DNS zones & records

Zones map 1:1 to domains and ride the domain lifecycle: registering a domain or creating a subzone provisions its zone, deleting the domain removes it. Records are the individual DNS entries within a zone.

Record fields:

• name is relative to the zone: @ for the apex, www or a.b for subdomains, * for wildcards. FQDNs and zone-suffixed input are collapsed to the relative form automatically.
• type is one of A, AAAA, CNAME, MX, TXT, SRV, NS, CAA, DS, PTR, HTTPS, SVCB, TLSA, or SSHFP. Content is validated per type (IPv4 for A, hostname for CNAME/NS/MX, and so on) and rejected with a 400 error code such as invalid_ipv4 or invalid_hostname.
• ttl is clamped to 30–86400 seconds and defaults to 3600.
• priority applies to MX (default 10) and SRV (default 0) records only.
• comment is an optional note of up to 500 characters for your own reference. It is stored with the record and never published in DNS; send an empty string to clear it.
• A CNAME must be the only record at its name — conflicting writes return 409 cname_conflict. CNAME and DS records are not allowed at the apex.

Records with managed: true (seeded NS, subzone delegation sets, mail records, DKIM) are system-owned. Editing or deleting one returns 409 managed_record unless you add ?force=true as an org admin. The source field records provenance — user, system, or external-dns.

curl -X POST https://avura.work/api/dns/records \
  -H "Authorization: Bearer avk_5f2c1e9a..." \
  -H "Content-Type: application/json" \
  -d '{
    "zoneId": "zn_123",
    "name": "www",
    "type": "CNAME",
    "content": "example.com.",
    "ttl": 3600
  }'

Access rules:

• Writes require editor access to the zone's domain — held directly, through a group, or inherited from a grant on any ancestor domain. Org owners and admins always have access.
• A zone-pinned token only reaches zones whose domain sits inside its pinned subtree — reads and writes outside it return 403 forbidden. See API tokens.
• Zone deletion and force-editing managed records are org-admin only.

Every successful write is pushed to the authoritative nameservers synchronously. If the DNS provider is unreachable the write returns 502 powerdns_unavailable — the database change may have been recorded, so re-sync the zone once the provider recovers rather than retrying the same write blindly.