How to self-host authoritative DNS on Quake AI

Run an authoritative DNS server you operate on a Quake AI instance. Quake AI does not host managed DNS for your domains. You launch a VM, install PowerDNS, publish zones, and delegate the domain from your registrar to the nameserver hostnames you control.

Choose authoritative software#

This guide installs PowerDNS with the BIND zone-file backend on Ubuntu 22.04. The REST API listens on localhost; you reach it through SSH port forwarding.

Create a security group for DNS#

Allow DNS from the internet and SSH from your administrator address. Restrict the API to localhost on the instance; do not expose TCP 8081 on the floating IP.

Replace YOUR_ADMIN_CIDR with your workstation's public address, for example 203.0.113.10/32.

Launch the DNS instance and assign a floating IP#

SSH to the instance using the floating IP:

ssh -i ~/.ssh/MY_KEYPAIR ubuntu@FLOATING_IP_ADDRESS

Install PowerDNS#

On the instance:

sudo apt update
sudo apt install -y pdns-server pdns-backend-bind

Generate an API key:

API_KEY=$(openssl rand -hex 16)
echo "API_KEY=$API_KEY"

Edit /etc/powerdns/pdns.conf and set:

launch=bind
local-address=0.0.0.0,::
bind-config=/etc/powerdns/named.conf
api=yes
api-key=API_KEY
webserver=yes
webserver-address=127.0.0.1
webserver-port=8081
webserver-allow-from=127.0.0.1

Create /etc/powerdns/named.conf:

zone "example.com" {
  type master;
  file "/etc/powerdns/zones/example.com.zone";
};

Create the zone directory and file:

sudo mkdir -p /etc/powerdns/zones
sudo tee /etc/powerdns/zones/example.com.zone <<'EOF'
$ORIGIN example.com.
$TTL 300
@   IN  SOA ns1.example.com. hostmaster.example.com. (
        2026070801 ; serial
        3600       ; refresh
        600        ; retry
        86400      ; expire
        300 )      ; minimum
    IN  NS  ns1.example.com.
ns1 IN  A   203.0.113.50
www IN  A   203.0.113.50
EOF

Replace example.com and the A records with your domain and floating IP. Bump the SOA serial when you edit the zone.

Validate and restart:

sudo pdnsutil check-zone example.com
sudo systemctl restart pdns
sudo systemctl enable pdns

Verify PowerDNS listens on port 53:

sudo ss -lunp | grep ':53'
dig @127.0.0.1 www.example.com +short

The dig command should print the A record you defined.

Test the REST API over SSH#

From your workstation, forward local port 8081 to the instance:

ssh -i ~/.ssh/MY_KEYPAIR -L 8081:127.0.0.1:8081 ubuntu@FLOATING_IP_ADDRESS

In another terminal:

curl -s -H "X-API-Key: API_KEY" http://127.0.0.1:8081/api/v1/servers/localhost/zones

The response lists the example.com zone. Use the API for dynamic record changes; zone files remain the bootstrap path in this guide.

Delegate the zone at your registrar#

At your registrar, point the domain's authoritative nameservers at the hostnames PowerDNS publishes (for example ns1.example.com). Add glue records (nameserver hostname to IPv4 address) when the registrar requires them.

Provider UIs differ. Use their nameserver or custom DNS documentation:

Delegation can take up to 48 hours to propagate globally. TTL on the previous NS set controls how long resolvers cache the old delegation.

Verify public resolution#

Query from your workstation against a public resolver:

dig +trace www.example.com A

The trace should end at your floating IP for the www A record.

Query the authoritative server directly:

dig @FLOATING_IP_ADDRESS www.example.com A +short

Send HTTP to a host you published once records resolve:

curl -I http://www.example.com

If resolution fails, confirm the floating IP is associated, dns-sg allows UDP/TCP 53, and the registrar glue records match the floating IP.

CoreDNS for Kubernetes service discovery#

When the goal is internal name resolution inside a cluster rather than public authoritative DNS, run CoreDNS on Kubernetes. Magnum clusters ship CoreDNS as the in-cluster resolver. For a custom Corefile on Quake AI compute outside Magnum, install the binary on an instance and point upstream to your PowerDNS host or to a public resolver.

Example stub zone forwarding to your PowerDNS instance:

example.com:53 {
    forward . FLOATING_IP_ADDRESS
}
log

Deploy CoreDNS with the DaemonSet or systemd unit pattern your orchestrator uses. Public delegation still flows through PowerDNS (or another authoritative server), not through cluster DNS.

See also#

• How to point a domain at a Quake AI resource: registrar A/CNAME records toward a Quake AI address
• How to allocate floating IP addresses
• How to put a CDN in front of a Quake AI workload
• How to issue and auto-renew a TLS certificate with Let's Encrypt
• Self-hosted vibecode stack: perimeter comparison including managed DNS alternatives