Import an existing zone
Create the zone, then run a DNS scan or import a zone file. The scan walks a broad list of common hostnames, because public DNS cannot list every name in a zone.
Review sensitive records before you change the delegation: a missing MX or verification TXT record can break mail or a third-party check.
Drafts and deployments
Additions, edits and deletions stay in a draft. The change set view shows the diff before you apply it, without touching the zone being served.
Applying the set creates a deployment revision. If synchronisation fails, the state stays visible and a retry action publishes again.
- Full diff before publishing
- One revision per applied set
- Discarding a draft leaves the published zone untouched
DNSSEC
Enabling DNSSEC prepares signing and gives you the DS data to publish at your registrar. Protection is complete once the parent holds the DS record and the check confirms the chain of trust.
To disable DNSSEC, remove the DS record at the registrar first, wait for propagation, then turn signing off.
Records proxied through the CDN
A proxied record sends compatible web traffic through cdn.pizza POPs, where caching, SSL and the WAF apply. Mail, verification and incompatible records stay DNS-only.
Nameservers and propagation
The zone is verified once the nameservers shown by the console are visible at the parent. After publishing, query the authoritative servers rather than a resolver that may still be caching.