# DNS · Neural Inverse Govern > Public and private hosted zones, atomic change batches, routing policies with health checks, DNSSEC and records that follow your gateways and endpoints, served by Govern's own name servers. Source: https://neuralinverse.com/govern/dns/ --- ![](/photos/hangar.jpg) [Neural Inverse Govern / DNS](https://neuralinverse.com/govern/) # Authoritative DNS for your domains, on name servers that need nothing outside your installation. Public and private hosted zones, atomic change batches, routing policies with health checks, DNSSEC and records that follow your gateways and endpoints, served by Govern's own name servers. Zones Public and private Changes Atomic batches, pending until every name server serves them Routing Weighted, latency, failover, geolocation Signing DNSSEC, ECDSA P-256 Runs Air-gapped, no external DNS provider Overview DNS answers for your domains from Govern's own name servers. The server is the only writer; name servers answer from an in-memory copy that a change feed keeps current, so queries never touch the database and keep being answered from the last copy if the database is unavailable. Every change is an atomic batch that is pending until every live name server serves it, and records can follow the addresses of Govern resources such as gateways and stream endpoints. [What it does ↓](https://neuralinverse.com/#capabilities)[How it works ↓](https://neuralinverse.com/#workflow)[Enforced and recorded ↓](https://neuralinverse.com/#enforcement)[Where it runs ↓](https://neuralinverse.com/#where)[Get started ↓](https://neuralinverse.com/#get-started) What it does ## What DNS covers. Zones, records, routing, health checks, signing and the tools to move and test them. - **Public hosted zones:** Authoritative zones that answer anyone once your registrar delegates the domain to the zone's name servers. One account at a time may host a public name. - **Private hosted zones:** Zones that answer only the private client networks associated with them. Within your networks your private zone wins; it never overrides another account's public zone. - **Record types:** A, AAAA, CNAME, MX, TXT, SRV, CAA, NS, PTR, HTTPS, SVCB and DS, with wildcards, and the apex SOA and NS kept for you. - **Atomic change batches:** Creates, upserts and deletes apply together or not at all, and a refused batch lists every problem. A batch is pending until every live name server serves it, usually within a second. - **Routing policies:** Weighted, latency by the answering name server's region, failover from primary to secondary, and geolocation by country, then continent, then a default. - **Health checks:** HTTP, HTTPS and TCP probes every 10 or 30 seconds that move routing. Unhealthy record sets are skipped, and checks cannot target private or internal addresses on the hosted service. - **ALIAS records:** Apex-capable records that answer with the current addresses of a gateway, a stream endpoint, a load balancer or another record set, and follow them when they change. - **DNSSEC:** Online signing with ECDSA P-256 and NSEC per public zone. The zone-signing key rolls every 90 days on its own; key-signing keys change only when you act. - **Custom domains:** Point your own domain at a Govern resource with an ALIAS or CNAME, accepted only when the domain is verified for your account, the same verification single sign-on uses. - **Zone import and export:** Import a BIND zone file as one change batch and export zones in BIND format. Routing policies and ALIAS records are written as comments, so a re-import never changes answers silently. - **Answer tester:** See the answer a client in a given network, location and region would get, and whether a routing policy chose it. - **Query metrics and status:** Queries per zone and period, standard, policy and NXDOMAIN, and the health and lag of the name servers serving your region. - **Name server protections:** Response rate limiting against reflection, zone transfers only to an allowlist of secondaries, and optional DNS over TLS. - **Managed roles:** Read only, records editor and full access roles, and limits on zones, records per zone and health checks in service quotas. How it works ## How a record change goes live. 1. Change An editor saves record changes; one save is one batch. 2. Validate The batch is checked as a whole and applied atomically, or refused with every problem. 3. Propagate Each name server loads the changed zones from the change feed. 4. In sync The batch turns from pending to in sync once every live name server serves it. 5. Record The batch and its changes are in the account's audit log. Who uses it ## Built for every role that answers for AI. - **Network engineers:** Run zones, routing policies and health checks for public and internal names. - **Platform teams:** Put custom domains in front of gateways and stream endpoints with ALIAS records. - **Security teams:** Turn on DNSSEC, publish DS records and control who may change records. - **Operators:** Run the name servers, set rate limits and transfer allowlists, and watch replica lag. Enforced and recorded ## No change without its record, no domain without a claim. Ownership and changes are decided on the server. Enforced - **Domain verification:** Custom domains for Govern resources, and public zones on the hosted service, need a domain verified for the account. - **One owner per public name:** Only one account at a time may host a public name, and a private zone never overrides another account's public zone. - **Atomic changes:** A batch with any problem changes nothing. - **Isolation:** Private networks of different accounts cannot overlap, and health checks cannot probe internal addresses on the hosted service. Recorded - **Zone and record changes:** Zone creation and deletion, every change batch with its changes, and zone file imports. - **Health and signing:** Health check status changes with the zones affected, DNSSEC changes and automatic key rollovers. - **Platform hostnames:** Hostnames Govern publishes for your resources, and their retirement. Where it runs ## On your network or ours. [Deployment options](https://neuralinverse.com/deployment/) - **Self-hosted:** The name servers are stateless replicas you deploy with your installation; they need no external DNS provider. - **Air-gapped:** Private zones answer workloads in your own networks with no outside dependency. - **Hosted by us:** Zones on Neural Inverse name servers in the region that serves your account. Get started ## Set it up with the documentation. - [Kubernetes deployment](https://neuralinverse.com/docs/deploy/kubernetes/) - [Govern concepts](https://neuralinverse.com/docs/govern/) What's next ## Being built now. These are in development and not part of the product today. - **Permissions per hosted zone:** Policies that grant DNS actions on one hosted zone rather than the whole account. Related [Streams → Durable, ordered streams with consumer groups, transactions, DLP and governed endpoints.](https://neuralinverse.com/govern/streams/)[Identity and access → Single sign-on, provisioning, least-privilege roles, just-in-time access and reviews.](https://neuralinverse.com/govern/identity/)[Audit and evidence → A hash-chained audit log you can verify offline, and evidence toward your frameworks.](https://neuralinverse.com/govern/audit/) ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)