DNS
Premium DNS
Premium DNS upgrades a single domain's zone to anycast resolution with health-checked failover, so visitors are answered from the nearest node and a dead origin is removed from DNS automatically.
What You Already Get Without It
Worth stating first, because it changes whether you need this at all. Every domain using Kapsule nameservers already resolves from our four-node DNS cluster:
ns1.kapsulecloud.comns2.kapsulecloud.comns3.kapsuledns.comns4.kapsuledns.com
That is included, it is redundant across regions, and it is the right answer for the overwhelming majority of sites. See Nameservers and DNS Basics.
What Premium DNS Adds
Premium DNS is per zone, and it adds three things on top of standard resolution:
- Anycast. Your zone is answered from the nearest of many global points of presence rather than from a fixed set of nameservers.
- Health-checked failover. You define up to two origins per zone. Health checks run every 60 seconds, and an unhealthy origin is automatically removed from DNS answers until it recovers.
- Weighted distribution across your origins.
Premium DNS is at Store, then Email, DNS and network, then Premium DNS. The direct address is /premium-dns. Per-domain configuration lives on the domain itself, at Domains, then the domain, then Premium DNS.
What It Costs
US$11.00 per zone, per month, billed monthly. One subscription covers one domain.
Each zone includes 1,000,000 queries per month. Beyond that, overage is charged at US$0.25 per additional million queries.
Prices in KPanel are shown excluding GST. The GST-inclusive total appears only at checkout, on the pay button, and GST applies where your account currency is NZD. A price with a plus GST caption is correct, not a discrepancy.
Adding Premium DNS to a Domain
- Open
/premium-dns. - Click Get Premium DNS. The subscription is added to your cart.
- Complete checkout.
- Go to Domains, open the domain you want covered, and open its Premium DNS section.
- Click Enable Premium DNS.
- Add your origins and save.
If you already hold a Premium DNS subscription, the page header shows an Add Domain button so you can buy cover for another zone.
Enabling and editing a zone requires the domains:write permission, held by account Owners and Admins.
Origins and Failover
An origin is a place your zone can point traffic at: an IP address or a hostname. The editor asks for:
- Name. A label for the origin, for example
primaryorbackup. - Address. An IP address, or a CNAME target such as
origin.example.com. - Weight, from 1 to 100, for distributing traffic between origins.
- Health path. The path health checks request to decide whether the origin is alive.
Your plan allows up to 2 origins per zone, which is exactly the shape of a primary plus a failover backup.
Turn on Failover routing to activate the health checks. The editor states the behaviour plainly: health checks every 60 seconds, and unhealthy origins are automatically removed from DNS responses until they recover.
Point the health path at something that actually exercises your application, not at a static file. A server that returns your homepage HTML while the database is down is not healthy, but a health check hitting /favicon.ico will happily call it so.
The Query Allowance
Your Premium DNS page lists every enrolled zone with its status and a Queries this month meter showing usage against the one million included.
Open a zone and the usage card breaks it down further: the percentage of allowance used, the exact query count, and where the account is billed in New Zealand dollars, the base and overage cost split. If your account bills in another currency, the panel shows the usage without a currency conversion of the overage rate rather than showing you a converted figure it cannot guarantee.
One million queries a month is a lot for a normal site. A zone that is burning through it is usually being scraped, being probed, or has a very low TTL on a busy record.
Zone Statuses
| Status | Meaning |
|---|---|
| Pending | Enrolled, not yet built |
| Provisioning ("Setting up") | Being built on the anycast network |
| Active | Live and answering |
| Failed | Provisioning did not complete |
A zone showing Failed carries a message explaining what went wrong. If it is not self-explanatory, open a support ticket with the domain name.
Geo Steering Is Not Available Yet
The Premium DNS editor includes a geo-steering section for routing visitors from a region to a specific origin. It is marked Coming soon and it is not active: geo mappings are not applied when you save.
Your origins and automatic health-based failover are active now and serve every region. If you are evaluating Premium DNS specifically for per-region routing, that capability is not live yet.
Cancelling Premium DNS
Open the domain's Premium DNS section and use the cancel action, then confirm.
Cancelling Premium DNS removes the anycast zone and the failover configuration. Your domain keeps resolving on the standard Kapsule DNS cluster, so it does not go dark, but the automatic origin failover stops immediately. If that failover is the reason you bought it, make sure you have another answer before you cancel.
Premium DNS and DNSSEC
They are separate features and they work together. DNSSEC is available on Kapsule DNS without Premium DNS, is enabled per domain, and has its own careful disable procedure. See DNSSEC.
What If It Fails
"Premium DNS is not available yet." The catalogue plan could not be resolved for your account. Contact support rather than retrying.
The zone sits on Provisioning. Anycast zone creation is not instant. If it has not gone Active after a reasonable wait, check the message on the zone card first.
Your save is rejected. The editor validates before it writes. Common causes: no origin at all, more than two origins, two origins sharing a name, or an address that is not a valid IP or hostname. The error names the specific origin.
Geo mappings vanish after saving. Expected. Geo steering is gated as coming soon and is dropped on save. Your origins and failover setting are kept.
Traffic is not failing over. Check that Failover routing is actually switched on for the zone, and that the second origin's health path returns a healthy response when requested directly.