Zone Editor
Zone Editor manages individual DNS records and shows how each record maps to local authoritative and optional Cloudflare proxy state.
Where to find it: DNS Zones > Edit on the required zone.
Available to: Authenticated users with access to the zone; Cloudflare lifecycle controls require root/admin.
What this page does
Use Zone Editor for record-level work. Names are normalized into the current zone, record-specific fields are converted into authoritative content, and eligible Cloudflare zones can synchronize A, AAAA, and CNAME proxy preferences.
Before you start
Confirm the zone displayed at the top, read the existing RRset, know the required TTL and record format, and decide whether Cloudflare should proxy an eligible web hostname or leave it DNS-only.
Record field map
| Type | Fields | Notes |
|---|---|---|
| A / AAAA | Record, TTL, IP value, optional Proxied. | Use IPv4 for A and IPv6 for AAAA. |
| CNAME / DNAME / NS / PTR | Record, TTL, hostname value; CNAME may be Proxied. | SDM normalizes hostname targets as fully qualified where required. |
| MX | Priority and destination. | Lower priority is preferred; the destination must resolve. |
| TXT | Text value. | Enter the intended value; SDM handles authoritative quoting/normalization. |
| SRV | Priority, weight, port, target. | The owner normally contains service and protocol labels. |
| CAA | Flag 0 or 1; tag issue, issuewild, or iodef; value. | Controls certificate-authority policy. |
| AFSDB | Subtype and host. | Use only for the AFS database service that requires it. |
| DS | Key tag, algorithm, digest type, digest. | Zone-editor DS data is not a replacement for publishing child-zone DS at its parent. |
| HINFO | CPU and operating system. | Publishing detailed platform data can be undesirable; add it only when required. |
The record table shows 25 rows per page by default. Add, Edit, and Delete mutate the selected RRset. Proxied is available only for A, AAAA, and CNAME when Cloudflare is active and public delegation matches; all other types remain DNS-only.
Controls and fields
| Control, Field, Or Section | What It Does | What It Affects | Recommended Usage |
|---|---|---|---|
| Name | Record label inside the selected zone. The apex is represented by the zone itself or the UI convention shown for the row. | Controls the fully qualified DNS name that will answer. | Use short labels such as www for subdomains and verify apex changes carefully. |
| TTL | Cache lifetime in seconds for the record. | Controls how long resolvers may cache the answer before asking again. | Use lower TTL before migrations; restore normal values after the change is stable. |
| Type | Record type selector: A, AAAA, CNAME, MX, TXT, NS, PTR, SRV, CAA, AFSDB, DNAME, DS, or HINFO. | Determines which value fields appear and how PowerDNS stores the record. | Choose the type first so the correct fields are visible before entering values. |
| A / AAAA value | IPv4 or IPv6 address for a host record. | Controls where the hostname resolves. | Confirm the destination address before saving; wrong values can send traffic to the wrong server. |
| CNAME / DNAME / PTR / NS value | Hostname-style target value. | Creates aliasing, reverse DNS, delegation, or nameserver behavior depending on type. | Use fully qualified targets when required by your DNS policy. |
| MX priority and destination | Priority number and mail exchanger hostname. | Controls mail routing order for the domain. | Lower priority wins. Verify SPF, DKIM, and DMARC after mail routing changes. |
| TXT value | Text payload used for SPF, DKIM, DMARC, verification, and policy records. | Affects mail authentication and vendor verification. | Paste exact vendor-provided text and avoid removing quotes or spaces unless instructed. |
| SRV priority, weight, port, target | Service discovery values for protocols that use SRV records. | Controls how clients locate a service endpoint. | Keep priority/weight/port aligned with the service documentation. |
| CAA flag, tag, value | Certificate authority authorization rule. Tags include issue, issuewild, and iodef. | Restricts which certificate authorities may issue certificates for the domain. | Review certificate provider requirements before saving CAA records. |
| DS key tag, algorithm, digest type, digest | DNSSEC delegation signer data. | Connects parent-zone delegation to child-zone DNSSEC material. | Use values from the DNSSEC signer exactly; incorrect DS can break validation. |
| SOA primary nameserver | Authoritative nameserver named in the zone SOA. | Tells secondary systems which server is primary for the zone. | Keep it aligned with the nameserver that represents SDM authority for this zone. |
| SOA responsible mailbox | Administrative contact in DNS SOA format. | Publishes the operator contact for the zone. | Use a monitored hostmaster-style mailbox formatted as DNS expects. |
| SOA serial | Version number that changes when the zone is updated. | Used by secondary systems and caches to detect newer zone data. | Let SDM manage it unless support explicitly instructs manual correction. |
| SOA refresh / retry / expire | Timing values used by secondary DNS servers. | Controls how secondaries refresh, retry failed refreshes, and decide when data is too old. | Use normal defaults unless you operate external secondary DNS. |
| Add Record | Creates a new record using the current row values. | Adds DNS data and triggers zone update handling. | Review type-specific fields before clicking; most mistakes are value-format mistakes. |
| Edit | Turns an existing editable row into input fields. | Prepares an update but does not save by itself. | Use it for targeted changes instead of deleting and recreating records. |
| Save | Writes edited row values back to the zone. | Changes live DNS data after backend validation. | Save one logical change at a time when troubleshooting. |
| Cancel | Leaves edit mode without saving the row. | Prevents accidental record changes. | Use when you opened edit mode only to inspect a value. |
| Delete | Removes a record after confirmation. | Deletes DNS data from the zone. | Confirm no service still depends on the record. |
Practical guidance
- Use lower TTLs before planned migrations and restore normal TTLs after the change is stable.
- For mail changes, verify MX, SPF, DKIM, and DMARC records together.
- For CAA changes, confirm the certificate authority requirements before saving.
How to use it
- Locate the existing RRset before adding a duplicate.
- Select Add Record or Edit and choose the type.
- Complete Record, TTL, and every type-specific field.
- For eligible Cloudflare records, choose Proxied deliberately.
- Save, refresh the table, and query the authoritative nameserver. Delete only the intended value or row.
Result and next check
The normalized record appears with the intended TTL, content, disabled/proxy state, and provider synchronization. Public visibility still follows DNS caching and delegation.
Theme color