Getting started
How an Orbit account is organised, what lives where in the console, and the shortest path from signing in to serving a name from our network.
DNS hosting
DNS hosting.
Your zone is answered from every node on the anycast network, from the address nearest to whoever asked. Records take effect at the edge within about a minute of being saved.
01
Add the zone
- In the console open DNS → Hosting and add the domain. A new zone starts as
pending. - At your registrar, replace the name servers with
ns1.yunzheng.spaceandns2.yunzheng.space, and remove the others. - Come back and press Verify, or wait — we re-check pending zones every ten minutes.
A pending zone is already being served. Verification only settles whether the public internet points at us — it is not a gate on the data reaching the edge. A zone that stays pending for seven days is removed along with its records.
| Name server | Addresses |
|---|---|
| ns1.yunzheng.space | 177.177.83.85 · 2602:f3ff:83::85 |
| ns2.yunzheng.space | 177.177.83.86 · 2602:f3ff:83::86 |
02
Records
A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, PTR, ALIAS, HTTPS and SVCB. TTL is between 60 and 86400 seconds; the default is 3600. Wildcards (* and *.name) expand only where no exact record matches.
| Feature | What it does |
|---|---|
| Weight | On A and AAAA records. Where any record in a set carries a weight, one record is chosen at random in proportion to the weights. |
| Health check | tcp:443, http:80/path or https:443/path. Each node probes every 30 seconds and drops failing addresses from its answers. If every address in a set is failing, all of them are answered again rather than answering nothing. |
| ALIAS | A CNAME that is safe at the apex. The edge resolves the target itself and answers under your own name, with the TTL clamped to between 60 and 300 seconds. |
A zone file can be pasted in whole: Import takes BIND-style text, ignores the SOA and apex NS lines, and shows you exactly what it will do before it does it.
03
Keeping the delegation
Once a zone is active we keep checking, once a day, that the parent still points at us. If somebody changes the name servers back, you get one email and one webhook — and nothing else happens. We never take a zone away because its delegation moved.
An inconclusive check — the parent returning NXDOMAIN, or a lookup failing — is treated as unknown and changes nothing. Only actually seeing somebody else's name servers counts as a loss.
04
Questions
How long until a change is live?
About a minute to reach every node. What takes longer is other people's caches: a record that was already looked up is held elsewhere for its old TTL. Lower the TTL before a planned change, not after.
Can I host DNS without moving the whole domain?
Yes — delegate a single hostname by adding two NS records for that label in your existing DNS. The zone mechanism is identical; only the instructions differ.
Do you support DNSSEC?
For zones you host with us, yes: we sign them and give you the DS record to publish at your registrar. Our public resolver validates DNSSEC too, but that is a separate thing: signing publishes proof, validating checks other people's.
Next
Related
Connect a hostname
Delegate the whole domain, delegate one hostname, or add a CNAME and leave your DNS where it is. What each one costs you and when to pick it.
Link (origin tunnels)
Run a small connector on your own server. It dials out to a city you choose and holds the connection open, so your site is reachable through Orbit without a public address and without an open port.