Authoritative DNS now in Early Access

Teams running workloads on Thalassa Cloud still had to host DNS with a separate provider. For organisations that use Thalassa for European data sovereignty, that left domain records outside the platform.

We heard from several customers that they prefer managing infrastructure and DNS through a single vendor: the same console, API, and audit trail they already use for VMs, Kubernetes, and load balancers, rather than maintaining zones at a third-party DNS service.

So, we are happy to introduce Thalassa DNS Service; our Authorative DNS service for managing Zones on our Cloud. Thalassa Cloud DNS adds authoritative DNS hosting on Thalassa’s regional nameservers. You can create and manage zones through the console, API, or Terraform, use external-dns with Kubernetes, import BIND zone files, and optionally enable DNSSEC signing. DNS records are stored on European infrastructure and covered by the same IAM and audit logging as our other platform services.

DNS is now in Early Access. General availability is planned for later in 2026.

Authoritative DNS on Thalassa Cloud

Thalassa Cloud DNS is authoritative DNS hosting for domains you run on the platform. Create zones, manage records through the console or API with Terraform, Kubernetes (external-dns project). Import existing BIND zone files, export for backup, and optionally enable DNSSEC signing backed by KMS.

Record types and zone management

Support for standard record types: A, AAAA, CNAME, NS, MX, TXT, CAA, and SRV. Wildcard and apex records (@, *) and service records (_acme-challenge, _sip._tcp, etc.) are supported. SOA serial numbers and regional nameserver injection are managed by the platform.

Migrate with BIND import/export

Moving from another provider? Import an existing BIND zone file and choose to merge or replace records. Export zones for backup or offline editing. This makes cutover planning straightforward: prepare the zone in Thalassa Cloud, validate records, then update delegation at your registrar.

DNSSEC with KMS

DNSSEC on Thalassa Cloud uses KMS asymmetric keys to sign zones before publication. Enable signing in the console, add DS records at your registrar and everything is automatically published, signed with DNSSEC.

Signing supports ECDSA or RSA KMS keys, with NSEC3 for authenticated denial of existence and DS records for parent delegation. Through the KMS integration you can auto-provision signing keys.

Get started

1. Open DNS in the Thalassa Cloud console
2. Create a zone for your domain and add records — or import a BIND zone file
3. Update NS delegation at your registrar to Thalassa’s nameservers (ns1.thalassa.cloud, ns2.thalassa.cloud).
4. Optionally enable DNSSEC and add DS records at your registrar

Learn more on the DNS product page or in the DNS documentation.