Skip to content
Origin Cloud Docs

Network / Task

Manage DNS policies

Updated · 2 min read

Create DNS policies, change their upstream servers and relaying, attach a policy to a VPC, change a project's default policy, and delete a policy.

On this page7 sections

A DNS policy decides where a VPC relays queries it can’t answer itself. Use your own policy when a VPC must resolve names in your company’s DNS zone, or when it must not resolve external names at all.

Before you begin

Create a policy

  1. Create the policy with its upstream servers and relaying turned on:

    terminal
    origin network create-dns-policy --project-urn <project-urn> \
  --relay-enabled true \
  --upstream-server 192.0.2.53 --upstream-server 192.0.2.54

    To create a policy that refuses every query outside the VPC, use --relay-enabled false --no-upstream-servers. Relaying with no upstream servers is refused.

  2. Verify it with list-dns-policies --project-urn <project-urn>.

Attach a policy to a VPC

  1. Attach the policy. It must belong to the VPC’s project.

    terminal
    origin network attach-dns-policy --vpc-urn <vpc-urn> \
  --dns-policy-urn <dns-policy-urn>

  2. Verify that the VPC’s dnsPolicyId names the policy:

    terminal
    origin network get-vpc --vpc-urn <vpc-urn>

Change a policy’s servers or relaying

  1. Send the policy’s full new settings. The server list you give replaces the existing one.

    terminal
    origin network update-dns-policy --dns-policy-urn <dns-policy-urn> \
  --relay-enabled true --upstream-server 192.0.2.53

  2. Verify with get-dns-policy --dns-policy-urn <dns-policy-urn>.

The change applies to every VPC attached to the policy while instances keep running; no restart is needed.

Change the project’s default policy

  1. Make another policy the default:

    terminal
    origin network set-default-dns-policy --dns-policy-urn <dns-policy-urn>

  2. Verify with list-dns-policies.

Only VPCs you create afterwards attach to the new default. Existing VPCs keep their current policy; use attach-dns-policy to move them.

Delete a policy

  1. Attach every VPC that uses the policy to another one. A policy can’t be deleted while a VPC is attached to it, or while it’s the project’s default.

  2. Delete the policy:

    terminal
    origin network delete-dns-policy --dns-policy-urn <dns-policy-urn>

  3. Verify that list-dns-policies no longer shows it.

Deleting a VPC doesn’t delete its DNS policy.