Neural Inverse Govern / DNS
Authoritative DNS for your domains, on name servers that need nothing outside your installation.
Public and private hosted zones, atomic change batches, routing policies with health checks, DNSSEC and records that follow your gateways and endpoints, served by Govern's own name servers.
- Zones
- Public and private
- Changes
- Atomic batches, pending until every name server serves them
- Routing
- Weighted, latency, failover, geolocation
- Signing
- DNSSEC, ECDSA P-256
- Runs
- Air-gapped, no external DNS provider
Overview
DNS answers for your domains from Govern's own name servers. The server is the only writer; name servers answer from an in-memory copy that a change feed keeps current, so queries never touch the database and keep being answered from the last copy if the database is unavailable. Every change is an atomic batch that is pending until every live name server serves it, and records can follow the addresses of Govern resources such as gateways and stream endpoints.
What it does
What DNS covers.
Zones, records, routing, health checks, signing and the tools to move and test them.
Public hosted zonesAuthoritative zones that answer anyone once your registrar delegates the domain to the zone's name servers. One account at a time may host a public name.
Private hosted zonesZones that answer only the private client networks associated with them. Within your networks your private zone wins; it never overrides another account's public zone.
Record typesA, AAAA, CNAME, MX, TXT, SRV, CAA, NS, PTR, HTTPS, SVCB and DS, with wildcards, and the apex SOA and NS kept for you.
Atomic change batchesCreates, upserts and deletes apply together or not at all, and a refused batch lists every problem. A batch is pending until every live name server serves it, usually within a second.
Routing policiesWeighted, latency by the answering name server's region, failover from primary to secondary, and geolocation by country, then continent, then a default.
Health checksHTTP, HTTPS and TCP probes every 10 or 30 seconds that move routing. Unhealthy record sets are skipped, and checks cannot target private or internal addresses on the hosted service.
ALIAS recordsApex-capable records that answer with the current addresses of a gateway, a stream endpoint, a load balancer or another record set, and follow them when they change.
DNSSECOnline signing with ECDSA P-256 and NSEC per public zone. The zone-signing key rolls every 90 days on its own; key-signing keys change only when you act.
Custom domainsPoint your own domain at a Govern resource with an ALIAS or CNAME, accepted only when the domain is verified for your account, the same verification single sign-on uses.
Zone import and exportImport a BIND zone file as one change batch and export zones in BIND format. Routing policies and ALIAS records are written as comments, so a re-import never changes answers silently.
Answer testerSee the answer a client in a given network, location and region would get, and whether a routing policy chose it.
Query metrics and statusQueries per zone and period, standard, policy and NXDOMAIN, and the health and lag of the name servers serving your region.
Name server protectionsResponse rate limiting against reflection, zone transfers only to an allowlist of secondaries, and optional DNS over TLS.
Managed rolesRead only, records editor and full access roles, and limits on zones, records per zone and health checks in service quotas.
How it works
How a record change goes live.
- ChangeAn editor saves record changes; one save is one batch.
- ValidateThe batch is checked as a whole and applied atomically, or refused with every problem.
- PropagateEach name server loads the changed zones from the change feed.
- In syncThe batch turns from pending to in sync once every live name server serves it.
- RecordThe batch and its changes are in the account's audit log.
Who uses it
Built for every role that answers for AI.
Network engineersRun zones, routing policies and health checks for public and internal names.
Platform teamsPut custom domains in front of gateways and stream endpoints with ALIAS records.
Security teamsTurn on DNSSEC, publish DS records and control who may change records.
OperatorsRun the name servers, set rate limits and transfer allowlists, and watch replica lag.
Enforced and recorded
No change without its record, no domain without a claim.
Ownership and changes are decided on the server.
Enforced
Domain verificationCustom domains for Govern resources, and public zones on the hosted service, need a domain verified for the account.
One owner per public nameOnly one account at a time may host a public name, and a private zone never overrides another account's public zone.
Atomic changesA batch with any problem changes nothing.
IsolationPrivate networks of different accounts cannot overlap, and health checks cannot probe internal addresses on the hosted service.
Recorded
Zone and record changesZone creation and deletion, every change batch with its changes, and zone file imports.
Health and signingHealth check status changes with the zones affected, DNSSEC changes and automatic key rollovers.
Platform hostnamesHostnames Govern publishes for your resources, and their retirement.
Self-hostedThe name servers are stateless replicas you deploy with your installation; they need no external DNS provider.
Air-gappedPrivate zones answer workloads in your own networks with no outside dependency.
Hosted by usZones on Neural Inverse name servers in the region that serves your account.
Get started
Set it up with the documentation.
What's next
Being built now.
These are in development and not part of the product today.
Permissions per hosted zonePolicies that grant DNS actions on one hosted zone rather than the whole account.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.