All help articles

Automatic DNS (Route53 or dnso.city)

If your domain's DNS is hosted in AWS Route53, or on dnso.city (Zappocity's own DNS hosting, free for a team's domains), Zappocity can publish its records for you and keep them right: the MX, SPF, DKIM, DMARC, MTA-STS, ownership and app-discovery records from the domain's DNS list. It checks them every hour, so a new DKIM key or an MTA-STS change goes out by itself, and a record changed by hand is put back.

What it changes, and what it leaves

Records are published as whole record sets (a name and a type), as Route53 keeps them.

Stopping it leaves the records as they are.

Setting it up

  1. In AWS, make an IAM user (or role) with an access key, and give it this policy, with your hosted zone's ID:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["route53:ChangeResourceRecordSets", "route53:ListResourceRecordSets", "route53:GetChange"],
      "Resource": ["arn:aws:route53:::hostedzone/Z0123456789ABC", "arn:aws:route53:::change/*"]
    },
    {
      "Effect": "Allow",
      "Action": ["route53:ListHostedZonesByName"],
      "Resource": "*"
    }
  ]
}

    The key can then change only that zone. (Leave out ListHostedZonesByName if you give the hosted zone ID below.)

  2. On the domain's page in the team manager, Automatic DNS, with Publish at Route53: enter the access key ID and secret, and the hosted zone (the domain itself by default, or a domain above it whose zone holds its records) and its ID if you have it. Choose Publish automatically, then Publish now: the card lists what changed.

    From the command line: corpsuite domain dns-automation set TEAM DOMAIN accessKeyId=AKIA... secretAccessKey=-, then corpsuite domain dns-automation sync TEAM DOMAIN.

  3. For a domain added without proof, the ownership record is published too: choose Verify on the domain's page once it is out.

The secret is stored sealed with the server's key and never shown again. If the domain moves to another team, the setting is removed, so your key is never used for another team.

Several domains with one key (Route53 connections)

If your tenant has many domains in one AWS account, keep the key once instead of entering it on every domain:

  1. Make the IAM key with the policy above, listing every hosted zone it should change (or arn:aws:route53:::hostedzone/* for all of them). Keep route53:ListHostedZonesByName: it is how each domain's zone is found.
  2. On the tenant's page in the team manager, Route53 connections → Add a connection: a name, the access key ID and secret, and whether new domains should be published with it by themselves.
  3. Under Publish domains with a connection, tick the domains, choose Find hosted zones to see which zone each one would use (nothing changes), then Publish. Each domain's records go in the public hosted zone named after it, or after the nearest domain above it (so mail.acme.com goes in acme.com's zone if it has none of its own). The table says, for each domain, what was published or why not.

With Publish new domains by themselves on, every domain of the tenant without automatic DNS is set up with the connection within ten minutes, including domains added later. A domain whose hosted zone is not in the AWS account is tried again every hour.

A domain's own Automatic DNS card can also choose a connection under Key instead of a key of its own.

The operator has the same under Shared domains → Route53 connections, for the shared domains (mailo.city and the like).

From the command line:

sudo corpsuite tenant dns-connection add acme name="Our AWS" accessKeyId=AKIA... secretAccessKey=- autoNewDomains:=true
sudo corpsuite tenant dns-connections acme
sudo corpsuite tenant dns-connection apply acme CONNECTION-ID all:=true dryRun:=true
sudo corpsuite tenant dns-connection apply acme CONNECTION-ID all:=true
sudo corpsuite dns-connection add name="Platform" accessKeyId=AKIA... secretAccessKey=-   # shared domains

On dnso.city

dnso.city is Zappocity's DNS hosting, and a team's own domains are free there. Under Automatic DNS, choose Publish at: dnso.city, then Publish on dnso.city and Publish now: no keys are needed.

From the command line: corpsuite domain dns-automation set TEAM DOMAIN provider=dnso, then corpsuite domain dns-automation sync TEAM DOMAIN.

Shared domains and the platform's own zones

The operator can set up shared domains the same way, under Shared domains, or publish with the server's own AWS credentials instead of a key (Use the server's own AWS credentials: the server's environment, or the instance role of a server running in AWS). A team's domain can never use the server's credentials. Shared domains publish in Route53 only.

Not yet