Authoritative zones
List, create and publish authoritative zones; upsert RRsets and individual records. The tenant controls exactly what it can publish and steer.
SS-25 · Global DNS & Traffic Steering
Private names on the mesh and public names for your workloads resolve here. Authoritative zones with 99.999% serve-stale answers, GeoDNS and health-weighted steering, a full DNSSEC key ceremony with ZSK rotation, and a distribution halt/resume brake for safe rollouts.
What it does
List, create and publish authoritative zones; upsert RRsets and individual records. The tenant controls exactly what it can publish and steer.
Compute a steered answer per resolver (GET /zones/{zone}/answer) weighted by geography and target health, so traffic lands on the nearest healthy endpoint.
99.999% serve-stale: when an origin health check fails the resolver still gets a last-known-good answer instead of SERVFAIL.
Initialise DNSSEC, run a signing ceremony and rotate the zone-signing key — the chain-of-trust operations, with keys held in Vault.
Halt and resume zone distribution as a safety brake around a risky change; report the zone SLO.
Worked examples
Auth on every call is the platform standard: an SS-01 Bearer token plus your X-Tenant-Id. $BASE is the service's /api/v1 base; ${H[@]} carries the auth headers.
Create a zone, add a geo/health-steered A record set, publish, then ask for the answer a specific resolver would get.
# Create + publish an authoritative zone
curl -sX POST "$BASE/zones" "${H[@]}" -d '{ "name":"acme.example" }'
curl -sX PUT "$BASE/zones/acme.example/rrsets" "${H[@]}" -d '{
"name":"api.acme.example", "type":"A",
"answers":[ {"ip":"10.0.1.5","region":"eu"}, {"ip":"10.0.2.5","region":"us"} ]
}'
curl -sX POST "$BASE/zones/acme.example/publish" "${H[@]}"
# The steered, health-weighted answer for an EU resolver
curl -s "$BASE/zones/acme.example/answer?name=api.acme.example&geo=eu" "${H[@]}"
# → { "answer": "10.0.1.5", "served_stale": false, "ttl": 30 }Endpoints
Method · path from services/25's openapi.json. The complete catalog for every group is on the docs page.
/api/v1/zonesList the tenant's authoritative zone names/api/v1/zonesCreate an authoritative zone/api/v1/zones/{zone}/recordsAdd a record to a zone/api/v1/zones/{zone}/rrsetsUpsert an RRset/api/v1/zones/{zone}/publishPublish the zone/api/v1/zones/{zone}/answerCompute a steered, health-weighted answer/api/v1/zones/{zone}/resolveResolve a name within the zone/api/v1/zones/{zone}/dnssec/initInitialise DNSSEC for the zone/api/v1/zones/{zone}/dnssec/ceremonyRun a DNSSEC signing ceremony/api/v1/zones/{zone}/dnssec/rotate-zskRotate the zone-signing key/api/v1/health/{target}Report a target health check for steering/api/v1/distribution/haltHalt zone distribution (safety brake)/api/v1/distribution/resumeResume zone distribution/api/v1/sloRead the DNS service SLOArchitecture placement
SS-25 is the resolution plane paired with the mesh: MagicDNS names inside a tenant mesh and authoritative public zones share one steering engine. Answers are health-checked against SS-25 targets and served stale on failure so a resolver never gets SERVFAIL; DNSSEC signing keys come from SS-05 Vault; every zone publish is audit-chained to SS-06.
Keep exploring
ZTNA, the sovereign mesh, native WireGuard coordination, SD-WAN and the UPO policy compiler — one fabric.
Open deep-dive →Detections-as-code, guard-railed containment, threat intel, and the Zeek mesh chaos-rig auditor.
Open deep-dive →The Envoy edge in front of the whole fabric: TLS, JWT, WAF, rate-limits, routes and weighted canaries.
Open deep-dive →Metrics, logs, traces, SLOs with burn-rate routing, synthetic probes and the signed audit index for the whole fabric.
Open deep-dive →