# DNS & nameservers

## Hosted vs. external DNS

A domain's DNS lives wherever its **nameservers** point:

- **Our nameservers** (`ns1.ingram.tech` / `ns2.ingram.tech` — the default at
  registration): the domain gets a hosted zone you manage here, via the API,
  the dashboard's DNS tab, or the assistant.
- **External nameservers** (e.g. Cloudflare): DNS is managed at that
  provider. Zone endpoints answer `409 no_hosted_zone`, and the dashboard's
  DNS tab shows where the delegation points instead. Domains transferred in
  keep their existing delegation, so nothing breaks on arrival.

Switch delegation any time from the domain's **Nameservers tab** in the
dashboard, or by asking the [assistant](/docs/agents) ("switch example.com to
your nameservers"). Nameserver changes are free. A REST endpoint for
delegation changes is on the roadmap; today the API manages records, not
delegation.

## Managing records

Record types: `A`, `AAAA`, `CNAME`, `MX`, `TXT`, `NS`, `CAA`, `SRV`.
Changes propagate from our nameservers in ~30 seconds (subject to record
TTLs downstream).

```bash
# List
curl -s https://domains.ingram.tech/api/v1/domains/example.com/zone \
  -H "authorization: Bearer $INGRAM_TOKEN"

# Create
curl -s -X POST https://domains.ingram.tech/api/v1/domains/example.com/zone \
  -H "authorization: Bearer $INGRAM_TOKEN" -H 'content-type: application/json' \
  -H 'idempotency-key: 7e2f1c9a-dns-1' \
  -d '{"subdomain": "app", "type": "A", "value": "203.0.113.10", "ttl": 3600}'

# Delete — a record is identified by its subdomain + type + value triple
curl -s -X DELETE 'https://domains.ingram.tech/api/v1/domains/example.com/zone?subdomain=app&type=A&value=203.0.113.10' \
  -H "authorization: Bearer $INGRAM_TOKEN" -H 'idempotency-key: 7e2f1c9a-dns-2'
```

There is no record id: updates are delete + create of the identifying triple
(the dashboard's edit form does exactly this).

`MX` and `SRV` records take a `priority`; `SRV` additionally understands
service/protocol/weight/port fields.

## DNSSEC

Toggle per domain — `PATCH /api/v1/domains/{name}/settings` with
`{"dnssec": true}`, or the domain's Security tab. Signing is handled on our
nameservers; DNSSEC on an externally-delegated domain is managed at the
external provider instead.