Skip to content
Tefily Docs

DNS

DNS manages providers, zones, and records for a project. Use it when you bind a custom hostname to a hosted app.

Typical flow:

  1. Add a DNS provider (for example Cloudflare) with an API token. DNS shows that the token is connected (not the token itself) and lists Cloudflare zones for that account.
  2. Create a zone, or add one from the Cloudflare list, then verify it (POST /api/projects/:projectId/dns/zones/:zoneId/verify).
  3. Create records the gateway instructions describe (GET .../dns/gateway-instructions?hostname=).
  4. Bind the hostname on the Hosting app and verify.

Record types are only A, AAAA, CNAME, and TXT. The default TTL is 300. Providers are cloudflare (an API token is required) and manual.

GET /api/projects/:projectId/dns/gateway-instructions?hostname=app.example.com returns cnameTarget, gatewayIpv4, gatewayIpv6, preferApexARecords, and hostingDomain. An apex name with an IPv4 gateway uses A; otherwise the record is a CNAME. Binding a hostname also creates a system TXT named _kataflax-verify (or _kataflax-verify.<relative>). Those system rows do not count toward the record cap.

POST /api/projects/:projectId/dns/zones/:zoneId/records
{ "name": "app", "type": "CNAME", "value": "<gateway cname target>", "ttl": 300 }

Admin SDK: DnsApi.createProvider, then zone create / verify, then records. Permissions are domains.read and domains.write.

Disconnecting a provider leaves DNS zones in the project; they just stop syncing to Cloudflare. Disconnect does not delete records already created at Cloudflare. Later creates sync to Cloudflare only when the zone still has a Cloudflare provider with a token.

Limits come from your plan: the number of zones per organization (counting only live zones), and records per zone (50 Free, 1,000 Pro, 5,000 Scale). Records Tefily manages for custom domains do not count toward the record cap. Each project can connect up to 10 DNS providers. Going over a limit returns quota_exceeded with the limit key, and a suspended billing account returns 402. Tefily syncs records to your provider but is not an authoritative DNS host itself.

DNS tools are not in the MCP registry. Use the console or the admin SDK dns sub-API.

The Cloudflare upsert body is { type, name, content, ttl }. It does not send proxied. Tefily does not opt into Cloudflare’s proxy.

Custom-domain certificates are requested from cert-manager. The issuer name is CERT_MANAGER_ISSUER_NAME (default letsencrypt-production). DNS records for issuance must be DNS only (not proxied through a CDN that terminates TLS in front of the cluster), or HTTP-01 / DNS-01 validation can fail. Records Tefily writes do not set Cloudflare’s proxy flag. A proxied record (orange-cloud) can break HTTP-01 / DNS-01 because TLS would terminate in front of the cluster.