Create, update, or delete a DNS record to configure how your site connects to the world.
📘
To delete a record, use terraform destroy.
On creation of a zone, Akamai automatically creates NS and SOA records for you. These are set with defaults. Review and update as necessary.
The sample declarations here are not exhaustive but show the most common record types. For guidance, the arguments table includes links to the RFC standards.
All record types need the base arguments. Add to those the arguments necessary for your record type.
Base
Argument
Required
Description
name
✔
The DNS record or owner name of the record's node.
zone
✔
The domain zone and any nested subdomains.
recordtype
✔
The DNS record type.
ttl
✔
The 32-bit signed integer for the time the resource record is cached.
A value of 0 means that the resource record is not cached and is only used for the transaction in progress. This may be useful for extremely volatile data.
Value of 0: Record holds some other type of DNS public key and must not be used to verify RRSIGs that cover RRsets.
Value of 1: Record holds a DNS zone key. The DNSKEY RR's owner must be the name of the zone.
Bit 15 Security Entry Point flag.
Value of 1: Record holds a key intended for use as a secure entry point. Use this flag as a hint when zone signing or debugging software. Validators must not alter their behavior during the signature validation process in anyway when using this bit. A SEP bit setting also needs the Zone Key flag set to generate signatures legally and must not be used to verify RRSIGs that cover RRsets.
protocol
✔
Set to 3. If not, the DNSKEY resource record is treated as invalid during signature verification.
algorithm
✔
The public key's cryptographic algorithm. This algorithm determines the format of the public key field.
key
✔
A Base64 encoded value representing the public key. The format used depends on the algorithm.
The key tag of the DNSKEY record that the DS record refers to in network byte order.
algorithm
✔
The algorithm number of the DNSKEY resource record referred to in the DS record.
digest_type
✔
Identifies the algorithm used to construct the digest.
digest
✔
A Base16 encoded DS record includes a digest of the DNSKEY record it refers to. The digest is configured the canonical form of the DNSKEY record's fully qualified owner name with the DNSKEY RDATA, and then applying the digest algorithm.
The type of hardware the host uses. A machine name or CPU type may be up to 40 characters long and include uppercase letters, digits, hyphens, and slashes, but the entry needs to start and to end with an uppercase letter.
software
✔
The type of software the host uses. A system name may be up to 40 characters long and include uppercase letters, digits, hyphens, and slashes, but the entry needs to start with an uppercase letter and end with an uppercase letter or a digit.
One or more domain names that specify a host willing to act as a mail exchange for the owner name.
priority
The preference value given to this MX record in relation to all other MX records. When a mailer needs to send mail to a certain DNS domain, it first contacts a DNS server for that domain and retrieves all the MX records. It then contacts the mailer with the lowest preference value. This value is ignored if an embedded priority exists in the target.
priority_increment
An auto-priority increment when multiple targets are provided with no embedded priority.
A 16-bit unsigned integer specifying the order in which the NAPTR records need to be processed to ensure the correct ordering of rules. Low numbers are processed before high numbers. Once a NAPTR is found whose rule matches the target, the client shouldn't consider any NAPTRs with a higher value for order except for the flagsnapter field.
preference
✔
A 16-bit unsigned integer that specifies the order in which NAPTR records with equal order values are processed. Low numbers are processed before high numbers.
flagsnaptr
✔
A character string containing flags that control how fields in the record are rewritten and interpreted. Flags are single alphanumeric characters.
service
✔
Specifies the services available down this rewrite path.
regexp
✔
A regular expression string containing a substitution expression. This substitution expression is applied to the original client string in order to construct the next domain name to lookup.
replacement
✔
Depending on the value of the flags attribute, the next NAME to query for NAPTR, SRV, or address records. Enter a fully qualified domain name as the value.
The cryptographic hash algorithm used to construct the hash value.
flags
✔
Eight one-bit flags you can use to indicate different processing. All undefined flags must be zero.
iterations
✔
The number of additional times the hash function has been performed.
salt
✔
The Base16 encoded salt value, which is appended to the original owner name before hashing. Used to defend against pre-calculated dictionary attacks.
next_hashed_owner_name
✔
The next hashed owner name in hash order. This value is Base32 encoded in binary format. Given the ordered set of all hashed owner names, the hash of an owner name that immediately follows the owner name of the given NSEC3 RR.
type_bitmaps
✔
The resource record set types that exist at the original owner name of the NSEC3 RR.
The resource record set type covered by this signature.
algorithm
✔
Identifies the cryptographic algorithm used to create the signature.
original_ttl
✔
The TTL of the covered record set as it appears in the authoritative zone.
expiration
✔
The date the signature's validity ends. The signature can't be used for authentication past this point in time.
inception
✔
The date the signature is valid. The signature can't be used for authentication prior to this point in time.
keytag
✔
The key tag value of the DNSKEY RR that validates this signature, in network byte order.
signer
✔
The owner of the DNSKEY resource record that validates this signature.
signature
✔
The Base64 encoded cryptographic signature that covers the RRSIG RDATA and covered record set. Format depends on the TSIG algorithm in use.
labels
✔
The number of labels in the original RRSIG RR owner name. Validated to determine if the answer was synthesized from a wildcard, and if so, it can be used to determine what owner name was used in generating the signature.
A 16-bit integer that specifies the preference given to this resource record among others at the same owner. Lower values are preferred.
weight
✔
The 16-bit unsigned integer in Network Byte Order that specifies a relative weight for entries with the same priority. The greater the weight, the greater the probability of selection.
Minimum: 0
Maximum: 65535
To make the RR human-readable, set the value to 0 when there's no server selection to process.
port
✔
The 16-bit unsigned integer in Network Byte Order that specifies the service's target port.
Describes the algorithm of the public key. Assigned values:
0 is reserved
1 for RSA
2 for DSS
3 for ECDSA
fingerprint_type
✔
Describes the message-digest algorithm used to calculate the fingerprint of the public key. Assigned values:
0 is reserved
1 for SHA-1
2 for SHA-256
fingerprint
✔
The Base16 encoded fingerprint as calculated over the public key blob. The message-digest algorithm is presumed to produce an opaque octet string output, which is placed as-is in the RDATA fingerprint field.