Skip to content
RedundantDNS
Menu

Connect OCI DNS

RedundantDNS talks to Oracle Cloud Infrastructure DNS with an API signing key of an OCI user. The private key is encrypted with your organization's key as soon as it reaches us, is never shown again, and is only used to read and write the DNS zones you attach.

Pick the access level that matches how much you want to delegate:

Access levelWhat RedundantDNS can do
Create and manage zonesCreate zones in one compartment, write their records and apex NS, and delete a zone when you detach it (only after you type the zone name).
Manage an existing zoneRead and edit the records of one zone that you created. It never creates or deletes zones.

1. Create a user, a group and an API key

  1. Identity & Security → Domains → (your domain) → Groups → Create group, for example redundantdns.
  2. Users → Create user (for example redundantdns) and add it to the group. It does not need a console password.
  3. Open the user, API keys → Add API key → Generate API key pair, download the private key (.pem) and click Add. The console then shows a configuration preview with the values you need:
    • user: the user OCID (ocid1.user.oc1..…)
    • fingerprint: the key fingerprint (12:34:…)
    • tenancy: the tenancy OCID (ocid1.tenancy.oc1..…)
    • region: the region identifier (for example sa-saopaulo-1)
  4. The compartment OCID is under Identity & Security → Compartments (click the compartment, then Copy next to OCID). Use the compartment where your DNS zones live; the root compartment's OCID is the tenancy OCID.

2a. Create and manage zones

Create a policy in the compartment (Identity & Security → Policies → Create policy, in that compartment or a parent), replacing the names:

Allow group redundantdns to manage dns in compartment <compartment-name>

In RedundantDNS, Providers → Add connection: provider OCI DNS, access level Create and manage zones, fill in tenancy OCID, user OCID, fingerprint, the private key (paste the whole PEM, including the BEGIN and END lines), region and compartment OCID, then click Test and save. We check the key by listing the zones in the compartment.

2b. Manage an existing zone

Use this when you already created the zone (a public, primary zone) and want to grant access to that zone only. Copy its zone OCID from Networking → DNS management → Zones, then create this policy, replacing the names and the OCID:

Allow group redundantdns to use dns in compartment <compartment-name> where target.dns-zone.id = '<zone OCID>'

use dns lets the group read the zone and update its records; it cannot create or delete zones. Add the connection with access level Manage an existing zone. The key is checked when you attach it to a zone: open the zone, Providers → Attach, pick the connection and paste the zone OCID. We verify that the zone holds the same domain and that the key can read its records.

What RedundantDNS writes

  • Every record set you manage in the dashboard (one update per record set, idempotent).
  • The apex NS record set: RedundantDNS rewrites it to list the nameservers of every attached provider, so each copy of the zone delegates to all of them. It is shown read-only in the dashboard.
  • It never touches the SOA record.

Revoking access

Delete the API key (or the user, or the policy) in OCI at any time. Then remove the connection in Providers; zones keep being served by OCI exactly as they are.