> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing DNS zones

Nebius AI Cloud creates a [system-managed DNS zone](/vpc/dns/overview#system-managed-and-custom-zones) for each virtual network automatically, but you can also create [custom DNS zones](/vpc/dns/overview#dns-zones) and manage them.

Custom zones are private. Names in them resolve only from workloads inside the network the zone is attached to.

<Note>
  System-managed zones, for example, `<network_ID>.compute.internal.`, are read-only and cannot be modified or deleted.
</Note>

## Prerequisites

<Tabs>
  <Tab title="Web console">
    Make sure you are in a [group](/iam/authorization/groups/index) that has at least the `editor` role within your tenant or project; for example, the default `editors` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.
  </Tab>

  <Tab title="CLI">
    1. [Install and configure](/cli/install) the Nebius AI Cloud CLI.
    2. Make sure you are in a [group](/iam/authorization/groups/index) that has at least the `editor` role within your tenant or project; for example, the default `editors` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.
  </Tab>
</Tabs>

## Creating DNS zones

<Note>
  If you want to set a name for the zone or configure the negative caching time-to-live (TTL), use a different interface. The web console doesn't support these settings.
</Note>

<Tabs group="interfaces">
  <Tab title="Web console">
    1. In the sidebar, go to <Icon icon="https://mintcdn.com/nebius-ai-cloud/rOlLZ_MFvrheaI-h/_assets/sidebar/networking.svg?fit=max&auto=format&n=rOlLZ_MFvrheaI-h&q=85&s=7a4fe6d935f68131371d7b49a9bd595f" width="16" height="16" data-path="_assets/sidebar/networking.svg" /> **Networking** → **Virtual Networks**.
    2. Click **Actions** → **Create DNS zone**.
    3. In the window that opens, enter a fully qualified domain name (FQDN) that ends with a dot (`.`), for example, `my.example.`. Single-label names, such as `example.`, and reserved names, such as `console.nebius.`, aren't allowed. Learn more in [Zone domain name restrictions](/vpc/dns/resources/quotas-limits#zone-domain-name-restrictions).
    4. Select the network to attach the DNS zone to.
    5. Click **Create DNS zone**.

    You cannot change the domain name or attached network after creating the zone. To use another domain name or network, [delete the zone](#deleting-dns-zones) and create a new one.
  </Tab>

  <Tab title="CLI">
    Run the following command:

    ```bash theme={null} theme={null}
    nebius dns zone create \
      --domain-name <domain_name> \
      --parent-id <project_ID> \
      --name <name> \
      --labels <key>=<value>,<key2>=<value2> \
      --soa-spec-negative-ttl <negative_TTL> \
      --vpc-primary-network-id <network_ID>
    ```

    In the command, specify the following parameters:

    * `--domain-name`: Domain name for the zone. Use a fully qualified domain name (FQDN) that ends with a dot (`.`), for example, `my.example.`. You cannot change the domain name after the zone is created. Top-level domains such as `example.` and some names that are reserved for internal use, such as `console.nebius.`, aren't allowed. Learn more in [Zone domain name restrictions](/vpc/dns/resources/quotas-limits#zone-domain-name-restrictions).
    * `--parent-id`: [Project ID](/iam/manage-projects#cli-3).
    * `--vpc-primary-network-id`: [Network ID](/vpc/networking/resources#cli) of the network to attach the zone to. You cannot change the network after the zone is created — delete and recreate the zone instead.
    * `--name` (optional): Name of the zone.
    * `--labels` (optional): Labels in the `key=value` format.
    * `--soa-spec-negative-ttl` (optional): How long DNS resolvers can cache a "record not found" response for this zone, in seconds. Values below `5` are ignored, and the service default of `900` is used instead.

    The output looks like the following:

    ```yaml theme={null}
    metadata:
      id: dnszone-e00**
      parent_id: project-e00**
      resource_version: "144465"
      created_at: "2026-06-30T12:50:55.335401Z"
      updated_at: "2026-06-30T12:50:55.335401Z"
    spec:
      domain_name: my.example.
      vpc:
        primary_network_id: vpcnetwork-e00**
      soa_spec:
        negative_ttl: "300"
    status:
      record_count: "2"
    ```

    The returned resource shows the parameters you specified and the following:

    * `resource_version` is the current version of the zone. If you later update or delete the zone, you can pass this value in `--resource-version` to make sure that the command applies only to this version of the zone.
    * `status.record_count` shows how many [DNS records](/vpc/dns/manage-records) the zone currently contains. This value can already be greater than `0` after creation because the zone includes service-managed records that are automatically created.
  </Tab>
</Tabs>

## Updating DNS zones

<Note>
  You cannot update DNS zones in the web console. To update a custom DNS zone, use a different interface.
</Note>

1. Get the ID of the zone that you want to update:

   ```bash theme={null} theme={null}
   nebius dns zone list
   ```

   Find the zone that you want to update. The output contains the zone ID in the `.metadata.id` parameter.

2. Run the following command:

   ```bash theme={null} theme={null}
   nebius dns zone update <DNS_zone_ID> \
     --name <name> \
     --soa-spec-negative-ttl <negative_TTL> \
     --resource-version <resource_version>

   # To replace all labels, add:
   # --labels <key>=<value>,<key2>=<value2>
   #
   # To add or remove specific labels, add:
   # --labels-add <key>=<value>
   # --labels-remove <label_key>
   ```

   Specify the zone ID you got in the previous step as `<DNS_zone_ID>`. In the command, you can specify the following parameters to update them:

   * `--name` (optional): Name of the zone.
   * `--labels` (optional): Replace all labels with the specified labels, in the `key=value` format.
   * `--labels-add` (optional): Add labels, in the `key=value` format, without replacing the existing labels.
   * `--labels-remove` (optional): Remove existing labels by key.
   * `--soa-spec-negative-ttl` (optional): How long DNS resolvers can cache a "record not found" response for this zone, in seconds. Values below `5` are ignored, and the service default of `900` is used instead.
   * `--resource-version` (optional): Current version of the zone. Use the `metadata.resource_version` value returned when you create the zone or when you get its ID and details if you want to update only the current version that you last checked. If the zone changed and has a different version, the command fails.

## Deleting DNS zones

You cannot delete system-managed DNS zones. To delete a custom DNS zone, first [delete all records](/vpc/dns/manage-records#deleting-dns-records) except the default `NS @` and `SOA @` records.

<Tabs group="interfaces">
  <Tab title="Web console">
    1. In the sidebar, go to <Icon icon="https://mintcdn.com/nebius-ai-cloud/rOlLZ_MFvrheaI-h/_assets/sidebar/networking.svg?fit=max&auto=format&n=rOlLZ_MFvrheaI-h&q=85&s=7a4fe6d935f68131371d7b49a9bd595f" width="16" height="16" data-path="_assets/sidebar/networking.svg" /> **Networking** → **Virtual Networks**.
    2. On the **DNS** tab, find the zone and click <Icon icon="https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/button-vellipsis.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=e80b8e57c43bfd117679262e6a1334ad" width="12" height="24" data-path="_assets/button-vellipsis.svg" /> → **Delete**.
    3. Confirm the deletion.
  </Tab>

  <Tab title="CLI">
    1. Get the ID of the zone that you want to delete:

       ```bash theme={null} theme={null}
       nebius dns zone list
       ```

       Find the zone that you want to delete. The output contains the zone ID in the `.metadata.id` parameter.

    2. Run the following command:

       ```bash theme={null} theme={null}
       nebius dns zone delete \
         --id <DNS_zone_ID> \
         --resource-version <resource_version>
       ```

       In the command, specify the following parameters:

       * `--id`: ID of the DNS zone to delete, `<DNS_zone_ID>`.
       * `--resource-version` (optional): Current version of the zone. Use the `metadata.resource_version` value returned when you create the zone or when you get its ID and details if you want to delete only the current version that you last checked. If the zone changed and has a different version, the command fails. If you omit this parameter or set it to `0`, the command uses the current version of the zone.
  </Tab>
</Tabs>