xCloud DNS

Private Beta

xCloud DNS is currently in private beta and only available after manual approval.

Overview

With xCloud DNS, you register domains and host their DNS with xCloud. You manage everything in the DNS section of the xCloud web app or through the DNS REST API:

Domains: register new domains or transfer existing ones to xCloud
Zones and records: host the DNS zone of a domain – no matter where the domain itself is registered – and manage its records (A, AAAA, MX, TXT, and more), including DynDNS for changing IP addresses and DNSSEC
Contacts: the owner and contact data that the registry stores for your domains
Notifications: emails and webhooks for expiring domains, transfers, broken delegations, and more
API tokens: bearer tokens for scripts and integrations that use the DNS API

Key terms

Term	Meaning
Domain	A domain name registered or transferred via xCloud, e.g. `example.com`
Zone	The DNS data of a domain, hosted on the xCloud nameservers
Record	A single DNS entry within a zone, e.g. an A record for `www`
Contact (handle)	Owner or contact data that the registry stores for a domain
Delegation	The nameservers stored at the registry; they decide which zone is used

A zone does not require a domain registered with xCloud: you can host the DNS of a domain that remains registered with another provider.

Getting started

Open the DNS section in the xCloud web app. As long as you have neither domains nor zones, the page offers two entry points:

Register new domain: check whether a domain is available and register it via xCloud. The DNS zone can be created right away. In the same dialog, you can also transfer domains from another provider to xCloud.
Add existing domain: your domain is already registered elsewhere? Create a DNS zone for it and point the domain's nameservers to xCloud – the registration stays where it is.

xCloud DNS is booked automatically with your first contact, domain, or zone. You need a stored payment method for this; without one, you cannot register domains.

Once you use DNS, the page is divided into the tabs Domains, Zones & Records, Contacts, Notifications, and API tokens.

Contacts

Every domain needs contacts that are stored at the registry. Create them on the Contacts tab before your first registration – or directly in the dialog for adding a domain.

A domain uses contacts in four roles:

Role	Meaning
Owner (Owner-C)	The legal owner of the domain
Admin contact (Admin-C)	Administrative contact
Technical contact (Tech-C)	Technical contact
Zone manager (Zone-C)	Contact for the domain's DNS zone

Only the owner is mandatory. The other roles default to Same as owner.

Create a contact

Click Create contact on the Contacts tab
Choose the Contact type: Organisation (company, association, or public authority) or Person (a natural person as owner)
Fill in the fields: first and last name, organisation (for organisations), street and house number, postal code, city, country, phone, optional fax, and the email address
Click Save contact

Enter phone and fax numbers in the format +<country code> <area code> <number>, separated by single spaces – for example +49 421 000000. The registry rejects other formats.

The data is sent to the registry.

Edit and delete contacts

The contact list shows for each contact whether it is In use or Not used.

As long as a domain uses a contact, its first name, last name, and organisation cannot be changed. To change the owner of a domain, create a new contact and assign it on the domain's detail page (see Change contacts).
A contact can only be deleted while no domain uses it.

Domains

The Domains tab lists your domains with status, renewal date, auto-renew, and annual price. Quick filters narrow the list down to Expiring soon or Auto-renew off. Notices at the top point out domains expiring within the next 30 days and zones with a broken delegation.

Register a domain

Click Add domain and stay on the Register tab
Enter the Domain name and click Check availability
If the domain is available, the dialog shows the registration and renewal price
Select the Owner (Owner-C); optionally, use Use other contacts to assign different contacts for the remaining roles
Choose the Nameserver mode:
- xCloud DNS zone (recommended): a DNS zone is created automatically, and the domain uses the xCloud nameservers
- Custom nameservers: you enter at least two of your own nameservers, one per line
Click Register domain

Registration runs in the background. The domain is first shown as Registering and changes to Registered as soon as the registry has confirmed the order.

Transfer domains to xCloud

To move domains from another provider to xCloud, you need the auth code from your previous provider for each domain.

Click Add domain and switch to the Transfer tab
Under Domains and auth codes, enter one domain per line in the format domain.tld, AUTH-CODE – at most 40 domains per transfer. The status list below shows for each line whether it is ready.
Select the contacts and the nameserver mode as for a registration. These settings apply to all domains of the transfer.
Click Transfer domains

A transfer is all-or-nothing: if a single line is invalid, no transfer is started. The domains are shown as Transfer in progress until the transfer has completed.

Domain status

Status	Meaning
Registering	The registration has been ordered and is in progress
Transfer in progress	The transfer to xCloud is in progress
Registered	The domain is active
Change in progress	A change of contacts or nameservers is in progress
Deleting	The domain is being deleted
Deleted	The domain has been released
Failed	The registry rejected the order or change

Domain detail page

Open in the domain list leads to the detail page. It shows status, paid-until date, renewal date with the annual fee, and the auto-renew switch. Manage DNS records leads to the domain's zone. The page has two tabs, Nameservers and Contacts.

Change nameservers

The Nameservers tab shows the nameservers stored at the registry and the result of the Delegation check: xCloud checks every hour whether the delegation at the registry matches the stored nameservers. Check again now starts an additional check.

With Add/change nameservers, you switch between xCloud DNS (managed zone) and Custom nameservers (at least two, one per line). Changes go to the registry and, depending on the TLD, become visible worldwide within a few minutes up to 24 hours.

Moving DNS between providers

Before you switch from one provider to another, lower the TTL of your records and create the records at the new provider. This keeps your website and email reachable during the switch. After the switch is complete, increase the TTL again.

Change contacts

The Contacts tab shows the contacts stored for all four roles. Change next to a role assigns another existing contact to it. Depending on the TLD, changing the owner triggers an owner change that has to be confirmed again.

More actions

The More actions menu on the detail page offers:

Show auth code: shows the code you need to transfer the domain to another provider. Only pass it on to your new provider. For a transfer, the transfer lock must be off.
Transfer lock: when active, the domain cannot be transferred away. Turn it off before a transfer to another provider.
Cancel domain: cancels the domain at the end of its term (see below)

Auto-renew and cancellation

Domains renew automatically every year as long as Auto-renew is on. You can switch auto-renew on or off directly in the domain list or on the detail page.

Cancel domain (or switching auto-renew off) cancels the domain at the end of its paid term:

The domain stays active and usable until the paid-until date and is then released by the registry.
If you switch auto-renew back on before that date, the cancellation is undone. This is no longer possible within the last five days before the scheduled date.
To confirm the cancellation, you type the domain name.

There is no option to renew a domain early.

In the domain list, you can select several domains (at most 40 at a time) and switch auto-renew on or off or cancel them together.

Zones & records

The Zones & Records tab lists your zones with their delegation status and the number of records:

Delegation status	Meaning
Correctly delegated	The domain points to the xCloud nameservers
Foreign nameservers	The domain points to other nameservers – the zone is not in use
Check pending	The delegation has not been checked yet

The quick filters Externally registered and Check pending narrow the list down. The All records switch shows the records of all zones in a single list; Open zone takes you to the respective zone.

Create a zone

When you register a domain with the xCloud DNS zone nameserver mode, its zone is created automatically. For a domain registered elsewhere:

Click Create zone
Enter the Zone name, i.e. the domain name, e.g. example.com
Choose under Records:
- Empty zone: NS and SOA records are set automatically; you create all other records yourself
- Secondary zone (AXFR): the records are regularly taken over from your own primary nameservers via zone transfer. Enter the IP addresses (IPv4 or IPv6) of the primary nameservers, one per line.
Click Create zone

Then point the domain's nameservers at your current registrar to the xCloud nameservers. Until then, the zone shows the delegation status Foreign nameservers.

Zone page

The zone page shows:

Delegation: status of the delegation check, with Check again
Records: number of record sets and entries
Serial: the zone's current serial number
DNSSEC: signing status with a switch (see DNSSEC)

If the domain points to other nameservers, a Broken delegation warning appears: visitors only see the records of this zone once the domain's nameservers point to xCloud.

The Zone actions menu contains Import zone file, Export zone, Delegated subdomains, and Delete zone.

Manage records

The record table groups records into record sets: one row per name and type, with all values of the set. NS and SOA records of the zone are set automatically and are not managed here. You can search records by name or value and filter them by type.

To add a record:

Click Add record
Fill in the fields:
- Type: A, AAAA, CNAME, MX, NS, PTR, SPF, SRV, TXT, or TLSA
- Name: the subdomain, e.g. www. Leave the field empty (or enter @) for the zone itself.
- Value: the content of the record (see table below)
- Priority: only for MX and SRV records
- TTL: in seconds; default 3600, minimum 60
- Comment: optional note, at most 255 characters
Click Add

Clicking a value in the table opens the record for editing. A record's type cannot be changed after creation. Changes are active on all nameservers after 60 seconds at the latest.

Type	Value
A	IPv4 address, e.g. `192.0.2.10`
AAAA	IPv6 address, e.g. `2001:db8::1`
CNAME	Target hostname, e.g. `shop.example.net`
MX	Mail server hostname, e.g. `mail.example.com`, plus a priority
NS	Nameserver hostname, e.g. `ns1.example.net`
PTR	Target hostname
SPF	SPF policy, e.g. `v=spf1 include:_spf.example.com -all`
SRV	`weight port target`, e.g. `10 5060 sip.example.com`, plus a priority
TXT	Free text
TLSA	`usage selector matching-type certificate-data`

Note:

A CNAME record cannot be created for the zone itself (empty name).
The name of a TLSA record must start with _port._protocol, e.g. _443._tcp.
For particularly sensitive records – MX, SPF, DMARC, DKIM, NS, and records on the zone itself – the editor shows a warning, as errors there can disrupt email delivery or the reachability of your domain.

To change several records at once, select their rows in the table. Change TTL sets a common TTL, Delete removes the selected records. At most 200 records can be selected at a time.

DynDNS

For A and AAAA records, you can enable DynDNS to keep a record up to date with a changing IP address, e.g. for a home connection:

Open the record and check Enable DynDNS
Save the record

The zone page then shows the DynDNS URL once. Call this URL from your device – for example from your router or a cron job – to set the record to the device's current IP address. Keep the URL safe: anyone who knows it can change the record.

Delegated subdomains

Via Zone actions › Delegated subdomains, you define how a subdomain of the zone is managed:

Delegated (NS): the subdomain is handed over to other nameservers via NS records. Only NS records are allowed below it.
Virtual: the subdomain only groups records and remains part of this zone. All record types except NS are allowed below it.

Click Create subdomain, enter the name (e.g. shop) and choose the type.

Import and export

Via Zone actions, you can transfer records in BIND zone file format:

Export zone downloads all records of the zone as a BIND zone file. SOA and apex NS records are managed by the nameservers and are not included.
Import zone file: paste the content of a BIND zone file or choose a file. Preview shows which records would be created, which lines are skipped (e.g. because an identical record already exists), and which contain errors. Only Apply changes the zone.

DNSSEC

Use the DNSSEC switch on the zone page to enable or disable signing for the zone. Signing runs in the background; in the meantime the status is Signing, then Signed.

For domains registered via xCloud, xCloud publishes the DS records at the registry automatically.
For externally registered domains, the zone page shows the DS records. Store them at your registrar so that DNSSEC takes effect.

Secondary zones

The records of a secondary zone come from your primary nameservers and cannot be edited in xCloud. DNSSEC and import are not available for secondary zones. Retrieve zone now starts an immediate zone transfer.

Delete a zone

Zone actions › Delete zone permanently removes the zone including all its records. To confirm, you type the zone name. This cannot be undone.

Notifications

The Notifications tab defines how xCloud informs you about events. The settings apply to all domains and zones of the project.

Email recipients: one address per line. Leave the field empty to use your account's email address.
Webhook URL (optional): an https URL to which xCloud sends events (for the structure of the requests, see Webhooks)
Expiry lead time: 7, 14, 30, or 60 days before a domain expires

For each event, you switch email and webhook on or off separately. Webhook switches can only be enabled once a webhook URL has been entered.

Event	When
Domain expiring	A domain without auto-renew expires within the expiry lead time
Renewal failed	Ordering a domain has failed
Delegation broken	The nameservers at the registry no longer match the zone
Transfer status	A transfer has completed or could not be started
Zone changed	Records were changed, also via API, bulk action, or import
DNSSEC key expiring	DS records were published at the registry

The Domain expiring reminder is sent once per term. For the critical events Renewal failed and Delegation broken, email is always on.

API tokens

On the API tokens tab, you create bearer tokens for the DNS REST API. Tokens apply to the project in which you create them; each token has its own permissions.

Click Create API token
Enter a Name
Under Permissions, choose No access, Read, or Write for each area:
- Records (zones & records)
- Domains
- Contacts
Under Zone access, choose All zones (including future ones) or Only selected zones
Choose the Validity: 30, 90, or 365 days, or Unlimited
Optionally, restrict the token to an IP allowlist: one IP address or CIDR range per line
Click Create token

The token is shown only once. Copy it right away – it cannot be retrieved later.

The token list shows each token's permissions, zones, validity, and last use. Revoke invalidates a token immediately; the entry remains in the list as Revoked.