Skip to main content
Private DNS gives resources in a Datum VPC names that resolve only from that VPC. It provides a consistent discovery layer for private addresses without requiring every product or workload to run its own DNS server.
Private DNS is under active development. Availability and supported service integrations may vary while the feature is in preview.

​
What you can do

With Private DNS, you can:
  • Reach resources by name: Use DNS names instead of private IP addresses that may change over a resource’s lifetime.
  • Use automatic service names: Integrated Datum services publish names for resources such as Compute instances.
  • Create private namespaces: Organize internal applications under private zones that are available only to associated VPCs.
  • Reuse internal names safely: Different VPCs can use the same names and overlapping private addresses without exposing answers to each other.
  • Keep records aligned with resources: Service-managed records update or disappear as their resources and addresses change.
Applications use ordinary DNS lookups. When they run in an associated VPC, private names resolve alongside public names without application-specific resolver configuration.

​
Private and public DNS

Datum offers two complementary DNS capabilities: Private DNS records are not published to the public DNS. Creating a private name does not make a resource reachable from the internet or grant network access to it.

​
Names and zones

Each VPC receives a managed DNS suffix for automatic service names. You can also associate private zones with a VPC for organization-specific names.
  • Managed names: Datum services publish predictable names beneath the VPC’s managed suffix.
  • Private zones: Your internal names are visible only from the VPCs with which the zone is associated.
The complete service-managed name includes the VPC’s allocated suffix. Use the name reported by the service instead of constructing it in application code.

​
Service integrations

The resource name, published record types, and eligibility rules are defined by the service that owns the resource.

Compute

Learn how Compute publishes stable private names for instance addresses.
Additional Datum services will be documented here as Private DNS integrations become available.

​
What Private DNS does not do

  • Provide public discovery: Private names are not available through public DNS.
  • Grant network access: Routing and access policy still determine whether a client can reach the returned address.
  • Replace application health checks: A name can resolve while the application itself is unavailable.
  • Remove cached answers immediately: Clients may retain an older answer until its DNS TTL expires.
Last modified on October 30, 2026