Introducing UDNS Hosted: Authoritative DNS Built Into the Platform

UDNS Hosted is a managed authoritative DNS service built directly into Unified DNS. Instead of leaving DNS at a domain registrar like GoDaddy or Network Solutions, or pointing it at a third-party DNS provider like DNSimple or Cloudflare, MSPs can point DNS straight at UDNS Hosted and manage it from the same portal used for every other provider. It runs on redundant nameserver pairs the platform operates specifically for this — ns1.udns.zone and ns2.udns.zone today, with more pairs coming online as adoption grows.

It's a real shift for the platform. Unified DNS started as a way to see and manage DNS across everyone else's nameservers. UDNS Hosted turns Unified DNS into the authoritative nameserver too, when an MSP wants it to be — same portal, same workflow, one less vendor to depend on. Here's how it works end to end.

Zone Onboarding: Three Ways In

When an MSP adds a domain to UDNS Hosted, the first decision is how to populate the zone's initial records. There are three options, and which one makes sense depends entirely on where the domain is coming from:

Start blank is for domains that don't have DNS history worth preserving — a new client domain, or a case where the MSP wants to build the zone deliberately before ever cutting over.

Public DNS scan is the path most MSPs will reach for first, because it requires nothing from the client and nothing to export. Point it at the domain, and it captures the current state of DNS as it exists in the wild. The trade-off is right there in how it works: it can only import what's publicly resolvable. Anything that isn't currently answering a query — a record for a service that's paused, a split-horizon entry, anything the current provider doesn't expose the way a scan expects — won't come across.

Import BIND zone file is the most complete path for exactly that reason. If the MSP can export a zone file from wherever the domain lives now, importing it captures records a public scan would miss. It's more manual — someone has to go get the file — but it's the migration path to use when "we're pretty sure we got everything" isn't good enough.

Once the zone is created and populated, the platform pushes it to the nameserver cluster through a private REST API call, so the zone already exists on ns1 and ns2 before delegation even happens — delegation is what tells the rest of the internet to start asking them.

DNSSEC and the Chain of Trust

DNSSEC can be turned on from the portal the moment a zone is created. The platform generates a signing key and starts signing responses for the zone right away, so there's no separate provisioning step to wait on.

The one manual piece is the DS record. The platform surfaces it as soon as the key is generated, and the MSP submits it to the domain's registrar to complete the chain of trust. Until that record is live at the registrar, the zone is being signed on the nameservers, but the chain of trust isn't fully established end-to-end — enabling DNSSEC in the portal and finishing it at the registrar are two separate steps, and both need to happen.

Delegation: Pointing the Domain at UDNS

Delegation itself is the same operation MSPs already do dozens of times a year: update the domain's NS records at the registrar to point at the new nameservers, ns1.udns.zone and ns2.udns.zone. Those nameservers run under the Unified DNS brand rather than the MSP's own domain. It's shared infrastructure that the platform operates, not a hostname the MSP white-labels as its own.

After the NS records are updated, the platform polls delegation status every 15 minutes and automatically marks the zone active once the cutover is confirmed through live DNS resolution.

The Infrastructure

The nameservers are built for redundancy, not just uptime on paper:

• Geographically separate — ns1 and ns2 run in different regions, so a regional outage doesn't take a zone down
• Private replication path — record changes sync between nameservers in under a second, over a private network connection that never touches the public internet
• Both nameservers answer queries — ns2 isn't a cold standby, it serves DNS continuously; it just doesn't accept record writes directly, those replicate out from ns1. If ns1 ever suffers a catastrophic failure, there's a documented process to promote ns2 to primary until it's restored
• DNSSEC always on — signing runs on both nameservers at all times, not just the one handling writes

ns1.udns.zone and ns2.udns.zone are the pair handling every UDNS Hosted zone today. As adoption grows, more nameserver pairs will come online to keep capacity ahead of demand — the architecture is built to scale out, not just hold steady.

Audit Logging and Quick Restore

Because UDNS Hosted gives the platform direct write access to the authoritative nameservers, every record change — creation, modification, deletion — lands in the audit log with a timestamp and the user that made it. Most third-party DNS providers don't expose that level of history through their APIs, which means restoring a deleted record usually means digging through a registrar dashboard or reconstructing the zone from memory.

Here's a more realistic version of that than "the record vanished": a technician updates a batch of records as part of a client's website cutover, then needs to roll part of it back the same day, because the client wants to hold off, or something downstream breaks. With a third-party DNS provider, that means remembering or reconstructing the old values from memory or old tickets. With UDNS Hosted, the audit log shows exactly what changed, when, and from what, and the affected record can be reverted directly from the portal in a few clicks. Automated backups to the MSP's own Azure Blob or SharePoint storage cover the rest, the same as every other provider, if a bigger restore is ever needed.

Platform Integration

UDNS Hosted isn't a bolt-on — it's a first-class provider in the platform, which means zones hosted on it get the same automation every other connected provider gets:

• Hudu sync pushes zone documentation and Magic Dash widgets automatically — no manual documentation step
• DNSSEC and NS change alerts fire if DNSSEC gets disabled or nameservers change unexpectedly
• PSA ticket automation opens a ticket automatically for high-signal events like a zone transfer or DNSSEC getting disabled, through the same HaloPSA, Autotask, Syncro, or SuperOps integration used for every other provider
• Domain Reputation monitoring checks UDNS-hosted domains against the same 13 DNSBL/RBL spam databases as every other provider, with an alert the moment one turns up on a blocklist
• Parked Domain Hardening runs the same six-record security baseline — SPF, DMARC, a null DKIM wildcard, null MX, and CAA — against inactive UDNS-hosted zones as it does everywhere else, with the same conservative handling that flags rather than touches any zone with active mail records
• Zone Health and DNSSEC reports include UDNS-hosted zones alongside every other provider in the account
• No drift to reconcile — every change to a UDNS Hosted zone happens through the portal in the first place, so there's no separate registrar dashboard where an out-of-band edit could happen and throw reports out of sync. That's exactly what scheduled record reconciliation exists to catch on every other provider

What This Means for MSPs

Most DNS hosting decisions for MSPs come down to picking a registrar or a DNS SaaS and accepting whatever comes with it — their API, their uptime, their pricing. UDNS Hosted is a different shape of trade-off: the infrastructure runs in a dedicated environment operated for the platform, management is embedded in the same portal used for every other provider, and there's no per-domain fee to a third party. It's included in the Unified DNS plan at no additional per-zone cost — pricing is based on total domain count, starting at $100/month for up to 50 domains, whether those domains are hosted on UDNS or spread across every other provider in the account.

One thing this isn't: white-labelled. ns1.udns.zone and ns2.udns.zone are shared, platform-branded nameservers, not a hostname on the MSP's own domain. It's worth being precise about what that trade-off actually looks like, too. The nameserver infrastructure itself, DNSSEC key management, replication between ns1 and ns2, uptime — that's Unified DNS's responsibility, not something handed off for the MSP to operate. What's on the MSP's side is narrower: which other DNS providers get connected to the account, where automated backups land (their own Azure Blob or SharePoint storage), and SSO configuration if it's set up. For most MSPs, that's still the part that actually matters day to day, and the rollback scenario above is the clearest version of why: when something breaks on a UDNS Hosted zone, the fix is a few clicks in the portal instead of a support ticket to someone else's DNS provider, even though the infrastructure underneath it isn't theirs to manage.

The underlying question — should DNS live at the registrar, or somewhere the MSP actually controls — comes up constantly for anyone managing client infrastructure, not only MSPs. A domain hosted directly at a registrar is usually the least visible, least auditable option available. Most registrar dashboards don't expose real change history, don't support DNSSEC without extra configuration, and don't integrate with anything else in the stack managing the client relationship. Hosting DNS somewhere with an audit trail, role-based access, and a change history attached is what turns "wherever the domain happens to point" into infrastructure someone is actually accountable for: who changed a record and when, whether DNSSEC is on, and what happens the moment something changes that shouldn't have.

That question isn't unique to MSPs, either. Web development agencies run into the same decision every time they take on an ongoing hosting or maintenance contract for a client: leave DNS in the client's own registrar account and lose visibility the moment something breaks, or host it themselves so changes don't require chasing down a login every time a record needs to move. UDNS Hosted works the same way for that use case as it does for an MSP's client portfolio — a web agency onboarding a client's domain doesn't need a separate DNS hosting subscription or a personal Cloudflare account shared across every project. It's the same audit-logged, DNSSEC-capable hosting, in the same dashboard as every other domain in the account.

Frequently Asked Questions

What is UDNS Hosted?

UDNS Hosted is the authoritative DNS service built directly into Unified DNS. Instead of leaving DNS at a domain registrar or pointing it at a separate provider like Cloudflare or DNSimple, a domain's NS records can point straight at UDNS Hosted's nameserver pair, managed from the same portal as every other connected provider.

Does UDNS Hosted cost extra per zone?

No. It's included in the Unified DNS plan at no additional per-zone cost. Pricing is based on total domain count across the account, starting at $100/month for up to 50 domains, whether those domains are hosted on UDNS or spread across other providers.

Is enabling DNSSEC in the portal enough on its own?

Not quite — it's two separate steps. DNSSEC can be turned on the moment a zone is created, and signing starts immediately, but the chain of trust isn't fully established until the DS record the platform surfaces gets submitted to the domain's registrar as well.

What happens if one of the nameservers goes down?

The other keeps answering queries. ns2 serves DNS continuously alongside ns1, it isn't a cold standby, it just doesn't accept record writes directly since those replicate out from ns1. If ns1 ever suffered a catastrophic failure, there's a documented process to promote ns2 to primary until ns1 is restored.

Is UDNS Hosted white-labelled?

No. ns1.udns.zone and ns2.udns.zone are shared, platform-branded nameservers, not a hostname on the MSP's own domain. The nameserver infrastructure, DNSSEC key management, and uptime are Unified DNS's responsibility. What's on the MSP's side is narrower: which other providers get connected, where backups land, and SSO configuration if it's set up.

Is UDNS Hosted only for MSPs?

No. Web development agencies hosting DNS for clients under an ongoing contract can use it the same way an MSP does, pointing a client's domain at UDNS Hosted instead of a personal Cloudflare account or a registrar login someone has to track down every time a record needs to change.

Is UDNS Hosted available now?

It's rolling out in partner preview now. Unified DNS itself, including multi-provider DNS management, is live today.

Get Started with UDNS Hosted

UDNS Hosted is rolling out in partner preview now. Add a domain, choose how to populate it — blank, public scan, or BIND import — and the zone is live on redundant, DNSSEC-capable nameservers with a full audit trail from day one.

Unified DNS itself is live today — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or contact us for early access to UDNS Hosted specifically.

Zoe Montague is the founder of Silverfern Technology Consultants and the creator of Unified DNS, a DNS management platform built for MSPs.