DNS: Delegated Domains

Delegated Domains

Delegated domains allow you to register DNS zones that this Nexus GSLB cluster is authoritative for. Once a domain is delegated, the cluster serves authoritative DNS responses for that zone — including DNSSEC-signed responses if DNSSEC is enabled.

Delegation is verified by checking that the zone's NS records point at the cluster's own nameserver(s) and, optionally, that a DS record is present in the parent zone.

Model

Field	Type	Description
`id`	string	UUID assigned on creation
`domain`	string	Fully-qualified domain name (trailing dot optional)
`verified`	bool	`true` if NS verification has passed
`nsOk`	bool	`true` if NS records point to this cluster
`dsOk`	bool	`true` if DS record is present in parent zone
`lastVerifiedAt`	int64?	Unix timestamp of last successful verification
`verificationError`	string	Last verification error, if any
`createdAt`	int64	Unix timestamp of creation

APIList delegated domains

GET /api/v1/domains

Response 200 OK: array of DelegatedDomain objects.

[  {    "id": "abc123...",    "domain": "gslb.example.com.",    "verified": true,    "nsOk": true,    "dsOk": false,    "lastVerifiedAt": 1716100000,    "createdAt": 1716090000  }]

Create a delegated domain

POST /api/v1/domains

Field	Type	Required	Description
`domain`	string	yes	Domain to delegate (e.g. `gslb.example.com`)

Response 201 Created: the created DelegatedDomain object.

curl -X POST https://nexus-api.example.com/api/v1/domains \  -H "Authorization: Bearer $GSLB_API_KEY" \  -H "Content-Type: application/json" \  -d '{"domain":"gslb.example.com"}'

Verify a delegated domain

POST /api/v1/domains/{id}/verify

Triggers an immediate NS and DS check. Returns the updated DelegatedDomain.

curl -X POST https://nexus-api.example.com/api/v1/domains/$DOMAIN_ID/verify \  -H "Authorization: Bearer $GSLB_API_KEY"

Delete a delegated domain

DELETE /api/v1/domains/{id}

Response 204 No Content.

gslbctl

# List delegated domainsgslbctl domains list --server https://nexus.example.com:8880# Add a domaingslbctl domains add gslb.example.com --server https://nexus.example.com:8880# Verify a domain (triggers NS/DS check)gslbctl domains verify <domain-id> --server https://nexus.example.com:8880# Delete a domaingslbctl domains delete <domain-id> --server https://nexus.example.com:8880

Terraform

resource "nexus_domain" "gslb" {
  domain = "gslb.example.com"
}

Attribute	Type	Required	Description
`domain`	string	yes	Domain to delegate

Setting Up Delegation

Add the domain via WebUI (Admin → Domains → Add Domain), API, or gslbctl.
Update your registrar to point the zone's NS records to the Nexus cluster's nameserver IPs.
Trigger verification — the cluster checks that NS records resolve to itself.
Optional DNSSEC: once verified, enable DNSSEC signing via Admin → DNSSEC and add the DS record to the parent zone.

Verification runs automatically on a background interval. nsOk and dsOk reflect the most recent check.

Notes

Domains are per-tenant. Different tenants can manage different zones on the same cluster.
A domain conflict (same FQDN registered by two tenants) is rejected with a 409 Conflict.
Trailing dot is normalised — gslb.example.com and gslb.example.com. are treated as identical.