# Manage DNS policies

Create DNS policies, change their upstream servers and relaying, attach a policy to a VPC, change a project's default policy, and delete a policy.

A DNS policy decides where a VPC relays queries it can’t answer itself. Use your own policy when a VPC must resolve names in your company’s DNS zone, or when it must not resolve external names at all.

## Before you begin [#before-you-begin]

<BeforeYouBegin>

- The URN of the project, and of the VPC if you attach a policy to one.
- The IPv4 or IPv6 addresses of the upstream DNS servers you want to use.

</BeforeYouBegin>

## Create a policy [#create-a-policy]

1. Create the policy with its upstream servers and relaying turned on:

   ```sh
   origin network create-dns-policy --project-urn <project-urn> \
     --relay-enabled true \
     --upstream-server 192.0.2.53 --upstream-server 192.0.2.54
   ```

   To create a policy that refuses every query outside the VPC, use `--relay-enabled false --no-upstream-servers`. Relaying with no upstream servers is refused.

1. Verify it with `list-dns-policies --project-urn <project-urn>`.

## Attach a policy to a VPC [#attach-a-policy-to-a-vpc]

1. Attach the policy. It must belong to the VPC’s project.

   ```sh
   origin network attach-dns-policy --vpc-urn <vpc-urn> \
     --dns-policy-urn <dns-policy-urn>
   ```

1. Verify that the VPC’s `dnsPolicyId` names the policy:

   ```sh
   origin network get-vpc --vpc-urn <vpc-urn>
   ```

## Change a policy’s servers or relaying [#change-a-policys-servers-or-relaying]

1. Send the policy’s full new settings. The server list you give replaces the existing one.

   ```sh
   origin network update-dns-policy --dns-policy-urn <dns-policy-urn> \
     --relay-enabled true --upstream-server 192.0.2.53
   ```

1. Verify with `get-dns-policy --dns-policy-urn <dns-policy-urn>`.

The change applies to every VPC attached to the policy while instances keep running; no restart is needed.

## Change the project’s default policy [#change-the-projects-default-policy]

1. Make another policy the default:

   ```sh
   origin network set-default-dns-policy --dns-policy-urn <dns-policy-urn>
   ```

1. Verify with `list-dns-policies`.

Only VPCs you create afterwards attach to the new default. Existing VPCs keep their current policy; use [`attach-dns-policy`](/docs/network/reference/cli#attach-dns-policy) to move them.

## Delete a policy [#delete-a-policy]

1. Attach every VPC that uses the policy to another one. A policy can’t be deleted while a VPC is attached to it, or while it’s the project’s default.
1. Delete the policy:

   ```sh
   origin network delete-dns-policy --dns-policy-urn <dns-policy-urn>
   ```

1. Verify that `list-dns-policies` no longer shows it.

Deleting a VPC doesn’t delete its DNS policy.

## Related [#related]

- [DNS](/docs/network/dns)
- [Rule sets are replaced as a whole](/docs/network/traffic-control/replace-rule-sets)
- [`create-dns-policy` reference](/docs/network/reference/cli#create-dns-policy)
- [`update-dns-policy` reference](/docs/network/reference/cli#update-dns-policy)
- [`attach-dns-policy` reference](/docs/network/reference/cli#attach-dns-policy)