> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Agent home for Datum, with what it is, pricing, and how to act: https://agents.datum.net
> If you can only fetch URLs: read https://www.datum.net/docs/llms.txt in full and open the most specific page for the task. Commands, limits, and field paths are on task, operations, and limits pages, not on section overviews. Pages described as "Documentation is coming soon" are placeholders.
> If you have a shell or can save files: download https://www.datum.net/docs/llms-full.txt (every page, about 740 KB) once and search it with grep, instead of fetching pages one at a time.
> datumctl describes itself: `datumctl api-resources` lists resource types and `datumctl explain <resource>` shows a schema. To act on live resources, use Datum MCP or datumctl. To search the docs, use the Docs MCP server at https://www.datum.net/docs/mcp.

# Point a domain at a load balancer

> Use Datum DNS to point your domain, and its subdomains, at an Application Load Balancer with an apex ALIAS record and a CNAME.

When Datum hosts your domain's DNS, you can point the domain at an [Application Load Balancer](/docs/alb/overview.md) with two records:

* An `ALIAS` record at the apex, `example.com`. A `CNAME` isn't allowed at the apex, so Datum answers `ALIAS` queries with the load balancer's current addresses. See [ALIAS](/docs/domain-dns/dns.md#alias-/-cname-flattening).
* A `CNAME` record for each subdomain, such as `www.example.com`.

Both point at the load balancer's generated hostname, such as `famous-tree-abc12.datumproxy.net`. To serve traffic for your domain, the load balancer also needs the domain as a [custom hostname](/docs/alb/operations/custom-domains.md).

> [!NOTE]
>
> If your DNS is hosted somewhere else, you don't need anything on this page. Create a `CNAME` to the load balancer's generated hostname at your own DNS provider.

## Point a domain with datumctl dns

The quickest way is the `datumctl dns` plugin. To install it, run `datumctl plugin install dns`.

**1. Find the load balancer's hostname**

```bash theme={null}
datumctl alb describe ALB_NAME
```

The `Default hostname` line shows the generated hostname.

**2. Create the zone, if you haven't already**

```bash theme={null}
datumctl dns zone create example.com
```

Then point your domain at Datum's nameservers. See [Point your domain at Datum](/docs/domain-dns/operations.md#point-your-domain-at-datum).

**3. Add the records**

```bash theme={null}
datumctl dns record set example.com @   ALIAS GENERATED_HOSTNAME.
datumctl dns record set example.com www CNAME GENERATED_HOSTNAME.
```

Replace `GENERATED_HOSTNAME` with the load balancer's hostname, and keep the trailing dot.

**4. Check that it works**

```bash theme={null}
datumctl dns record list example.com --type ALIAS,CNAME
dig +short www.example.com @ns1.datumdomains.net
curl -sI https://www.example.com/
```

The records are live when their status is `Programmed`.

## Point a domain with manifests

The rest of this page creates the same zone and records with `DNSZone` and `DNSRecordSet` manifests, using `datumctl apply`.

### Prerequisites

* `datumctl` installed and authenticated
* A valid **Project**
* Domain delegated to Datum nameservers

***

### Configuration steps

### Step 1: Set variables

The `TARGET` value is your Application Load Balancer endpoint hostname. Find it in the Datum portal under your Application Load Balancer's generated hostname, or via:

```bash theme={null}
datumctl get httpproxy <name> --namespace default -o yaml
```

> [tab] macOS / Linux
>
> ```bash theme={null}
> PROJECT="your-project-id"
> NAMESPACE="default"
> ZONE="your-zone-name"
> DOMAIN="your-domain.example.com"
> TARGET="your-endpoint.datumproxy.net."
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> $PROJECT   = "your-project-id"
> $NAMESPACE = "default"
> $ZONE      = "your-zone-name"
> $DOMAIN    = "your-domain.example.com"
> $TARGET    = "your-endpoint.datumproxy.net."
> ```

> [!WARNING]
>
> `TARGET` must include a trailing dot. Without it, the value will be treated as a relative name and DNS resolution will fail.

***

### Step 2: Create the DNS zone

> [tab] macOS / Linux
>
> ```bash theme={null}
> cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
> apiVersion: dns.networking.miloapis.com/v1alpha1
> kind: DNSZone
> metadata:
>   name: $ZONE
>   namespace: $NAMESPACE
> spec:
>   dnsZoneClassName: datum-external-global-dns
>   domainName: $DOMAIN
> EOF
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> @"
> apiVersion: dns.networking.miloapis.com/v1alpha1
> kind: DNSZone
> metadata:
>   name: $ZONE
>   namespace: $NAMESPACE
> spec:
>   dnsZoneClassName: datum-external-global-dns
>   domainName: $DOMAIN
> "@ | datumctl apply -f - --project $PROJECT --validate=false
> ```

> [!NOTE]
>
> `--validate=false` disables client-side schema validation. It is required here because `datumctl` does not bundle schemas for DNS API types locally.

Verify the zone is accepted and programmed:

```bash theme={null}
datumctl get dnszones --project $PROJECT --namespace $NAMESPACE
```

Wait until both `ACCEPTED` and `PROGRAMMED` show `True` before proceeding.

***

### Step 3: Create the apex ALIAS record

Points the root domain (`@`) at the Application Load Balancer endpoint.

> [tab] macOS / Linux
>
> ```bash theme={null}
> cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
> apiVersion: dns.networking.miloapis.com/v1alpha1
> kind: DNSRecordSet
> metadata:
>   name: ${ZONE}-apex
>   namespace: $NAMESPACE
> spec:
>   dnsZoneRef:
>     name: $ZONE
>   recordType: ALIAS
>   records:
>     - name: "@"
>       ttl: 300
>       alias:
>         content: $TARGET
> EOF
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> @"
> apiVersion: dns.networking.miloapis.com/v1alpha1
> kind: DNSRecordSet
> metadata:
>   name: ${ZONE}-apex
>   namespace: $NAMESPACE
> spec:
>   dnsZoneRef:
>     name: $ZONE
>   recordType: ALIAS
>   records:
>     - name: "@"
>       ttl: 300
>       alias:
>         content: $TARGET
> "@ | datumctl apply -f - --project $PROJECT --validate=false
> ```

***

### Step 4: Create a subdomain CNAME

Points a subdomain (e.g., `app.your-domain.example.com`) at the same endpoint.

> [tab] macOS / Linux
>
> ```bash theme={null}
> cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
> apiVersion: dns.networking.miloapis.com/v1alpha1
> kind: DNSRecordSet
> metadata:
>   name: ${ZONE}-app-cname
>   namespace: $NAMESPACE
> spec:
>   dnsZoneRef:
>     name: $ZONE
>   recordType: CNAME
>   records:
>     - name: "app"
>       ttl: 300
>       cname:
>         content: $TARGET
> EOF
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> @"
> apiVersion: dns.networking.miloapis.com/v1alpha1
> kind: DNSRecordSet
> metadata:
>   name: ${ZONE}-app-cname
>   namespace: $NAMESPACE
> spec:
>   dnsZoneRef:
>     name: $ZONE
>   recordType: CNAME
>   records:
>     - name: "app"
>       ttl: 300
>       cname:
>         content: $TARGET
> "@ | datumctl apply -f - --project $PROJECT --validate=false
> ```

***

## Verification

### Check record status

```bash theme={null}
datumctl get dnsrecordsets --project $PROJECT --namespace $NAMESPACE
```

Both records should show `ACCEPTED=True` and `PROGRAMMED=True`.

***

### Check DNS resolution

> [tab] macOS / Linux
>
> ```bash theme={null}
> dig $DOMAIN
> dig app.$DOMAIN
> ```
>
> Both names should resolve to the Application Load Balancer endpoint.

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> Resolve-DnsName $DOMAIN
> Resolve-DnsName "app.$DOMAIN"
> ```

***

## Cleanup

> [tab] macOS / Linux
>
> ```bash theme={null}
> datumctl delete dnsrecordset ${ZONE}-app-cname \
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
>
> datumctl delete dnsrecordset ${ZONE}-apex \
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
>
> datumctl delete dnszone $ZONE \
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
> ```

> [tab] Windows (PowerShell)
>
> ```powershell theme={null}
> datumctl delete dnsrecordset ${ZONE}-app-cname `
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
>
> datumctl delete dnsrecordset ${ZONE}-apex `
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
>
> datumctl delete dnszone $ZONE `
>   --project $PROJECT --namespace $NAMESPACE --ignore-not-found
> ```

***

## Troubleshooting

| Symptom | Root Cause | Resolution |
| - | - | - |
| Zone stuck at `PROGRAMMED=False` | Most often the domain isn't verified yet, which also leaves the zone's records `Rejected`. Delegation doesn't cause this: Datum provisions a zone whether or not your registrar points at it | [Verify the domain](/docs/domain-dns/domains.md#verify-a-domain), then wait for the zone to be programmed |
| `nslookup` / `dig` returns NXDOMAIN | Zone not yet propagated | Wait 1–2 minutes and retry |
| ALIAS resolves to wrong address | `TARGET` missing trailing dot | Re-apply the record with a trailing dot on the target |
| Record not appearing | `--validate=false` omitted | Re-apply with `--validate=false` |

***

## Summary

* DNS zones use `kind: DNSZone` at `dns.networking.miloapis.com/v1alpha1`
* The DNS zone class is always `datum-external-global-dns` — it is platform-provided and not user-configurable
* Use `recordType: ALIAS` for the apex (`@`) and `recordType: CNAME` for subdomains
* The `TARGET` value must include a trailing dot
* All DNS apply commands require `--validate=false`
* Delete record sets before deleting the zone


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.