DNS is a tool, so this page is the tool.
This is the zone editor from the panel, running in your browser, with the product's real validation behind it. Add a record. Try to break it. Nothing you type here leaves the page.
- 8
- record types in the editor
- 8
- resolvers polled for propagation
- 2
- parent domains the nameservers split across
Checked against the same rules the nameserver enforces. There is no TTL box because there is none in the panel: a record follows the zone default and shows as Auto.
- Google2026081104
- Quad92026081104
- OpenDNS2026081104
- AdGuard2026081104
- NextDNS2026081104
- Umbrella2026081104
- Mullvad2026081104
- DNS.SB2026081104
The check does not ask whether a record looks right. It reads the SOA serial from eight public resolvers and compares them, so a resolver still serving the old copy is visible as a number rather than a guess. A resolver that fails to answer is reported as unreachable, never counted as not propagated.
What Saved actually means here
On most panels a save is a write to a database and a hope. Ours is three steps, and the second is the one nobody does.
- 1PublishedThe record is written to the primary nameserver.
- 2Read backWe query the primary for the record we just wrote. If it is not there, the save fails and you are told. You never get a green tick for a record that did not land.
- 3NotifiedThe zone serial is bumped and the other nameservers are notified, which is what starts the propagation you can watch above.
The most useful thing an editor does is say no.
Every write goes through one validator, wired at the provider layer, so nothing can write around it: not the panel, not the API, not Kora. These are real refusals with real reasons, and you can trigger every one of them in the console above.
Mirrored from record-validity.ts in the panel, read 11 August 2026.
A @ 1.2.3.4One of eight addresses that mean somebody copied an example. Refused before it can point a live site at nothing.CNAME shop shop.northsend.coA CNAME pointing at itself. It resolves in a circle and takes the name off the internet.MX @ 203.0.113.24Mail exchangers are named, not numbered. A numeric MX is silently ignored by most senders, which is worse than an error.TXT @ v=spf1An SPF record that authorises nobody. It passes a syntax check and quietly fails your mail.TXT _dmarc v=DMARC1; p=offThere is no p=off. The only policies are none, quarantine and reject.TXT sel._domainkey v=DKIM1; p=abcA DKIM key that short is a truncated paste. Published, it breaks signing rather than enabling it.
Four nameservers, delegated through {zones} different parents.
Most providers publish four nameservers under one domain. If that one parent has a registry incident, all four go dark together and there is nothing you can do. Ours are split across two parent domains on purpose, so one registry cannot take the whole set with it.
Check it yourself: dig NS northsend.co
- ns1.kapsulecloud.comkapsulecloud.com
- ns2.kapsulecloud.comkapsulecloud.com
- ns3.kapsuledns.comkapsuledns.com
- ns4.kapsuledns.comkapsuledns.com
The records for a mail provider, in one action.
Ask Kora to apply a template and it writes the whole set: the exchangers, the sender policy, the DMARC record and the autodiscover names. It shows you the exact records first and asks you to confirm in writing before it touches the zone.
- An external mail provider, with its exchangers, SPF, DMARC and autodiscover records
- Kapsule Mail, which is also written for you automatically when a mailbox is created
- Web only: an address record and a www alias, with no mail records at all
Templates are applied through Kora rather than a button in the zone editor. That is where they live today, and saying otherwise would send you looking for a control that is not there.
Premium DNS, US$11 a month per zone
A second origin, health checked, removed from answers on its own when it stops responding and put back when it recovers. Everything on this page is included with a domain and stays free.
What Premium DNS adds