> ## Documentation Index
> Fetch the complete documentation index at: https://www.datum.net/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Agent home for Datum, with what it is, pricing, and how to act: https://agents.datum.net
> If you can only fetch URLs: read https://www.datum.net/docs/llms.txt in full and open the most specific page for the task. Commands, limits, and field paths are on task, operations, and limits pages, not on section overviews. Pages described as "Documentation is coming soon" are placeholders.
> If you have a shell or can save files: download https://www.datum.net/docs/llms-full.txt (every page, about 740 KB) once and search it with grep, instead of fetching pages one at a time.
> datumctl describes itself: `datumctl api-resources` lists resource types and `datumctl explain <resource>` shows a schema. To act on live resources, use Datum MCP or datumctl. To search the docs, use the Docs MCP server at https://www.datum.net/docs/mcp.

# Private DNS

> Resolve private service and resource names within a Datum VPC.

Private DNS gives resources in a Datum VPC names that resolve only from that
VPC. It provides a consistent discovery layer for private addresses without
requiring every product or workload to run its own DNS server.

> [!NOTE]
>
> Private DNS is under active development. Availability and supported service
> integrations may vary while the feature is in preview.

## What you can do

With Private DNS, you can:

* **Reach resources by name:** Use DNS names instead of private IP addresses
  that may change over a resource's lifetime.
* **Use automatic service names:** Integrated Datum services publish names for
  resources such as Compute instances.
* **Create private namespaces:** Organize internal applications under private
  zones that are available only to associated VPCs.
* **Reuse internal names safely:** Different VPCs can use the same names and
  overlapping private addresses without exposing answers to each other.
* **Keep records aligned with resources:** Service-managed records update or
  disappear as their resources and addresses change.

Applications use ordinary DNS lookups. When they run in an associated VPC,
private names resolve alongside public names without application-specific
resolver configuration.

## Private and public DNS

Datum offers two complementary DNS capabilities:

| Capability | Where names resolve | Typical use |
| - | - | - |
| [Authoritative DNS](https://www.datum.net/docs/domain-dns/dns.md) | The public internet | Websites, public APIs, email, and domain records |
| Private DNS | Inside an associated VPC | Private instances, internal services, and service discovery |

Private DNS records are not published to the public DNS. Creating a private
name does not make a resource reachable from the internet or grant network
access to it.

## Names and zones

Each VPC receives a managed DNS suffix for automatic service names. You can
also associate private zones with a VPC for organization-specific names.

* **Managed names:** Datum services publish predictable names beneath the VPC's
  managed suffix.
* **Private zones:** Your internal names are visible only from the VPCs with
  which the zone is associated.

The complete service-managed name includes the VPC's allocated suffix. Use the
name reported by the service instead of constructing it in application code.

## Service integrations

The resource name, published record types, and eligibility rules are defined by
the service that owns the resource.

> [card] [Compute](https://www.datum.net/docs/compute/private-dns.md)
>
> Learn how Compute publishes stable private names for instance addresses.

Additional Datum services will be documented here as Private DNS integrations
become available.

## What Private DNS does not do

* **Provide public discovery:** Private names are not available through public
  DNS.
* **Grant network access:** Routing and access policy still determine whether a
  client can reach the returned address.
* **Replace application health checks:** A name can resolve while the
  application itself is unavailable.
* **Remove cached answers immediately:** Clients may retain an older answer
  until its DNS TTL expires.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.