Domains and DNS
Domains are the platform’s only region-less resource: a domain does not live in a datacentre, it lives at a registrar.
What runs underneath
Section titled “What runs underneath”| Function | Technology |
|---|---|
| Registration | NameSilo, through an adapter. Other registrars can be added behind the same interface |
| DNS hosting | Cloudflare, through its API |
| ACME challenges | The same Cloudflare zone — see TLS certificates |
The panel does not store a copy of your DNS records. They live at the provider and every screen reads them live. Keeping a copy would mean two lists that disagree, with no way to tell which is right.
Three DNS states, and why they are separate
Section titled “Three DNS states, and why they are separate”| State | Meaning | Can the panel manage records? |
|---|---|---|
namesilo | Records are at the registrar’s own DNS | No |
cloudflare | The zone is in our Cloudflare account | Yes |
external | The zone is in your own Cloudflare account | No — manage them in your own panel |
Collapsing external and namesilo into one “not managed” value would lose the
distinction that matters to you: one is “you could connect this”, the other is “this is
already yours elsewhere”.
Connecting a domain’s DNS, in two steps
Section titled “Connecting a domain’s DNS, in two steps”The two steps are deliberately separate, because merging them into one button would mean handing over a domain’s DNS without realising it.
1. Connect. The zone is prepared at the provider and you can start writing records. Nothing is live yet.
2. Go live. You change the nameservers at your registrar to the ones the panel shows. When the internet sees the change, your records take effect.
Between the two you have a working, honest intermediate state: connected but not live. The panel shows it as such, and it measures the nameservers currently visible on the internet rather than assuming — the gap between “I changed it at the registrar” and “the world sees it” is where nearly every “I did it but it did not work” lives.
Records
Section titled “Records”Standard types: A, AAAA, CNAME, MX, TXT and the rest. For proxyable types the
Cloudflare proxy toggle is shown as it is in Cloudflare’s own interface: Proxy’li
(proxied) or Yalnızca DNS (DNS only).
The LB column
Section titled “The LB column”Next to the proxy toggle there is an LB control. Turning it on for a record asks which load balancer and which target, creates the listener there, and points the record at the load balancer’s address.
Two things about this are worth stating precisely, because they are the whole design:
The routing rule lives on the load balancer, not here. A hostname alone is not a routing decision — “to which backend?” is only answerable on the listener. The Domains screen is a shortcut that creates that listener; it does not keep its own copy. That is why the LB column can tell you a record is already bound: it asks the load balancer.
The proxy setting is never written. When the panel points a record at a load balancer it reads the existing proxy value and writes it back unchanged. The LB control governs where the record points; the Cloudflare control governs how it is served. They are independent, and using both — internal load balancing plus Cloudflare’s proxy to hide your origin address — is a supported combination.
Removing the binding deletes the listener and leaves the DNS record alone. What the record should become afterwards is your decision, not the panel’s.
When you use Cloudflare’s proxy
Section titled “When you use Cloudflare’s proxy”Two notes, neither of which blocks anything:
- Cloudflare’s SSL mode should be Full (strict). Your load balancer presents a valid Let’s Encrypt certificate, so strict validation passes.
- If the load balancer is internal, the record points at a private address that
Cloudflare cannot reach. The certificate is still obtained — the challenge is a
TXTrecord — but proxying is meaningless there.
See Using zone9 with Cloudflare.
Registration and renewal
Section titled “Registration and renewal”Registering and renewing happen at the registrar. The panel shows expiry, nameservers, auto-renew and transfer lock as a reflection of what the registrar reports, with the time of the last read. It does not claim to be authoritative about them, and it does not buy or delete domains: removing a domain from the panel removes the record of ownership, not the domain.
Limits
Section titled “Limits”- One registrar adapter (NameSilo) and one DNS provider (Cloudflare) today.
- DNSSEC is not managed by the panel.
- Domains are not transferable between organisations in the panel.