Creating a Zone

To create a new DNS zone, navigate to Zones → Create Zone. The form requires the following fields:

Domain name – a valid domain name (e.g. example.com). The name is normalized to lowercase, and any trailing dot is stripped automatically. Domain names follow standard hostname rules (one or more labels followed by a valid TLD). The check is case-insensitive.

NS group – selects which set of nameservers will be authoritative for the zone. An NS group is a set of NexDNS nameservers (a primary and one or more secondaries). If only one NS group is available, it is pre-selected.

Zone type – either Master (default) or Slave. Slave zone creation requires the slave_zones plan feature.

What happens when a master zone is created:

The domain is checked for availability – no two accounts can host the same domain.
Your domain quota is checked against your subscription plan limit.
The system confirms the zone is not already present on the selected NS group.
Your zone is registered in your account with the status pending.
The zone is provisioned on the NexDNS nameservers as a Master zone, with an initial SOA record and NS records derived from the NS group’s servers.
The SOA record is set to: {primary-ns} {admin-email} 1 10800 3600 604800 3600 where the serial starts at 1, refresh is 10800s (3 hours), retry is 3600s (1 hour), expire is 604800s (7 days), and minimum TTL is 3600s (1 hour). The default TTL for SOA and NS records is taken from the NS group configuration (fallback: 3600s).
NS records are created for each nameserver hostname in the NS group. If your plan includes the ns_aliases feature, custom NS hostnames are used instead.
A copy of the zone is created on every secondary nameserver in the NS group for redundancy.

Zone creation is blocked if the account has any overdue invoices. An active subscription is required.

Cloning a Zone

An existing master zone can be cloned to create a new zone under a different domain name. The clone operation creates a new zone (following the same process as zone creation) and then copies all DNS records from the source zone, except SOA and apex NS records which are generated fresh.

During cloning, all record names and content values that reference the source domain are rewritten to the new domain. For example, if the source zone is old.com and the target is new.com, a CNAME record pointing to www.old.com. will be rewritten to www.new.com..

Only master zones can be cloned. The user must have edit access to the source zone.

Importing a Zone

Zones can be imported from standard BIND zone files. Navigate to Zones → Import Zone to access the import form.

Input methods: paste the zone file content into the text area, or upload a zone file (maximum 2 MB).

Domain name override: optionally specify a domain name. If left empty, the system attempts to detect the domain from the SOA record in the zone file.

NS group: select the NS group for the imported zone, same as with manual zone creation.

Import process:

The zone file content is normalized: comments (starting with ;) are removed, and multi-line records within parentheses are collapsed to single lines.
The parser recognizes the $TTL directive and uses it as the default TTL. The $ORIGIN directive and other directives are skipped.
Each line is parsed as a BIND record: name, optional TTL, optional class (IN), record type, and content. Quoted strings (e.g. TXT values) are preserved correctly.
A new master zone is created with SOA and NS records (as in normal zone creation).
SOA and NS records from the imported file are skipped – the system generates its own.
Supported record types for import: A, AAAA, CNAME, MX, TXT, SRV, CAA, PTR, ALIAS, DNAME, DS, TLSA. Other record types are silently ignored.
Record names are resolved relative to the domain: @ becomes the zone apex, fully qualified names ending with the domain are converted to short names.
Each record is created individually. If a specific record fails validation, it is skipped and the error is reported – remaining records continue to be imported.

After import, you are redirected to the zone detail page. A summary shows how many records were successfully imported and how many had errors.

Exporting a Zone

Any zone can be exported to a standard BIND zone file format. On the zone detail page, use the export action to download the file.

The zone is exported in BIND-compatible format and delivered as a plain text download named {domain}.zone (e.g. example.com.zone).

The exported file can be imported into any DNS server that supports BIND zone file format, or re-imported into NexDNS using the import function.

Slave Zones

A slave zone is a read-only copy of a zone hosted on an external master DNS server. NexDNS pulls zone data from the master server via AXFR zone transfer. This is useful when you want to use NexDNS nameservers as secondaries for zones you manage elsewhere.

Requirements: slave zone creation requires the slave_zones feature in your subscription plan.

Master IP address: you must provide a valid IP address of the master DNS server. This IP is used to perform AXFR transfers. The master server must allow zone transfers from the NexDNS server IP addresses.

How slave zones work:

The slave zone is registered in your account with type slave and the specified master IP.
The NexDNS nameservers are configured to pull the zone from your master IP as the transfer source.
The NexDNS nameservers automatically perform an AXFR transfer from the master to populate the zone data.
Slave zones cannot be edited directly – records are managed on the external master server.

Manual retransfer: you can trigger a manual AXFR retransfer from the zone detail page. This re-fetches the full zone from the master server immediately. Use this if you know the master has been updated and you do not want to wait for the normal SOA-based refresh cycle.

DNSSEC

DNSSEC (DNS Security Extensions) provides cryptographic authentication of DNS responses, protecting against spoofing and cache poisoning. NexDNS supports automatic DNSSEC signing for master zones.

Enabling DNSSEC:

DNSSEC can be enabled from the zone detail page. The toggle is available for master zones only.
When enabled, the system creates two cryptographic keys for the zone:
- A KSK (Key Signing Key) – signs the DNSKEY record set.
- A ZSK (Zone Signing Key) – signs all other record sets in the zone.
Both keys use the ECDSAP256SHA256 algorithm (algorithm 13, ECDSA with P-256 curve and SHA-256). This is a modern, widely supported algorithm with compact signatures.
Zone signing is handled automatically – every DNS response is signed in real time.

DS records:

After enabling DNSSEC, the system provides DS (Delegation Signer) records that you must add at your domain registrar. These DS records create the chain of trust from the parent zone. The DS records are displayed on the zone detail page and are derived from the active KSK. Without configuring DS records at the registrar, DNSSEC validation will not work for external resolvers.

Key rotation:

Keys can be rotated individually (KSK or ZSK). Rotation creates a new key of the same type with the ECDSAP256SHA256 algorithm, activates it, and deactivates the previous key. The old key is kept (but deactivated) to support the rollover period. Individual keys can also be activated, deactivated, or deleted through the zone management interface.

Disabling DNSSEC:

When DNSSEC is disabled, all cryptographic keys for the zone are deleted. You should also remove the DS records from your domain registrar to avoid validation failures. The zone returns to standard unsigned DNS operation.

Deleting a Zone

Zones can be deleted individually from the zone detail page or in bulk from the zone list. Deletion requires edit access to the zone.

When a zone is deleted, the following occurs in order:

Slave copies are removed from all slave servers in the zone’s NS group (failures are logged but do not block deletion).
The zone is removed from the NexDNS nameservers. If it is already absent, deletion proceeds normally.
The zone is removed from your account.

Deletion is immediate and irreversible. All DNS records associated with the zone are permanently removed.

NS Groups

An NS group is a set of NexDNS nameservers that serve your zones. Each group has a name and contains a primary nameserver and one or more secondaries.

NS groups are configured with:

Default TTL – used for SOA and NS records when creating zones (validated as a proper TTL value).
Master server IP – the IP address the secondary nameservers use for AXFR transfers within the group.
Admin email – optional contact email for the group.

When a zone is created, the NS group’s servers determine the NS records added to the zone and which slave servers receive a copy of the zone for redundancy.

Zone Sync Status

Every zone has a sync status that indicates whether it has been successfully provisioned on the NexDNS nameservers. Possible values:

pending – the zone has been registered but is not yet live on the nameservers.
syncing – provisioning to the nameservers is currently in progress.
synced – the zone is fully provisioned and live on the nameservers.
failed – provisioning failed. You are notified, and the system retries automatically in the background.

In most cases, provisioning happens immediately during zone creation. If it cannot complete right away, the zone remains in the pending state and is retried automatically.

Zone Management