain name restrictions.
--parent-id: Project ID.
--vpc-primary-network-id: Network ID of the network to attach the zone to. You cannot change the network after the zone is created — delete and recreate the zone instead.
--name (optional): Name of the zone.
--labels (optional): Labels in the key=value format.
--soa-spec-negative-ttl (optional): How long DNS resolvers can cache a “record not found” response for this zone, in seconds. Values below 5 are ignored, and the service default of 900 is used instead.

The output looks like the following:

metadata:
  id: dnszone-e00**
  parent_id: project-e00**
  resource_version: "144465"
  created_at: "2026-06-30T12:50:55.335401Z"
  updated_at: "2026-06-30T12:50:55.335401Z"
spec:
  domain_name: my.example.
  vpc:
    primary_network_id: vpcnetwork-e00**
  soa_spec:
    negative_ttl: "300"
status:
  record_count: "2"

The returned resource shows the parameters you specified and the following:

resource_version is the current version of the zone. If you later update or delete the zone, you can pass this value in --resource-version to make sure that the command applies only to this version of the zone.
status.record_count shows how many DNS records the zone currently contains. This value can already be greater than 0 after creation because the zone includes service-managed records that are automatically created.

Updating DNS zones

You cannot update DNS zones in the web console. To update a custom DNS zone, use a different interface.

Get the ID of the zone that you want to update:
nebius dns zone list
Find the zone that you want to update. The output contains the zone ID in the .metadata.id parameter.
Run the following command:
nebius dns zone update <DNS_zone_ID> \ --name <name> \ --soa-spec-negative-ttl <negative_TTL> \ --resource-version <resource_version> # To replace all labels, add: # --labels <key>=<value>,<key2>=<value2> # # To add or remove specific labels, add: # --labels-add <key>=<value> # --labels-remove <label_key>
Specify the zone ID you got in the previous step as <DNS_zone_ID>. In the command, you can specify the following parameters to update them:
- --name (optional): Name of the zone.
- --labels (optional): Replace all labels with the specified labels, in the key=value format.
- --labels-add (optional): Add labels, in the key=value format, without replacing the existing labels.
- --labels-remove (optional): Remove existing labels by key.
- --soa-spec-negative-ttl (optional): How long DNS resolvers can cache a “record not found” response for this zone, in seconds. Values below 5 are ignored, and the service default of 900 is used instead.
- --resource-version (optional): Current version of the zone. Use the metadata.resource_version value returned when you create the zone or when you get its ID and details if you want to update only the current version that you last checked. If the zone changed and has a different version, the command fails.

Deleting DNS zones

You cannot delete system-managed DNS zones. To delete a custom DNS zone, first delete all records except the default NS @ and SOA @ records.

Web console
CLI

In the sidebar, go to Networking → Virtual Networks.
On the DNS tab, find the zone and click → Delete.
Confirm the deletion.

Get the ID of the zone that you want to delete:
nebius dns zone list
Find the zone that you want to delete. The output contains the zone ID in the .metadata.id parameter.
Run the following command:
nebius dns zone delete \ --id <DNS_zone_ID> \ --resource-version <resource_version>
In the command, specify the following parameters:
- --id: ID of the DNS zone to delete, <DNS_zone_ID>.
- --resource-version (optional): Current version of the zone. Use the metadata.resource_version value returned when you create the zone or when you get its ID and details if you want to delete only the current version that you last checked. If the zone changed and has a different version, the command fails. If you omit this parameter or set it to 0, the command uses the current version of the zone.

​Prerequisites

​Creating DNS zones

​Updating DNS zones

​Deleting DNS zones

Prerequisites

Creating DNS zones

Updating DNS zones

Deleting DNS zones