Sovereign zone hosting
Zone records, configuration and DNSSEC signing keys stay in the region you pin them to. Nothing is replicated outside it.
What is different
Sovereignty, steering and GSLB in one service.
Most providers split these across products or tiers. Resolve delivers them together, with regional data residency underneath.
Intelligent traffic steering
Route queries by geography, source IP or custom rules at resolution time, with EDNS Client Subnet for sub-region accuracy.
Smart-health GSLB
HTTP, TCP, ICMP and custom-script checks drive priority-group failover. Unhealthy endpoints leave the rotation in seconds.
How it works
From zone import to intelligent answers in four steps.
- 01
Import your zone
Load records through the dashboard or the API. Each zone is parsed, validated and stored in your selected region.
- 02
Pin your region
Choose where zones, configuration, signing keys and query logs live. They are not copied anywhere else.
- 03
Configure steering and health checks
Define geo and source-IP rules, health probes, failover priorities and weights for each endpoint.
- 04
Serve answers
Queries reach the serving nodes in your assigned region, follow your rules and receive an answer from a healthy endpoint.
Traffic steering
Answer every visitor from the right place.
Pick which of our 52 data centres in 32 countries serve your zones: UAE only, GCC only, EU only, or any combination you need.
Data centres by region
- 6 Middle East & Africa
- 11 Europe
- 22 Asia Pacific
- 10 North America
- 3 Latin America
Capabilities
Everything an authoritative DNS team needs.
DNSSEC automation
Zones are signed through reusable DNSSEC Profiles, with the KSK and ZSK lifecycle managed for you and records re-signed on state changes.
EDNS Client Subnet
ECS sharpens steering inside large countries and regions instead of treating the whole region the same way.
Health checks
HTTP, TCP, ICMP and custom-script probes per record, with the action on failure and last-checked time in view.
GSLB
Priority groups with automatic tier promotion, and round-robin or latency-ordered selection within the active tier.
Zone access control
DNS Zone Operator and DNS Zone Reader roles govern who can change zones, with separation of duties enforced by the platform.
Analytics
Per-zone query trends with NXDOMAIN and SERVFAIL counts, query volume by serving node, and CSV export.
Inside the product
Your zones, measured and signed.
Real screens from the DNS Armor™ admin portal, not mockups.
Zones, records and DNSSEC state
Every zone with its tenant, record count, SOA serial and DNSSEC status — signed or off — at a glance, with per-tenant isolation enforced by the DNS Zone roles.
Source-based steering rules
Map source subnets to the addresses that answer them, with an explicit fallback when every endpoint is down: withdraw and serve the zone default rather than hand back a dead address.
Health-driven failover
Per-record checks with the action taken on failure, current state and last-checked timestamp, plus the primary and failover addresses in the rotation.
Technical specifications
The details your network team will ask for.
The documentation lists every supported record type and limit.
- Record types
- Standard types including A, AAAA, CNAME, NS, PTR, SOA and TXT (SPF, DKIM, DMARC)
- TTL
- Set per record
- DNSSEC
- Automated signing through reusable DNSSEC Profiles; KSK and ZSK rotation managed
- Health checks
- HTTP, TCP, ICMP and custom script
- Steering
- Geography, source subnet, EDNS Client Subnet; CNAME steering is geography-only
- Failover
- Priority groups; round-robin or latency-ordered within the active tier
- Management
- Admin portal and API; DNS Zone Operator and DNS Zone Reader roles
- Telemetry
- Per-zone queries, NXDOMAIN and SERVFAIL, volume per serving node, CSV export
- Serving
- Region-assigned, across 52 data centres in 32 countries
Pricing
Billed by what you actually host.
Resolve is licensed on its own, and self-service usage is billed automatically from live zone and record counts.
DNSSEC included. Enterprise licensing is available for larger estates.
$10
per 10 zones, per month
$10
per 100 DNS records, per month
Migration
Move from Route 53, Cloudflare or on-premises BIND.
Bring existing zones across without a flag day. Our team can walk you through the move on a call.
- 01
Export
Export the records for each zone from your current provider or name server.
- 02
Import and validate
Load them through the dashboard or the API; every record is validated as it is imported.
- 03
Configure
Add DNSSEC profiles, steering rules, health checks and failover order before any traffic arrives.
- 04
Switch delegation
Update the name servers at your registrar when you are ready. Statistics are live from the first query.
FAQ
Questions network teams ask us.
Can we choose exactly where our zones are hosted?
Yes. You pick which of the 52 locations serve your domains — UAE only, GCC only, EU only, or any mix you need. Your records, settings, DNSSEC signing keys and query logs all stay in the locations you choose and are not copied anywhere else. That is how the service is built, not simply what the contract promises.
Where do the DNSSEC signing keys live?
In the same region as the domain they protect. DNSSEC is what proves an answer really came from you and was not tampered with on the way. Signing happens automatically using reusable profiles, and we manage the whole life of both signing keys for you, including replacing them on schedule. If a health check changes a record, it is re-signed straight away.
How does failover actually work?
We continuously test each of your servers — by HTTP, TCP, ping, or a script you provide. You group servers by priority, and if every server in the active group fails, the next group takes over on its own. Within a group you can share traffic evenly or always send people to the fastest server. A failed server stops being given out within seconds.
Do you support EDNS Client Subnet?
Yes. It lets us direct visitors more precisely inside a large country or region, instead of treating the whole region the same way. One limit worth knowing: steering by CNAME is based on location only — those cannot be health-checked or ordered by speed.
Can we license Resolve without Protect?
Yes. Resolve and Protect are two separate licences and either works on its own — Resolve is not an add-on. With Resolve alone you get the authoritative DNS section and the shared platform tools, and the DNS Zone Operator and DNS Zone Reader roles decide who can manage your domains.
How do we migrate our existing zones?
Import them through the dashboard or the API. Each domain is checked and validated as it loads, then stored in the region you chose. From there you set your routing rules, health checks and failover order, and switch over when you are ready. Statistics and live query reporting are available from the moment a domain starts serving.
Who in our team can manage zones?
Two roles cover DNS. A DNS Zone Operator can create and change domains, records, DNSSEC, routing and health checks; a DNS Zone Reader can see all of it but change none of it. These sit alongside one security role and one licensing role, so whoever manages DNS need not have any access to security policy — the system enforces that rather than relying on good intentions.
Is there a point of presence in the UAE?
Yes — Dubai. The Middle East and Africa region also covers Doha, Riyadh, Cairo, Istanbul and Cape Town. In total the platform runs from 52 data centres in 32 countries, and you choose which of them serve your domains.
Take control of your authoritative DNS.
Book a 30-minute demo and see sovereign hosting, steering and GSLB on your own zones.