> ## Documentation Index
> Fetch the complete documentation index at: https://datum.net/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Point a domain at a load balancer

> Use Datum DNS to point your domain, and its subdomains, at an Application Load Balancer with an apex ALIAS record and a CNAME.

When Datum hosts your domain's DNS, you can point the domain at an [Application Load Balancer](https://datum.net/docs/alb/overview.md) with two records:

* An `ALIAS` record at the apex, `example.com`. A `CNAME` isn't allowed at the apex, so Datum answers `ALIAS` queries with the load balancer's current addresses. See [ALIAS](https://datum.net/docs/domain-dns/dns.md#alias-/-cname-flattening).
* A `CNAME` record for each subdomain, such as `www.example.com`.

Both point at the load balancer's generated hostname, such as `famous-tree-abc12.datumproxy.net`. To serve traffic for your domain, the load balancer also needs the domain as a [custom hostname](https://datum.net/docs/alb/operations/custom-domains.md).

> [!NOTE]
>
> If your DNS is hosted somewhere else, you don't need anything on this page. Create a `CNAME` to the load balancer's generated hostname at your own DNS provider.

## Point a domain with datumctl dns

The quickest way is the `datumctl dns` plugin. To install it, run `datumctl plugin install dns`.

**1. Find the load balancer's hostname**

```bash theme={null}
datumctl alb describe ALB_NAME
```

The `Default hostname` line shows the generated hostname.

**2. Create the zone, if you haven't already**

```bash theme={null}
datumctl dns zone create example.com
```

Then point your domain at Datum's nameservers. See [Point your domain at Datum](https://datum.net/docs/domain-dns/operations.md#point-your-domain-at-datum).

**3. Add the records**

```bash theme={null}
datumctl dns record set example.com @   ALIAS GENERATED_HOSTNAME.
datumctl dns record set example.com www CNAME GENERATED_HOSTNAME.
```

Replace `GENERATED_HOSTNAME` with the load balancer's hostname, and keep the trailing dot.

**4. Check that it works**

```bash theme={null}
datumctl dns record list example.com --type ALIAS,CNAME
dig +short www.example.com @ns1.datumdomains.net
curl -sI https://www.example.com/
```

The records are live when their status is `Programmed`.

## Point a domain with manifests

The rest of this page creates the same zone and records with `DNSZone` and `DNSRecordSet` manifests, using `datumctl apply`.

### Prerequisites

* `datumctl` installed and authenticated
* A valid **Project**
* Domain delegated to Datum nameservers

***

### Configuration steps

### Step 1: Set Variables

The `TARGET` value is your Application Load Balancer endpoint hostname. Find it in the Datum portal under your Application Load Balancer's generated hostname, or via:

```bash theme={null}
datumctl get httpproxy <name> --namespace default -o yaml
```

**macOS / Linux**

```bash theme={null}
PROJECT="your-project-id"
NAMESPACE="default"
ZONE="your-zone-name"
DOMAIN="your-domain.example.com"
TARGET="your-endpoint.datumproxy.net."
```

**Windows (PowerShell)**

```powershell theme={null}
$PROJECT   = "your-project-id"
$NAMESPACE = "default"
$ZONE      = "your-zone-name"
$DOMAIN    = "your-domain.example.com"
$TARGET    = "your-endpoint.datumproxy.net."
```

> [!WARNING]
>
> `TARGET` must include a trailing dot. Without it, the value will be treated as a relative name and DNS resolution will fail.

***

### Step 2: Create the DNS Zone

**macOS / Linux**

```bash theme={null}
cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSZone
metadata:
  name: $ZONE
  namespace: $NAMESPACE
spec:
  dnsZoneClassName: datum-external-global-dns
  domainName: $DOMAIN
EOF
```

**Windows (PowerShell)**

```powershell theme={null}
@"
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSZone
metadata:
  name: $ZONE
  namespace: $NAMESPACE
spec:
  dnsZoneClassName: datum-external-global-dns
  domainName: $DOMAIN
"@ | datumctl apply -f - --project $PROJECT --validate=false
```

> [!NOTE]
>
> `--validate=false` disables client-side schema validation. It is required here because `datumctl` does not bundle schemas for DNS API types locally.

Verify the zone is accepted and programmed:

```bash theme={null}
datumctl get dnszones --project $PROJECT --namespace $NAMESPACE
```

Wait until both `ACCEPTED` and `PROGRAMMED` show `True` before proceeding.

***

### Step 3: Create the Apex ALIAS Record

Points the root domain (`@`) at the Application Load Balancer endpoint.

**macOS / Linux**

```bash theme={null}
cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-apex
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: ALIAS
  records:
    - name: "@"
      ttl: 300
      alias:
        content: $TARGET
EOF
```

**Windows (PowerShell)**

```powershell theme={null}
@"
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-apex
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: ALIAS
  records:
    - name: "@"
      ttl: 300
      alias:
        content: $TARGET
"@ | datumctl apply -f - --project $PROJECT --validate=false
```

***

### Step 4: Create a Subdomain CNAME

Points a subdomain (e.g., `app.your-domain.example.com`) at the same endpoint.

**macOS / Linux**

```bash theme={null}
cat <<EOF | datumctl apply -f - --project $PROJECT --validate=false
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-app-cname
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: CNAME
  records:
    - name: "app"
      ttl: 300
      cname:
        content: $TARGET
EOF
```

**Windows (PowerShell)**

```powershell theme={null}
@"
apiVersion: dns.networking.miloapis.com/v1alpha1
kind: DNSRecordSet
metadata:
  name: ${ZONE}-app-cname
  namespace: $NAMESPACE
spec:
  dnsZoneRef:
    name: $ZONE
  recordType: CNAME
  records:
    - name: "app"
      ttl: 300
      cname:
        content: $TARGET
"@ | datumctl apply -f - --project $PROJECT --validate=false
```

***

## Verification

### Check Record Status

```bash theme={null}
datumctl get dnsrecordsets --project $PROJECT --namespace $NAMESPACE
```

Both records should show `ACCEPTED=True` and `PROGRAMMED=True`.

***

### Check DNS Resolution

**macOS / Linux**

```bash theme={null}
dig $DOMAIN
dig app.$DOMAIN
```

Both names should resolve to the Application Load Balancer endpoint.

**Windows (PowerShell)**

```powershell theme={null}
Resolve-DnsName $DOMAIN
Resolve-DnsName "app.$DOMAIN"
```

***

## Cleanup

**macOS / Linux**

```bash theme={null}
datumctl delete dnsrecordset ${ZONE}-app-cname \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnsrecordset ${ZONE}-apex \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnszone $ZONE \
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found
```

**Windows (PowerShell)**

```powershell theme={null}
datumctl delete dnsrecordset ${ZONE}-app-cname `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnsrecordset ${ZONE}-apex `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found

datumctl delete dnszone $ZONE `
  --project $PROJECT --namespace $NAMESPACE --ignore-not-found
```

***

## Troubleshooting

| Symptom | Root Cause | Resolution |
| - | - | - |
| Zone stuck at `PROGRAMMED=False` | Domain not delegated to Datum nameservers | Update nameservers at your registrar |
| `nslookup` / `dig` returns NXDOMAIN | Zone not yet propagated | Wait 1–2 minutes and retry |
| ALIAS resolves to wrong address | `TARGET` missing trailing dot | Re-apply the record with a trailing dot on the target |
| Record not appearing | `--validate=false` omitted | Re-apply with `--validate=false` |

***

## Summary

* DNS zones use `kind: DNSZone` at `dns.networking.miloapis.com/v1alpha1`
* The DNS zone class is always `datum-external-global-dns` — it is platform-provided and not user-configurable
* Use `recordType: ALIAS` for the apex (`@`) and `recordType: CNAME` for subdomains
* The `TARGET` value must include a trailing dot
* All DNS apply commands require `--validate=false`
* Delete record sets before deleting the zone


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.