Forward and reverse zones
Host your domains and your address space side by side. Enter a network in CIDR form and the reverse zone name is worked out for you, for IPv4 and IPv6.
203.0.113.0/24113.0.203.in-addr.arpa
Know exactly what your DNS will answer.
DNS Aman hosts your domains on two authoritative nameservers and gives your team one workspace for records, reverse zones, reviews and API access. Every record is checked before it is published.
Accounts are created with an invitation code. How access works
Everything DNS.
One clear workspace.
The record editor tells you what will be published before you press save. Here is what each part of it does.
Add record
Names are relative to example.com. Saving publishes the change to every nameserver immediately.
A form for each record type
Priority, weight, port, CAA tag: each type asks for its own fields, so nobody hand-formats a record string.
TypeA
Nameapp.example.com
IPv4 address192.0.2.20
TTL5 minutes300
Checked on the server
Every field is validated before anything is written, and a record that would break the zone is refused with a message that says why.
Proxy
DNS onlyResolves directly to the address above.
ProxiedResolves to the DNS Aman proxy network instead; the address above stays out of public DNS.
Keep an origin out of DNS answers
A proxied A or AAAA record answers with DNS Aman's proxy-edge addresses instead of your server's. It is not a CDN or a firewall, and an origin can still be found by other means.
Will publish as
app.example.com300A192.0.2.20DNS Aman edge address
The answer, before you save
The exact name, TTL, type and value resolvers will receive, updated as you type.
CancelAdd and publishSave and publish
borobudur
prambanan
Published to 2 nameservers
Saved means published
Each save goes out to both authoritative nameservers at once, and lands in the zone's activity history. Need a second pair of eyes? With review before publish, saves are staged for a DNS admin instead.
The work DNS actually involves.
Moving a domain, delegating a subdomain, filling a /24 with PTR records, letting a script update one name. Each of these has a direct path.
Import what you have
Bring existing records in with a zone transfer where your current provider allows it, or a scan of common names. Generate PTR records in bulk for reverse zones, and export the published zone file at any time.
Review before publish
Turn it on per zone. Edits are staged, an admin sees every add, edit and delete as a diff, and publishes them as one change.
- Pending addapiA192.0.2.30
- Pending edit@MX10 mx2.example.com
- Pending deleteoldCNAMElegacy.example.net
Delegation check
Confirms that public resolvers see your domain delegated to DNS Aman, and that every nameserver is serving the current version of the zone.
- Delegated to DNS Aman nameservers
- borobudur.ns.dnsaman.com serves the current version
- prambanan.ns.dnsaman.com serves the current version
REST API and MCP for agents
Automate with scoped API tokens over a REST API, or connect an AI agent through the MCP endpoint. Tokens never carry more access than the person who created them.
Subdomain delegation
Hand a subdomain to another team or provider with NS records. The apex NS and SOA records are managed for you, so the zone itself always points at the right nameservers.
From registrar to resolvers in three steps.
-
Add your domain
Create the zone in the console, or a reverse zone from a CIDR block. Import the records you already have so nothing goes missing.
-
Configure records
Add and adjust records with validation on every save. Compare them with your current setup before you switch anything over.
-
Point your nameservers
At your registrar, replace the nameservers with the two below. Registries and resolvers cache delegation, so the change can take hours to be seen everywhere. The delegation check tells you when it has.
Nine record types, checked before they go live.
Each type has its own form fields, so you fill in a priority or a port rather than hand-formatting a string.
| Type | Used for | Example |
|---|---|---|
| A | IPv4 address | www.example.com. 300 A 192.0.2.10 |
| AAAA | IPv6 address | www.example.com. 300 AAAA 2001:db8::10 |
| CNAME | Alias to another name | docs.example.com. 3600 CNAME pages.example.net. |
| MX | Mail delivery | example.com. 3600 MX 10 mail.example.com. |
| NS | Delegate a subdomain | lab.example.com. 3600 NS ns1.example.net. |
| TXT | Verification, SPF, policies | example.com. 3600 TXT "v=spf1 mx -all" |
| SRV | Service location | _sip._tcp.example.com. 3600 SRV 10 5 5060 sip.example.com. |
| CAA | Which CAs may issue certificates | example.com. 3600 CAA 0 issue "letsencrypt.org" |
| PTR | Reverse lookup | 10.2.0.192.in-addr.arpa. 3600 PTR host.example.com. |
Who it is for.
Developers
Script record changes with a write-scoped token limited to your build server's IP, or let an agent manage records over MCP. Set a token to expire when the project does.
Businesses
Marketing can look, IT can edit, and a DNS admin publishes. Review before publish keeps a mistyped MX record from reaching your customers.
Hosting providers
Import customer zones, keep each team's access limited to its own zones, and create or delete zones through the API when an account opens or closes.
Network operators
Run in-addr.arpa and ip6.arpa zones from a CIDR, generate PTR records in bulk, and delegate subdomains to the teams that run them.
Control where it matters.
Access is given per zone and per role, and every change leaves a record.
| Permission | DNS Admin | DNS Editor | DNS Viewer |
|---|---|---|---|
| Read records and history | |||
| Add, edit and delete records | No | ||
| Publish staged changes | No | No | |
| Import and export zones | No | No |
Two-factor sign-in
Protect accounts with a TOTP authenticator app.
Tokens with limits
Read, write or zone create and delete scopes, optional IP allowlists and expiry dates. A token never exceeds its owner's access.
History you can check
Activity history on every zone and an audit log across the platform.
Infrastructure kept apart
Nameserver and platform administration is separate from everyday DNS work and limited to platform administrators.
Accounts are by invitation.
DNS Aman accounts are created with an invitation code, issued by a DNS Aman administrator.
Need one?
Ask your DNS Aman administrator for an invitation code.
Bring your first zone over.
Import the records you have, check them, then point your nameservers.