# DNS

URL: /products/platform/dns · Id: `capability:dns`

> DNS serves each Domain’s records as data, signs every zone with DNSSEC, and flags missing, drifted or dangling records daily.

DNS serves each [Domain](/business/nouns/domain)’s records as data, signs every zone with DNSSEC, and flags missing, drifted or dangling records daily. An [Agent](/business/nouns/agent) reads what a Domain answers and changes it through a previewed [Change](/business/nouns/change).

## Contract
| Clause | Terms |
| --- | --- |
| Record | Each [DNS Record](/business/nouns/dns-record) holds `DNSRecord.type`, `DNSRecord.name` and `DNSRecord.value`: the declared answer. |
| Owner | `DNSRecord.owner` is `platform` for records that serve the [Site](/business/nouns/site), authenticate mail and validate certificates, or `startup` for every other record. |
| Changes | [`DNSRecord.set`](/business/nouns/dns-record/set) adds or changes a `startup` record through a Change, previewed against what the Domain answers today. A revert restores the previous answer. |
| Removes | [`DNSRecord.remove`](/business/nouns/dns-record/remove) stops a `startup` record from answering; its history stays. |
| Refuses | `DNSRecord.set` and `DNSRecord.remove` refuse a `platform` record, so no Agent takes its own Site offline. |
| Checks | Every day the check reads public DNS into `DNSRecord.observed` and sets `DNSRecord.status`: `ok`, `missing`, `drifted` or `dangling`. |
| Dangling | A `dangling` record points at a target that no longer answers, the opening for a subdomain takeover; [`Domain.verify`](/business/nouns/domain/verify) names its fix. |
| Signing | Every registered Domain is signed with DNSSEC by [`Domain.register`](/business/nouns/domain/register), and its CAA record names only the certificate authorities the platform uses. |
| Connected names | For a Domain attached with [`Domain.connect`](/business/nouns/domain/connect), whose DNS sits at another host, the platform lists the records it needs and observes each one. |

## Verbs
| Verb | Object | Event |
| --- | --- | --- |
| [DNSRecord.set](/business/nouns/dns-record/set) | [DNS Record](/business/nouns/dns-record) | [`DNSRecord.set`](/business/events/DNSRecord.set) |
| [DNSRecord.remove](/business/nouns/dns-record/remove) | [DNS Record](/business/nouns/dns-record) | [`DNSRecord.removed`](/business/events/DNSRecord.removed) |

## Interfaces
- [API](/code/api/reference)
- [SDK](/code/sdk/reference)
- [CLI](/code/cli/reference)
- [MCP](/code/mcp/reference)

## Example
```text
fieldnotes.fm   type   name                 value                                owner      status
                txt    @                    google-site-verification=4kq…        startup    ok
                cname  help                 fieldnotes.helpdesk.example          startup    dangling
                txt    _dmarc               v=DMARC1; p=reject                   platform   ok
                caa    @                    0 issue "…"                          platform   ok
```