DNS & traffic steering (SS-25 DNS)

What it does

DNS & traffic steering

SS-25 is authoritative DNS with a full DNSSEC lifecycle and geography- plus health-based traffic steering. Author zones and RRsets, run the DNSSEC ceremony and rotate ZSKs, publish atomically, resolve with a geo/health-aware answer, and report a target's health so the answer steers away from a failing PoP. When origin is in trouble, serve-stale keeps names resolving.

Sub-capabilities

The real surface, grouped.

Zones & records

Create zones, add records, and replace RRsets atomically with a PUT — the authoritative source for every name the edge steers.

DNSSEC lifecycle

Initialise DNSSEC, run the signing ceremony, and rotate the zone-signing key — a full signed-zone lifecycle, not a checkbox.

Health-based steering

Post a target's health and read a zone's geo/health-aware answer; unhealthy targets drop out of the answer so traffic steers to the nearest healthy PoP.

Atomic publish & serve-stale

Publish a zone atomically; the resolver serves stale (expired) answers at 99.999% availability so names keep resolving through an origin or control-plane incident.

Distribution control & SLO

Halt and resume zone distribution for controlled rollouts, and read the DNS SLO — the availability contract the serve-stale guarantee backs.

Endpoints

Real method + path — SS-25 DNS.

A representative slice of the 14 operations on SS-25. Base: https://api.edge.nexocloud.io/api/v1. Auth is an SS-01 bearer token plus X-Tenant-Id.

GET/api/v1/zonesList zones.

POST/api/v1/zonesCreate a zone.

POST/api/v1/zones/{zone}/recordsAdd a record to a zone.

PUT/api/v1/zones/{zone}/rrsetsReplace a zone's RRsets atomically.

POST/api/v1/zones/{zone}/dnssec/initInitialise DNSSEC for a zone.

POST/api/v1/zones/{zone}/dnssec/ceremonyRun the DNSSEC signing ceremony.

POST/api/v1/zones/{zone}/dnssec/rotate-zskRotate the zone-signing key.

POST/api/v1/zones/{zone}/publishPublish a zone atomically.

GET/api/v1/zones/{zone}/resolveResolve a name (geo/health-aware).

GET/api/v1/zones/{zone}/answerGet the computed steering answer.

POST/api/v1/health/{target}Report a target's health for steering.

POST/api/v1/distribution/haltHalt zone distribution.

POST/api/v1/distribution/resumeResume zone distribution.

GET/api/v1/sloRead the DNS SLO.

Full endpoint catalog →

Worked example

Sign a zone and steer by health

Author a zone, sign it with DNSSEC, publish atomically, then let a failing target drop out of the answer.

SS-25 DNS · bash

# 1. Create a zone and its records
curl -X POST "$BASE/zones" -H "$AUTH" -H "$TENANT" \
  -d '{"name":"acme.io"}'
curl -X PUT "$BASE/zones/acme.io/rrsets" -H "$AUTH" -H "$TENANT" \
  -d '{"name":"cdn","type":"A","ttl":60,"records":["203.0.113.10","203.0.113.20"]}'

# 2. Full DNSSEC lifecycle: init → ceremony → publish
curl -X POST "$BASE/zones/acme.io/dnssec/init"     -H "$AUTH" -H "$TENANT"
curl -X POST "$BASE/zones/acme.io/dnssec/ceremony" -H "$AUTH" -H "$TENANT"
curl -X POST "$BASE/zones/acme.io/publish"         -H "$AUTH" -H "$TENANT"

# 3. A PoP goes unhealthy — report it; the answer steers away
curl -X POST "$BASE/health/203.0.113.20" -H "$AUTH" -H "$TENANT" \
  -d '{"status":"down"}'
curl "$BASE/zones/acme.io/answer?name=cdn.acme.io" -H "$AUTH" -H "$TENANT"
#  → { "answer": ["203.0.113.10"], "served_stale": false }  # .20 dropped out

The answer is computed from geography and live health. Through an origin incident, the resolver falls back to serve-stale (99.999%) so the name keeps resolving instead of NXDOMAIN.

Architecture placement