Skip to content
Leaflow
Get started

DNS

DNS

Manage records at Cloudflare, Tencent Cloud DNSPod, Alibaba Cloud and AWS Route 53 from one list. Records stay with your provider; Leaflow doesn't host zones.BillingFree for now. A top-up of at least US$1 is required before you use Leaflow.

Open in the ConsoleView pricing
example.comProvider · Cloudflare
NameTypeValueTTL
blogA203.0.113.10300
blogAAAA2001:db8::10300
wwwCNAMEblog.example.com3600
@MX10 mail.example.com3600
@TXT"v=spf1 mx -all"3600
@CAA0 issue "letsencrypt.org"3600

At a glance

example.comProvider · Cloudflare
NameTypeValueTTL
blogA203.0.113.10300
blogAAAA2001:db8::10300
wwwCNAMEblog.example.com3600
@MX10 mail.example.com3600
@TXT"v=spf1 mx -all"3600
@CAA0 issue "letsencrypt.org"3600

Domains from every provider in one table, with the copy that answers queries marked when a domain appears twice.

Every domain’s records are managed in one table.

Register a provider account as a credential and every domain that credential can reach appears in one list. Records are read and written against the provider’s current state. Changes made in the provider’s dashboard, by a certificate client or by another automation appear after a refresh, and changes made here reach the provider directly.

In each dashboard

  • Sign in to each account separately
  • Each provider has its own record syntax and limits
  • Moving to another provider means another interface

In Leaflow

  • One list of domains, separated by credential
  • The same name, type, value and TTL fields
  • Shipping and your own agent can both read and write records

Each provider has its own key. It is checked before it is saved.

Cloudflare uses an API token with the Zone.DNS edit permission. DNSPod uses a SecretId and SecretKey. Alibaba Cloud uses an AccessKey ID and AccessKey Secret. Route 53 uses an access key ID and secret access key. The credential is checked against the provider when you submit it; one that cannot list domains is not saved.

When you register

  • Create the key at the provider with only the permissions DNS needs
  • For a Cloudflare token scoped to one domain, add the Zone Token used to list domains
  • The Alibaba Cloud region defaults to cn-hangzhou; the Route 53 region defaults to us-east-1 and only affects request signing
  • Temporary Route 53 STS credentials expire, after which every operation with that provider fails
  • The same credential cannot be registered twice in one project

After it is saved

  • The Console shows the name, provider and a masked fragment
  • You can check it again, rename it or delete it
  • Changing a key means deleting the credential and registering it again
  • Deleting it withdraws access and leaves every record in place

Each record type has its own value syntax.

A, AAAA, CNAME, TXT, MX, NS, SRV and CAA. A record has a name, a type, a value and a TTL. Names are written relative to the domain, with @ for the domain itself. TTL can be 0 to 604800 seconds; 0 leaves the choice to the provider.

How the value is written

  • CNAME and NS take a target name that ends with a dot
  • MX puts the priority before the host
  • SRV takes priority, weight, port and target in that order
  • TXT takes the text itself, without quotes
  • CAA takes flags, tag and value in that order

TTL

  • 0 to 604800 seconds
  • 0 leaves the choice to the provider
  • A value below the provider’s minimum is raised to it
  • A TTL change applies to the whole set with the same name and type

Delegation decides which copy answers.

During a migration a domain often stays in both the old and the new account. Leaflow reads the domain’s delegation to find the copy that answers queries; only that copy receives real traffic. The list shows an Answers column only when a domain appears more than once. With custom nameservers or no delegation it cannot tell, and you choose a credential before writing.

Answering

  • The domain’s delegation points to this provider
  • Real queries arrive here
  • Changes here affect visitors

Not answering

  • May be a copy left in an old account during a migration
  • Changes here do not affect real queries
  • Remove or migrate it once you are sure it is no longer needed

One tool call writes a record set.

Shipping sets a record through the platform API. It names the domain, record name, type and value, such as pointing blog.example.com at 203.0.113.10. The change follows your Before running setting. Your own agent can call the DNS API with a scoped token; the token determines the project.

  • Shipping’s write appears in the conversation as Set record, with its arguments and result
  • Read-only calls run directly; changes stop according to your setting
  • The DNS API works in record sets. PUT replaces the set; PATCH adds or removes named values
  • PATCH reads nothing first, so concurrent writes such as certificate renewal do not overwrite each other
Before running

  • Automatic review

    Before resources change or outside services are called, automatic review decides whether to go ahead

  • Confirm each change

    Pauses before resources change or outside services are called, and waits for you

  • Run directly

    Never pauses, even for deletes and restarts

The domain, its registrar and its records stay with you.

Leaflow does not host zones or register domains. It reads and writes records through the credential you register; the domain’s owner and registrar do not change. Deleting a credential withdraws this project’s access and leaves every record at the provider untouched.

Leaflow reads and writes

  • Record names, types and values
  • Record TTL
  • Every value in a set with the same name and type

Stays with you

  • The registrar and domain ownership
  • Domain renewal
  • The provider account itself

Also included

  • One list of domains

    Every domain the credentials can reach in one table, with its provider and credential. Search by name.

    Domain, provider, credential

  • Provider credentials

    Cloudflare, DNSPod, Alibaba Cloud and Route 53 each use their own key. A credential is checked with the provider before it is saved.

    One format per provider

  • Check again

    When a key is deleted, a permission is removed or a temporary credential expires, check it again and read the provider’s reason in the list.

    Shows the provider’s error

  • Record sets

    Values with the same name and type are read and written as one set. Add several values at once, one per line.

    Up to 100 values per set

  • Record types

    A, AAAA, CNAME, TXT, MX, NS, SRV and CAA cover common website, mail and certificate records.

    HTTPS and SVCB not yet

  • TTL

    Set TTL from 0 to 604800 seconds. 0 leaves it to the provider, which raises a value below its own minimum.

    300 seconds by default

  • Delegation check

    When a domain appears under more than one credential, the list reads its NS delegation and marks the copy that answers queries.

    Answering, not answering, undetermined

  • Duplicate domains

    During a migration you can see the old and new account copies side by side. A write names the credential when the copy cannot be determined.

    Credential required when ambiguous

  • Hand it to Shipping

    Ask Shipping to add or change a record, such as a subdomain for a new instance. Changes follow your Before running setting.

    Shown as Set record in the chat

  • DNS API

    Your own agent can call the DNS API with a scoped token. PUT replaces a set; PATCH adds or removes individual values.

    https://dns.leaflow.cloud

  • No zone hosting

    Records stay with your provider. Leaflow reads and writes the accounts you authorize and does not change who holds the domain.

    Domain registration coming soon

  • Delete records

    Delete one value or a whole set with the same name and type. The change goes straight to the provider.

    The last apex NS set is usually protected

Pricing

Free for now. A top-up of at least US$1 is required before you use Leaflow.

How every product is billed

Details

Providers
Cloudflare, Tencent Cloud DNSPod, Alibaba Cloud DNS, AWS Route 53
Record types
A, AAAA, CNAME, TXT, MX, NS, SRV, CAA; HTTPS and SVCB not yet
TTL
0 to 604800 seconds, 300 by default; 0 uses the provider default and values below its minimum are raised
Record sets
Values with the same name and type form one set of up to 100 values; each value can be up to 4096 characters
API
https://dns.leaflow.cloud
Authentication
Scoped token; the token determines the project
Credentials
Submitted secrets are never returned; the Console shows a masked fragment, and a credential that fails its check is not saved
Delegation
Read from the domain’s NS delegation; when no copy can be determined, a write must name a credential
Propagation
A write reaches the provider at once; other resolvers keep the old value until its TTL expires
Billing
Free for now; a top-up of at least US$1 is required before you use Leaflow
Domain registration
Coming soon, not available today
Change history
No DNS change history or undo in the Console

Questions

Which providers are supported?

Cloudflare, Tencent Cloud DNSPod, Alibaba Cloud DNS and AWS Route 53.

Will my domain move to Leaflow?

No. Leaflow does not host zones or register domains. Records stay with your provider, and the registrar and ownership do not change.

Which record types are supported?

A, AAAA, CNAME, TXT, MX, NS, SRV and CAA. HTTPS and SVCB are not available yet.

Can I turn on Cloudflare’s proxy?

There is no proxy switch in the Console. It sets records and TTL; the proxy setting is managed in Cloudflare.

When do changes take effect?

A write reaches the provider at once, but other resolvers keep the old value until its TTL expires. Wait at least one TTL before you check, rather than trusting a lookup made right after the change.

A domain appears at two providers. What should I do?

The Console marks the copy that answers queries when a domain appears more than once. When it cannot tell, choose a credential before writing; otherwise the write is refused.

Is there a change history or undo?

The Console has no DNS change history or undo. Every change goes straight to the provider, including deleting a value or a set.

How is it billed?

Free for now. A top-up of at least US$1 is required before you use Leaflow.

Get started in the Console.

Top up at least US$1 before first use. After that, each product is billed at its public price.

Get startedView pricing

Other products

All products