# dnsRecords (/docs/reference/api/dns-records) > The records of a tenant's [DNS zone](/docs/reference/api/dns-zones). Every method names the zone and is decided on it: reading takes `compute:dns:read`, everything else `compute:dns:manage`, on `provider-dns-zone/{zoneId}`. Records book no quota (at most 500 per zone) and do not bill. The provider's ownership marker (`_better-compute`) and its apex NS and SOA records are never touched. The records of a tenant's [DNS zone](/docs/reference/api/dns-zones). Every method names the zone and is decided on it: reading takes `compute:dns:read`, everything else `compute:dns:manage`, on `provider-dns-zone/{zoneId}`. Records book no quota (at most 500 per zone) and do not bill. The provider's ownership marker (`_better-compute`) and its apex NS and SOA records are never touched. All 5 methods are served by @better-compute/server 0.3.0. | Method | Kind | Authorization | Phase | Status | | ------------------- | -------- | -------------------------------------------------- | ----- | ---------- | | [`create`](#create) | mutation | `compute:dns:manage` @ `compute-provider-dns-zone` | v1.0 | registered | | [`list`](#list) | read | `compute:dns:read` @ `compute-provider-dns-zone` | v1.0 | registered | | [`get`](#get) | read | `compute:dns:read` @ `compute-provider-dns-zone` | v1.0 | registered | | [`update`](#update) | mutation | `compute:dns:manage` @ `compute-provider-dns-zone` | v1.0 | registered | | [`delete`](#delete) | mutation | `compute:dns:manage` @ `compute-provider-dns-zone` | v1.0 | registered | ## create [#create] `POST /api/compute/dnsRecords/create` Makes a record (`name` relative to the zone, `@` for the apex; `type` A, AAAA, CNAME, TXT, MX, SRV, CAA or NS, default A) and returns it `pending` until its zone is ready and the provider has it. `data` is checked against the type before anything is written: an A record holds an IPv4 address, an AAAA record an IPv6 one, CNAME, MX, SRV and NS an absolute host name with a final dot. An apex NS or CNAME and the reserved `_better-compute` name are `INVALID_INPUT`; the same name, type and data twice is `CONFLICT`. An A or AAAA record may follow an instance of the tenant instead (`instanceId`, no `data`): its data is a reserved address assigned to the instance, else the instance's first public address; the record waits until there is one and is deleted with the instance. Another tenant's instance is `ACCESS_DENIED`; the instance is also decided as `compute:instances:update`, with the caller's own credential. Publishes `providerDnsRecord.created`, then `providerDnsRecord.ready` or `providerDnsRecord.error`. * **Kind:** mutation * **Authorization:** `compute:dns:manage` @ `compute-provider-dns-zone` * **Module:** `vps` * **Phase:** v1.0 (registered) **Input** | Field | Type | Required | Constraints | | ---------------- | ------------------------------------------------------------ | -------- | ----------------------------------------------------------------- | | `tenantId` | string | yes | at most 128 characters; matches `^[A-Za-z0-9._:-]{1,128}$` | | `zoneId` | string | yes | at most 56 characters; matches `^pdz_[0-9a-hjkmnp-tv-z]{26,52}$` | | `name` | string | yes | at most 200 characters | | `type` | one of `A`, `AAAA`, `CNAME`, `TXT`, `MX`, `SRV`, `CAA`, `NS` | | default `"A"` | | `instanceId` | string | | at most 57 characters; matches `^inst_[0-9a-hjkmnp-tv-z]{26,52}$` | | `data` | string | | at most 512 characters | | `ttlSeconds` | integer | | 30-86400 | | `priority` | integer | | 0-65535 | | `port` | integer | | 1-65535 | | `weight` | integer | | 0-65535 | | `flags` | integer | | 0-255 | | `tag` | one of `issue`, `issuewild`, `iodef` | | | | `idempotencyKey` | string | yes | at most 128 characters; matches `^[A-Za-z0-9._:-]{1,128}$` | ## list [#list] `POST /api/compute/dnsRecords/list` Returns the zone's records in the order they were made (at most 1000). Deleted ones only with `includeDeleted`. * **Kind:** read * **Authorization:** `compute:dns:read` @ `compute-provider-dns-zone` * **Module:** `vps` * **Phase:** v1.0 (registered) **Input** | Field | Type | Required | Constraints | | ---------------- | ------- | -------- | ---------------------------------------------------------------- | | `tenantId` | string | yes | at most 128 characters; matches `^[A-Za-z0-9._:-]{1,128}$` | | `zoneId` | string | yes | at most 56 characters; matches `^pdz_[0-9a-hjkmnp-tv-z]{26,52}$` | | `includeDeleted` | boolean | | default `false` | ## get [#get] `POST /api/compute/dnsRecords/get` Returns one record: its name, `fqdn`, type, data, TTL, the type's own fields and its state. * **Kind:** read * **Authorization:** `compute:dns:read` @ `compute-provider-dns-zone` * **Module:** `vps` * **Phase:** v1.0 (registered) **Input** | Field | Type | Required | Constraints | | ---------- | ------ | -------- | ---------------------------------------------------------------- | | `tenantId` | string | yes | at most 128 characters; matches `^[A-Za-z0-9._:-]{1,128}$` | | `zoneId` | string | yes | at most 56 characters; matches `^pdz_[0-9a-hjkmnp-tv-z]{26,52}$` | | `recordId` | string | yes | at most 56 characters; matches `^pdr_[0-9a-hjkmnp-tv-z]{26,52}$` | ## update [#update] `POST /api/compute/dnsRecords/update` Changes `data`, `ttlSeconds` and the type's own fields (`priority`, `port`, `weight`, `flags`, `tag`) in place and returns it `updating`; the name and type never change. A record that follows an instance takes no `data`. * **Kind:** mutation * **Authorization:** `compute:dns:manage` @ `compute-provider-dns-zone` * **Module:** `vps` * **Phase:** v1.0 (registered) **Input** | Field | Type | Required | Constraints | | ------------ | ------------------------------------ | -------- | ---------------------------------------------------------------- | | `tenantId` | string | yes | at most 128 characters; matches `^[A-Za-z0-9._:-]{1,128}$` | | `zoneId` | string | yes | at most 56 characters; matches `^pdz_[0-9a-hjkmnp-tv-z]{26,52}$` | | `recordId` | string | yes | at most 56 characters; matches `^pdr_[0-9a-hjkmnp-tv-z]{26,52}$` | | `data` | string | | at most 512 characters | | `ttlSeconds` | integer | | 30-86400 | | `priority` | integer | | 0-65535 | | `port` | integer | | 1-65535 | | `weight` | integer | | 0-65535 | | `flags` | integer | | 0-255 | | `tag` | one of `issue`, `issuewild`, `iodef` | | | ## delete [#delete] `POST /api/compute/dnsRecords/delete` Marks the record for deletion and returns it `deleting`; the reconciler deletes it at the provider and publishes `providerDnsRecord.deleted`. A record whose id the provider has since given to another record is not deleted: the row is finished with a warning in the log. * **Kind:** mutation * **Authorization:** `compute:dns:manage` @ `compute-provider-dns-zone` * **Module:** `vps` * **Phase:** v1.0 (registered) **Input** | Field | Type | Required | Constraints | | ---------- | ------ | -------- | ---------------------------------------------------------------- | | `tenantId` | string | yes | at most 128 characters; matches `^[A-Za-z0-9._:-]{1,128}$` | | `zoneId` | string | yes | at most 56 characters; matches `^pdz_[0-9a-hjkmnp-tv-z]{26,52}$` | | `recordId` | string | yes | at most 56 characters; matches `^pdr_[0-9a-hjkmnp-tv-z]{26,52}$` |