Managed DNS

Managed DNS is $2 per domain per month ($22 per year). Each domain you buy it for is one seat.

1. What This Feature Does

Managed DNS hosts the DNS for a domain you own. You point the domain's nameservers at CertaDNS, and from then on the answers for every name in the domain — website, mail, verification records — come from our nameservers, ns1.certadns.com, ns2.certadns.com and ns3.certadns.com.

Each Managed DNS domain gets:

• A record editor for A, AAAA, CNAME, MX, TXT, NS, SRV and CAA records, with a change history and undo. See DNS Records.
• A live check of whether the domain is actually delegated to CertaDNS.
• One-click DNSSEC signing, with the DS record to publish at your registrar.
• Access to DNS Analytics, Threats and DNS Failover, and to TLS Certificates on a paid Dynamic DNS plan.

2. When You Should Use It

• You want CertaDNS to answer for the whole domain, and to manage its records from the dashboard.
• You want DNSSEC on the domain without running your own signing.
• You want query analytics, failover or TLS certificates for the domain — these work over the domain's own DNS.

3. When You Should Not Use It

• You only want email authentication. DMARC, DKIM, SPF, MTA-STS and BIMI do not need Managed DNS: add the domain under Email Authentication instead, and your DNS stays where it is.
• You cannot change the domain's nameservers at its registrar. Managed DNS only serves answers once the domain is delegated to CertaDNS.

4. Prerequisites

• A CertaDNS account with a free Managed DNS seat. Seats are bought in the plan builder; an account without one sees Add Managed DNS — $2/domain on the Managed DNS page.
• A registered domain you control, and access to its current DNS host (to add one TXT record) and to its registrar (to change nameservers).
• A list of the records the domain uses today. Once the nameservers change, only the records you have added in CertaDNS are answered.

5. How It Works (Brief)

1. Ownership. You add a TXT record at your current DNS host. When CertaDNS finds it, the domain is created on our nameservers and appears in your Managed DNS list.
2. Delegation. You change the domain's nameservers at your registrar. CertaDNS checks the domain's public nameserver records and shows whether the domain is Live — answered by CertaDNS — or still pointed elsewhere.
3. Records. Changes you save reach our nameservers within seconds. Resolvers elsewhere may keep a previous answer until that record's TTL expires.

6. How to Use It

Everything below is in DNS > Managed DNS.

Add a domain

1. Click Add a domain. (With no free seat the button is unavailable; buy a seat first.)
2. Enter the domain, for example example.com, and click Request Import.
3. Under Domains being added, copy the Record Name (_certadns-verify.example.com) and Record Value (certadns-verify=…) and add them as a TXT record at your current DNS host.
4. Wait a few minutes, then click Verify. When it succeeds the domain is created on our nameservers and appears in the list.
5. At your registrar, replace the domain's nameservers with ns1.certadns.com, ns2.certadns.com and ns3.certadns.com. View registrar instructions has step-by-step guides for several registrars.

Before step 5, recreate your existing records — especially MX and TXT records for mail — in the record editor, so nothing stops resolving when the nameservers change. If the domain was already set up under Email Authentication, its email records (DMARC, DKIM, SPF, MTA-STS, TLS-RPT, BIMI) are copied into the zone for you when it is verified.

Check delegation

Open the domain (click its name or Manage records). If it is not live, a notice explains why and where the domain currently points. After changing nameservers at your registrar, click Check again. Registrar changes can take a few hours to spread.

Turn on DNSSEC

1. On the domain's page, in the DNSSEC panel, click Enable DNSSEC. CertaDNS generates the keys and signs the domain.
2. Copy the record under DS records — publish at your registrar and add it at your registrar. Until you do, the domain is signed but resolvers do not validate it.

To turn it off, remove the DS record at your registrar first, then click Disable DNSSEC and confirm. A DS record left at the registrar makes validating resolvers treat the domain as broken until it expires from their caches.

Cancel a domain being added

In Pending imports on the Managed DNS page, click the delete icon on the domain and choose Cancel setup. You can start again at any time.

Delete a domain

1. Delete every record you added to the domain, and any Dynamic DNS hostnames created under it. Records CertaDNS maintains for Email Authentication are removed from Email Authentication.
2. On the Managed DNS page, click the delete icon on the domain's row, type the domain name to confirm, and click Delete domain.

CertaDNS stops answering for the domain immediately. Point its nameservers somewhere else first, or anything using it stops resolving. The seat becomes free for another domain.

7. Inputs and Settings

8. Outputs and Results

The Managed DNS list

• The header shows how many seats you have used, for example 2 of 3 seats used.
• Each domain shows its Status, its number of Records, Manage records, and a delete icon.
• Pending imports lists domains still being verified, with how many attempts have been made.

Status

The domain page

• A delegation notice, shown only when the domain is not live.
• The DNSSEC panel: Active with the DS record to publish, or Disabled.
• The record editor — see DNS Records.
• Change history, with who changed what and an undo on the latest change.

9. How to Interpret Results

Normal

• Live on every domain you have finished moving.
• Not delegated for a few hours after you change nameservers at the registrar.

Worth investigating

• Not delegated a day after changing nameservers — the change was not saved at the registrar, or was saved on a different domain. Compare the nameservers the notice shows with the three above.
• Not resolving — check the registration with your registrar before changing anything in CertaDNS. Changing nameservers cannot fix an expired domain.
• A domain that was Live and no longer is — the nameservers were changed at the registrar, or the registration lapsed.

10. Common Issues and Explanations

"Managed DNS is $2 per domain per month and you're using all … you've bought"

Every seat is in use. Buy another seat, or delete a domain you no longer host here.

Verification fails

The TXT record was not found with the exact value. Check the name is _certadns-verify.<domain> (some DNS hosts add the domain automatically — enter only _certadns-verify there), that the value is copied whole, and that it is published at the DNS host the domain uses today.

"Please wait … seconds before retrying"

Verification can be tried once a minute.

"Maximum verification attempts exceeded"

A domain gets 10 verification attempts. Cancel the setup and add the domain again for a new token.

"You already own this zone"

The domain is already on your account with Managed DNS. A domain you added under Email Authentication is different: add it here as usual and verify it with the TXT record, and Managed DNS is switched on for it.

"This zone is already registered by another user"

Another CertaDNS account holds the domain.

"Cannot delete zone with … DNS records. Delete DNS records first."

Delete the domain's records first, then delete the domain. A similar message names Dynamic DNS hostnames still under the domain.

Mail or the website stopped working after the nameserver change

The records it needed were not recreated in CertaDNS. Add them in the record editor; answers update within the record's TTL.

11. Limits and Constraints

12. Related Features

• DNS Records — adding, editing and undoing records.
• DNS Analytics — queries to your Managed DNS domains.
• TLS Certificates — certificates validated through your Managed DNS domain.
• Dynamic DNS — dynamic hostnames, including under your own domain.
• Branded Nameservers — nameservers under your own name.

13. Updates and Behavior Changes

• 30 September 2026. This article was rewritten to match the current dashboard. Managed DNS is bought per domain ($2/month); it is no longer tied to a Dynamic DNS plan. The Verified badge was replaced by a delegation status checked against public DNS (Live, Not delegated, Not resolving). Domains are served from three nameserver names, ns1, ns2 and ns3.certadns.com.
• September 2026. Email Authentication no longer needs Managed DNS; domains added there keep their DNS where it is.