Point a domain at a load balancer

When Datum hosts your domain’s DNS, you can point the domain at an Application Load Balancer with two records:

An ALIAS record at the apex, example.com. A CNAME isn’t allowed at the apex, so Datum answers ALIAS queries with the load balancer’s current addresses. See ALIAS.
A CNAME record for each subdomain, such as www.example.com.

Both point at the load balancer’s generated hostname, such as famous-tree-abc12.datumproxy.net. To serve traffic for your domain, the load balancer also needs the domain as a custom hostname.

If your DNS is hosted somewhere else, you don’t need anything on this page. Create a CNAME to the load balancer’s generated hostname at your own DNS provider.

Point a domain with datumctl dns

The quickest way is the datumctl dns plugin. To install it, run datumctl plugin install dns.

Find the load balancer's hostname

datumctl alb describe ALB_NAME

The Default hostname line shows the generated hostname.

Create the zone, if you haven't already

datumctl dns zone create example.com

Then point your domain at Datum’s nameservers. See Point your domain at Datum.

Add the records

datumctl dns record set example.com @   ALIAS GENERATED_HOSTNAME.
datumctl dns record set example.com www CNAME GENERATED_HOSTNAME.

Replace GENERATED_HOSTNAME with the load balancer’s hostname, and keep the trailing dot.

Check that it works

datumctl dns record list example.com --type ALIAS,CNAME
dig +short www.example.com @ns1.datumdomains.net
curl -sI https://www.example.com/

The records are live when their status is Programmed.

Point a domain with manifests

The rest of this page creates the same zone and records with DNSZone and DNSRecordSet manifests, using datumctl apply.

Prerequisites

datumctl installed and authenticated
A valid Project
Domain delegated to Datum nameservers

Configuration steps

Step 1: Set Variables

The TARGET value is your Application Load Balancer endpoint hostname. Find it in the Datum portal under your Application Load Balancer’s generated hostname, or via:

datumctl get httpproxy <name> --namespace default -o yaml

macOS / Linux
Windows (PowerShell)

PROJECT="your-project-id"
NAMESPACE="default"
ZONE="your-zone-name"
DOMAIN="your-domain.example.com"
TARGET="your-endpoint.datumproxy.net."

$PROJECT   = "your-project-id"
$NAMESPACE = "default"
$ZONE      = "your-zone-name"
$DOMAIN    = "your-domain.example.com"
$TARGET    = "your-endpoint.datumproxy.net."

TARGET must include a trailing dot. Without it, the value will be treated as a relative name and DNS resolution will fail.

Step 2: Create the DNS Zone

macOS / Linux
Windows (PowerShell)

cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSZone
metadata:
  name: $ZONE
  namespace: $NAMESPACE
spec:
  dnsZoneClassName: datum-external-global-dns
  domainName: $DOMAIN
EOF

@"
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSZone
metadata:
  name: $ZONE
  namespace: $NAMESPACE
spec:
  dnsZoneClassName: datum-external-global-dns
  domainName: $DOMAIN
"@ | datumctl apply -f - --project $PROJECT --validate=false

--validate=false disables client-side schema validation. It is required here because datumctl does not bundle schemas for DNS API types locally.

Verify the zone is accepted and programmed:

datumctl get dnszones --project $PROJECT --namespace $NAMESPACE

Wait until both ACCEPTED and PROGRAMMED show True before proceeding.

Step 3: Create the Apex ALIAS Record

Points the root domain (@) at the Application Load Balancer endpoint.

macOS / Linux
Windows (PowerShell)

cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-apex
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: ALIAS
  records:
    - name: "@"
      ttl: 300
      alias:
        content: $TARGET
EOF

@"
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-apex
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: ALIAS
  records:
    - name: "@"
      ttl: 300
      alias:
        content: $TARGET
"@ | datumctl apply -f - --project $PROJECT --validate=false

Step 4: Create a Subdomain CNAME

Points a subdomain (e.g., app.your-domain.example.com) at the same endpoint.

macOS / Linux
Windows (PowerShell)

cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-app-cname
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: CNAME
  records:
    - name: "app"
      ttl: 300
      cname:
        content: $TARGET
EOF

@"
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-app-cname
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: CNAME
  records:
    - name: "app"
      ttl: 300
      cname:
        content: $TARGET
"@ | datumctl apply -f - --project $PROJECT --validate=false

Verification

Check Record Status

datumctl get dnsrecordsets --project $PROJECT --namespace $NAMESPACE

Both records should show ACCEPTED=True and PROGRAMMED=True.

Check DNS Resolution

macOS / Linux
Windows (PowerShell)

dig $DOMAIN
dig app.$DOMAIN

Both names should resolve to the Application Load Balancer endpoint.

Resolve-DnsName $DOMAIN
Resolve-DnsName "app.$DOMAIN"

Cleanup

macOS / Linux
Windows (PowerShell)

datumctl delete dnsrecordset ${ZONE}-app-cname \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnsrecordset ${ZONE}-apex \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnszone $ZONE \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnsrecordset ${ZONE}-app-cname `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnsrecordset ${ZONE}-apex `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnszone $ZONE `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

Troubleshooting

Symptom	Root Cause	Resolution
Zone stuck at `PROGRAMMED=False`	Domain not delegated to Datum nameservers	Update nameservers at your registrar
`nslookup` / `dig` returns NXDOMAIN	Zone not yet propagated	Wait 1–2 minutes and retry
ALIAS resolves to wrong address	`TARGET` missing trailing dot	Re-apply the record with a trailing dot on the target
Record not appearing	`--validate=false` omitted	Re-apply with `--validate=false`

Summary

DNS zones use kind: DNSZone at dns.networking.miloapis.com/v1alpha1
The DNS zone class is always datum-external-global-dns — it is platform-provided and not user-configurable
Use recordType: ALIAS for the apex (@) and recordType: CNAME for subdomains
The TARGET value must include a trailing dot
All DNS apply commands require --validate=false
Delete record sets before deleting the zone

Introduction

Explore

Point a domain at a load balancer

Point a domain with datumctl dns

Point a domain with manifests

Prerequisites

Configuration steps

Step 1: Set Variables

Step 2: Create the DNS Zone

Step 3: Create the Apex ALIAS Record

Step 4: Create a Subdomain CNAME

Verification

Check Record Status

Check DNS Resolution

Cleanup

Troubleshooting

Summary

​Point a domain with datumctl dns

​Point a domain with manifests

​Prerequisites

​Configuration steps

​Step 1: Set Variables

​Step 2: Create the DNS Zone

​Step 3: Create the Apex ALIAS Record

​Step 4: Create a Subdomain CNAME

​Verification

​Check Record Status

​Check DNS Resolution

​Cleanup

​Troubleshooting

​Summary

Point a domain with datumctl dns

Point a domain with manifests

Prerequisites

Configuration steps

Step 1: Set Variables

Step 2: Create the DNS Zone

Step 3: Create the Apex ALIAS Record

Step 4: Create a Subdomain CNAME

Verification

Check Record Status

Check DNS Resolution

Cleanup

Troubleshooting

Summary