vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If a network has been added to a zone, the zone cannot be deleted until the permitted network is deleted from the zone.





 What happens if I delete my VPC? 

If the VPC is deleted, the corresponding permitted network will also be deleted from the DNS zones of your instance.





 Why can I still resolve my resource records after I deleted its associated zone or permitted network? 

To maintain a level of performance while resolving DNS queries, DNS Services resolvers cache data related to permitted networks for a period of time. Changes made to a permitted network might not have propagated until the previously cached data expires. See [Known limitations](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-known-limitations) for more details.





 What do the different zone states mean? 

The zone states definitions are as follows.



* Pending: When a DNS zone is added to the instance it will be in Pending. In this state Resource Records can be added, deleted or updated. Since the zone does not have any permitted networks, the zone will not be served by the resolvers in any region.
* Active: When a domain has one or more permitted networks added then the domain state changes to ACTIVE and the domain will be served by the resolver from all the regions.
* Disabled: In this state the zone will not be served and all control path operations will be disabled except deleting the zone.







 Can I use any name for the zone? 

In general, yes, you can use any name for the zone. Certain IBM-owned or IBM-specific DNS zone names are restricted, in other words, they can't be created in DNS Services. See [Restricted DNS zone names](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-zonesrestricted-dns-zone-names) for the complete list.





 Can I create two DNS zones with the same name? 

Creating two DNS Zones with the same name is allowed. Use label and description as described in the following steps to differentiate between the two.



1. Create an instance of DNS Services.
You can drag and drop the import file into the panel that appears, or click the link to upload from your computer

Import files must be plain text format, and cannot exceed 8 MB
4. Click Import records



Your import file should follow this sample format:

www.test.com. 900 IN A 127.0.0.1
www.test.com. 900 IN AAAA ::1
w3.test.com. 900 IN CNAME mydomain.com.
www.test.com. 900 IN MX 1 mail.example.com.
_service._tcp.www.sample.com. 900 IN SRV 1 1 1 mydomain.com.
www.test.com. 900 IN TXT "my content"

After the records are imported, you can review the details of the import status, including the number of files that successfully uploaded and which records could not be uploaded. If you need to upload additional files, click Upload more files and repeat the import steps. Click the X icon in the top right of the panel to close the import panel.





 Exporting resource records 

To export resource records, take the following steps:



1. From your DNS Services instance, select the zone from which you want to export records
2. Click Select record action in the zone details section and choose Export records
3. Enter a name for your exported file, or accept the default name of records.txt
4. Click Download



The exported file is downloaded to the default download location specified by your browser.







 Using the API 

First store the API endpoint in a variable so you can use it in API requests without having to type the full URL. For example, to store the production endpoint in a variable, run this command:

DNSSVCS_ENDPOINT=https://api.dns-svcs.cloud.ibm.com

To verify that this variable was saved, run echo $DNSSVCS_ENDPOINT and ensure that the response is not empty.



 Creating type A resource record 



 Request
Consult [https://whois.icann.org/](https://whois.icann.org/) for this information.

You must have the administrator privilege to edit your domain's configuration at the registrar in order to update or add the name servers provided for your domain when you add it to CIS. If you don't know who the registrar is for the domain you're trying to add to CIS, it is unlikely you have the permission to update your domain's configuration at the registrar. Work with the owner of the domain in your organization to make the necessary changes.
* I want to keep my current DNS provider for my domain (example.com). Can I delegate a subdomain (subdomain.example.com) from my current DNS provider to CIS?

Yes. The process is similar to adding a domain, but instead of the registrar, you work with the DNS provider for the higher level domain. When you add a subdomain to CIS, you are given two name servers to configure, as usual. You configure a Name Server (NS) record for each of the two name servers as DNS records within your domain being managed by the other DNS provider. When we are able to verify that the required NS records have been added, we activate your subdomain. If you do not manage the higher level domain within your organization, you must work with the owner of the higher level domain to get the NS records added.
* What is TLS?

TLS is a standard security protocol for establishing encrypted links between a web server and a browser in an online communication. A TLS certificate is necessary to create a TLS connection with a website and comprises the domain name, the name of the company, and additional data, such as company address, city, state, and country. The certificate also shows the expiration date and details of the issuing Certificate Authority (CA).
* How Does TLS Work?

When a browser initiates a connection with a TLS secured website, it first retrieves the site's TLS Certificate to check whether the certificate is still valid.
Proxied records are records that proxy their traffic through IBM CIS. Only proxied records receive CIS benefits, such as IP masking, where a CIS IP is substituted for your origin IP to protect it:

$ whois 104.28.22.57 | grep OrgName
OrgName: IBM

If you would rather bypass CIS on a domain (we still resolve DNS), then non-proxying the record is a possible solution.
* I got a DNS Validation error: 1004; now what can I do?

For page rules to work, DNS needs to resolve for your zone. As a result, you must have a proxied DNS record for your zone.
* Can I add a CNAME for a root record?

Yes. IBM CIS supports a feature called "CNAME Flattening" which allows our users to add a CNAME as a root record. Our authoritative DNS servers enumerate the CNAME target's records and respond with those records instead of the CNAME itself, effectively hiding the fact that the user configured a CNAME at the root of the domain.
* What is the default health check timeout?

The default health check timeout for the Free Trial and Standard plans is 60 seconds.
* Can health checks be configured for non-HTTP/HTTPS traffic?

No, health checks can only be configured with HTTP/HTTPS.
* Can global load balancers be configured for non-HTTP/HTTPS traffic?

No, global load balancers can only be configured with HTTP/HTTPS.
* Does disabling all of my origins in an origin pool disable the entire pool itself?

Yes, if the origin pool is being used in a load balancer, the traffic is routed to the next highest priority pool or the fallback pool.
* I have an error in my Kubernetes Ingress, what do I do?

The hostname in a Kubernetes ingress must consist of lower case alphanumeric characters, - or ., and must start and end with an alphanumeric character. Using _ in the load balancer name, though permitted, can cause an ingress error in Kubernetes clusters.
: When you run a common command to look up public DNS registry records, like "dig mydomain.com" or "dig app.mydomain.com", you get back the DNS record which looks similar to this
: 

* app.mydomain.com. 300 IN CNAME custom-domain.us-south.cf.cloud.ibm.com.



: 

* custom-domain.us-south.cf.cloud.ibm.com. 33 IN A 169.62.254.80



: 

* custom-domain.us-south.cf.cloud.ibm.com. 33 IN A 169.46.89.151



: 

* custom-domain.us-south.cf.cloud.ibm.com. 33 IN A 169.47.124.23



: This is a correctly set up DNS entry, using the CNAME (custom-domain.us-south.cf.cloud.ibm.com) and A records auto retrieved (169.62.254.80, 169.46.89.151, 169.47.124.23). If however you get back something similar to this
: app.mydomain.com. 3600 IN A 169.62.254.80
: then you only have a hard-coded "A record", and no "CNAME record". This means that when we change the IP addresses that our CNAMES point to, your DNS record forwarding will point to an incorrect IP address and fail. You need to ensure that using the instructions that you add "CNAME records" to your DNS registry, to ensure that your application receives the proper forwarding information. Without fixing this potential problem, your domain will stop receiving traffic, even if you complete the SSL certificate upload steps. So this is a second general step to correct an incorrectly designated DNS record forward.

What happens if I don't update this custom domain redirect by the deadline?
: Your custom domain URL redirect will stop working on the deadline listed.

If my custom domain URL redirect stopped working because the deadline has passed, how can I fix it?
: Follow the listed instructions, it will begin working again after completing the steps.
Secondary DNS zones can be edited at any time to update the master name server or transfer interval. Follow these steps to edit a secondary DNS zone from the DNS Secondary Zones page:



1. Locate the row pertaining to the zone you want to edit.
2. Click the cells of the row to update the Master Nameserver and Transfer Interval fields as necessary.
3. Click the Update button to update the secondary DNS zone, or select Cancel to cancel the action.







 Delete a secondary DNS zone 

A secondary DNS zone can be deleted at any time. Once a secondary DNS zone is deleted, it cannot be recovered. Follow these steps to delete a secondary DNS record from the DNS Secondary Zones page:



1. Locate the row pertaining to the zone you want to delete.
2. Click the Actions menu at the end of the row and select Delete. A confirmation dialog appears.
3. Click the Yes button to confirm the deletion, or click the No button to cancel the action.







 Force a zone transfer for a secondary DNS zone 

In general, DNS zone transfers are automatic, based on the secondary DNS transfer interval specified. If you do not want to wait for the transfer interval, you can force a transfer manually from the DNS Secondary Zones page:



1. Locate the row pertaining to the zone you want to force.
2. Click the Actions menu at the end of the row and select Force Transfer.



After the transfer begins, the status will change to Transferring now. Manual transfers cannot be canceled after they begin. After data is transferred, data transfers return to the transfer interval previously set for the secondary DNS zone. You can update the transfer interval by [editing the secondary DNS zone](https://cloud.ibm.com/docs/dns?topic=dns-manage-secondary-dns-zonesedit-a-secondary-dns-zone) to avoid the need to force the transfer on a frequent basis.





 Convert a secondary DNS zone to a primary zone 

When you convert a secondary DNS zone to primary, IBM Cloud name servers become the authoritative name servers for the converted zone.
Enable / Disable DNSSEC PATCH /v1/{crn}/zones/{domain_id}/dnssec internet-svcs.reliability.update internet-svcs.dnssec.update 







 DNS Records 



Table 3. DNS Records

 Action Method IAM ACTION AT ACTION 

 Get DNS records GET /v1/{crn}/zones/{domain_id}/dns_records internet-svcs.reliability.read internet-svcs.dns-records.read 
 Create a DNS record POST /v1/{crn}/zones/{domain_id}/dns_records internet-svcs.reliability.manage internet-svcs.dns-records.create 
 Update a DNS record PUT /v1/{crn}/zones/{domain_id}/dns_records/{record_id} internet-svcs.reliability.update internet-svcs.dns-records.update 
 Delete a DNS record DELETE /v1/{crn}/zones/{domain_id}/dns_records/{record_id} internet-svcs.reliability.manage internet-svcs.dns-records.delete 
 Import DNS records from zone file GET /v1/{crn}/zones/{domain_id}/dns_records_bulk internet-svcs.reliability.read internet-svcs.dns-records-bulk.read 
 Export DNS records to a zone file POST /v1/{crn}/zones/{domain_id}/dns_records_bulk internet-svcs.reliability.manage internet-svcs.dns-records-bulk.create 







 GLB 



Table 4. GLB

 Action Method IAM ACTION AT ACTION 

 Get global load balancers GET /v1/{crn}/zones/{domain_id}/load_balancers internet-svcs.reliability.read internet-svcs.load-balancers.read 
 Create a global load balancer POST /v1/{crn}/zones/{domain_id}/load_balancers internet-svcs.reliability.manage internet-svcs.load-balancers.create
Fields required for A, AAAA, or CNAME records
Use the buttons before the table to change the context of the table. The column headers identify the fields required and their description.

 Field Description 

 Host Enter the hostname. 
 Points To Enter the IP address to which the host record points. 
 TTL Select the Time to Live (TTL) from the list menu. TTL defaults to 15 minutes. 







 Edit a DNS zone record 

Existing DNS zone records can be edited by a user to update various areas, such as Time to Live (TTL), Pointer (PTR) records and hostnames. Multiple hosts and aliases can be associated with a DNS zone record at any time. A DNS Zone record can be edited from the DNS Edit Zone page. Click the fields of the record you want to update. After updating the details of the record, click the Update button to update the record.

Records that are italicized cannot be edited. These are generally limited to NS (name server) records.





 Delete a DNS zone record 

Deleting a DNS zone record is done through the DNS Edit Zone page. To delete a DNS zone record, click the Delete icon at the end of the row containing the record. A confirmation dialog appears. Click the Yes button to confirm the deletion or on No to cancel the action. Deleting a DNS zone record cannot be undone.
"vpc_crn": "crn:v1:staging:public:is:us-east:a/40705ee14536813e2385f26c20be24a5::vpc:ed5e3cdd-8a4f-45ce-bae4-2774cb028caf"
}
}'





 Response 

{
"id": "fecd0173-3919-456b-b202-3029dfa1b0f7",
"created_on": "2019-01-01T05:20:00.12345Z",
"modified_on": "2019-01-01T05:20:00.12345Z",
"acl_data": {
"vpc_crn": "crn:v1:staging:public:is:us-east:a/40705ee14536813e2385f26c20be24a5::vpc:ed5e3cdd-8a4f-45ce-bae4-2774cb028caf"
},
"type": "vpc"
}







 Creating an "A" resource record 

An A Record (Address Record) is a DNS resource record that associates a domain or subdomain to an IPv4 address.



 Request 



* name: FQDN, such as www.example.com or the host, such as www.
* type: Type of Record - A, AAAA, SRV, and so on.
* ip: IP address for the name.
* ttl: Time to live for the resource record.



curl -X POST $DNSSVCS_ENDPOINT/v1/instances/$INSTANCE_ID/dnszones/$DNSZONE_ID/resource_records -H "Authorization: $TOKEN" -d '{
"name":"www.example.com",
"type":"A",
"rdata": {
"ip":"1.2.6.7"
},
1. Add an A record in CIS and enable proxy:

www.ibmnetworkdemo.com A 169.48.151.44 true 1
2. Add the CNAME record in the authoritative DNS:

www.ibmnetworkdemo.com www.ibmnetworkdemo.com.cdn.cloudflare.net

check::
dig www.ibmnetworkdemo.com a

; <<>> DiG 9.10.6 <<>> www.ibmnetworkdemo.com a
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13528
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.ibmnetworkdemo.com. IN A

;; ANSWER SECTION:
www.ibmnetworkdemo.com. 899 IN CNAME www.ibmnetworkdemo.com.cdn.cloudflare.net.
www.ibmnetworkdemo.com.cdn.cloudflare.net. 299 IN A 104.18.8.216
www.ibmnetworkdemo.com.cdn.cloudflare.net. 299 IN A 104.18.9.216
Show more
Backing up and restoring data 

DNS Services takes daily backups. You can take your own backups, if needed. For IBM and customer responsibilities related to High Availability and Disaster Recovery, refer to [Understanding your responsibilities when using IBM Cloud DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-responsibilities-dns-svcsresponsibilities-dns-svcs).



  Backing up DNS Services data 

DNS Services takes point-in-time backups of all data and saves it in the Dallas and Washington, D.C. regions.





  Restoring a deleted service instance 

After you delete an instance of DNS Services, you can restore the deleted service instance within the data retention period of seven days. After the seven-day period expires, the service instance is permanently deleted.

To view which service instances are available for restoration, use the ibmcloud resource reclamations command. To restore a deleted service instance, use the ibmcloud resource reclamation-restore command.

Learn more about [managing resources](https://cloud.ibm.com/docs/account?topic=account-manage_resource).
* Why is my domain in Pending state? How do I activate it?

When you add a domain to CIS, we give you a couple of name servers to configure at your registrar (or at your DNS provider, if you are adding a subdomain). The domain or subdomain remains in pending state until you configure the name servers correctly. Make sure you add both the name servers to your registrar or DNS provider. We periodically scan the public DNS system to check whether the name servers have been configured as instructed. As soon as we are able to verify the name server change (which can take up to 24 hours), we activate your domain. You can submit a request to recheck name servers by clicking on Recheck name servers in the overview page.
* Who is the registrar for my domain?

Consult [https://whois.icann.org/](https://whois.icann.org/) for this information.

You must have the administrator privilege to edit your domain's configuration at the registrar in order to update or add the name servers provided for your domain when you add it to CIS. If you don't know who the registrar is for the domain you're trying to add to CIS, it is unlikely you have the permission to update your domain's configuration at the registrar. Work with the owner of the domain in your organization to make the necessary changes.
* I want to keep my current DNS provider for my domain (example.com). Can I delegate a subdomain (subdomain.example.com) from my current DNS provider to CIS?

Yes. The process is similar to adding a domain, but instead of the registrar, you work with the DNS provider for the higher level domain. When you add a subdomain to CIS, you are given two name servers to configure, as usual. You configure a Name Server (NS) record for each of the two name servers as DNS records within your domain being managed by the other DNS provider. When we are able to verify that the required NS records have been added, we activate your subdomain.
A DNS CNAME record can be created to allow clients to look up vpc-lb-region1.example.com and resolve xxxxxxx-REGION.lb.appdomain.cloud.



* In the CIS, open Reliability panel and choose DNS.
* Scroll down to DNS Records and create a record of Type: CNAME, Name: vpc-lb-region1, TTL: Automatic and Alias Domain Name: VPC load balancer Hostname.
* Add a DNS CNAME record for vpc-lb-region2.



2. Now adjust the global load balancer to use the new CNAME records.



* Open Reliability panel and choose Global Load Balancers.
* Find and edit the Origin Pools to change the OriginsOrigin Address to vpc-lb-region1.example.com.
* Repeat the above steps for vpc-lb-region2.example.com.



3. Turn on end-to-end security.



* Open the Security panel and choose TLS.
* For the Mode choose End-to-end CA signed. This will terminate HTTPS connections at the global load balancer and use HTTPS connections to the VPC load balancer.





In a browser open [https://lb.example.com](https://lb.example.com) to verify success





 Alternative 2: DNS-only mode, traffic flows directly from the client to the VPC Load Balancers 

In this alternative you will order an SSL certificate for lb.example.com from [Let's Encrypt](https://letsencrypt.org/) through Secrets Manager and configure the global load balancer.

It is not currently possible to order a certificate directly for a CIS global load balancer, but it is possible to order one for a CNAME record. So we will create a CNAME to order the certificate.



1. Open the CIS service you created by earlier, you can find it in the [Resource list](https://cloud.ibm.com/resources)
2. Navigate to Global Load Balancers under Reliability and click DNS.
3. Scroll down to DNS Records section and create a new record:
To eliminate vulnerability from the internet, DNSSec must be deployed at each step in the lookup, from root zone to final domain name (for example, www.icann.org).





 Root record CNAME flattening 

IBM CIS supports a feature called "CNAME Flattening." Using this method, root records can overcome the IETF RFC restriction that if a root record is a CNAME, it cannot have any other records for that domain. CIS Authoritative servers overcome this restriction by returning the A records corresponding to the CNAME target instead of returning the CNAME itself, effectively hiding the CNAME. This technique allows other records such as MX records to be added to the domain, even though the root record is a CNAME.





 Proxying DNS records and global load balancers 

IBM CIS supports proxying for global load balancers and DNS records. When a record or load balancer is proxied, it means that its traffic runs directly through CIS.

Currently, DNS records of type A, AAAA, or CNAME can be proxied.



 Setting proxy modes 

Load balancers and DNS records support both DNS-only and HTTP proxy modes. You can have HTTP proxy and DNS-only domains in the same CIS instance, but the traffic routing behavior differs as follows:



* Traffic for records that are proxied flows through CIS.
* Traffic for records that are non-proxied (DNS-only mode) flows directly from the client to the origin.







 HTTP proxy mode 

In HTTP proxy mode, CIS announces IBM IP addresses externally, but protects (mask) your origin server IP addresses. The announced IP address records have an automatic TTL.

Using HTTP proxy mode offers the following benefits:



* Traffic flows through CIS where all the security, performance, and reliability features such as firewall rules, caching, and so on, are applied.
* The "automatic" TTL (five minutes) reduces the number of authoritative queries made against CIS.







 DNS-only mode 

In DNS-only mode, records are resolved to the origin IP and you can customize the TTL for your records.