Manage DNS policies

A DNS policy decides where a VPC relays queries it can’t answer itself. Use your own policy when a VPC must resolve names in your company’s DNS zone, or when it must not resolve external names at all.

Before you begin

The URN of the project, and of the VPC if you attach a policy to one.
The IPv4 or IPv6 addresses of the upstream DNS servers you want to use.

Create a policy

Create the policy with its upstream servers and relaying turned on:
Terminal window
```
origin network create-dns-policy --project-urn <project-urn> \
  --relay-enabled true \
  --upstream-server 192.0.2.53 --upstream-server 192.0.2.54
```
To create a policy that refuses every query outside the VPC, use --relay-enabled false --no-upstream-servers. Relaying with no upstream servers is refused.
Verify it with list-dns-policies --project-urn <project-urn>.

Attach a policy to a VPC

Attach the policy. It must belong to the VPC’s project.

origin network attach-dns-policy --vpc-urn <vpc-urn> \
  --dns-policy-urn <dns-policy-urn>

Verify that the VPC’s dnsPolicyId names the policy:
Terminal window
```
origin network get-vpc --vpc-urn <vpc-urn>
```

Change a policy’s servers or relaying

Send the policy’s full new settings. The server list you give replaces the existing one.

origin network update-dns-policy --dns-policy-urn <dns-policy-urn> \
  --relay-enabled true --upstream-server 192.0.2.53

Verify with get-dns-policy --dns-policy-urn <dns-policy-urn>.

The change applies to every VPC attached to the policy while instances keep running; no restart is needed.

Change the project’s default policy

Make another policy the default:

origin network set-default-dns-policy --dns-policy-urn <dns-policy-urn>

Verify with list-dns-policies.

Only VPCs you create afterwards attach to the new default. Existing VPCs keep their current policy; use attach-dns-policy to move them.

Delete a policy

Attach every VPC that uses the policy to another one. A policy can’t be deleted while a VPC is attached to it, or while it’s the project’s default.

Delete the policy:

origin network delete-dns-policy --dns-policy-urn <dns-policy-urn>

Verify that list-dns-policies no longer shows it.

Deleting a VPC doesn’t delete its DNS policy.