DNS Delegation
Delegate a domain zone to Ink so your agent can manage DNS records, custom domains, and TLS certificates programmatically
DNS delegation gives Ink authoritative control over a domain zone. Once delegated, your agent can create and manage any DNS record type — A, AAAA, CNAME, MX, TXT, CAA — without you touching a registrar dashboard.
Without delegation, you're limited to default *.ml.ink subdomains.
Nameservers
Delegate to:
ns1.ml.inkns2.ml.ink
Setup
Step 1: Initiate delegation
Go to Settings > DNS and enter the domain you want to delegate (e.g., apps.example.com).
Step 2: Add TXT verification record
Ink generates a verification token. Add a TXT record at your current DNS provider or registrar:
| Type | Name | Value |
|---|---|---|
| TXT | _dp-verify.apps.example.com | (your verification token) |
This proves you own the domain. The token is unique to your account.
Step 3: Verify ownership
Click Verify in the Ink dashboard. Ink checks for the TXT record. DNS propagation typically completes within minutes but can take up to 48 hours.
Step 4: Add NS records
Once ownership is verified, update the nameserver records for your zone at your registrar:
| Type | Name | Value |
|---|---|---|
| NS | apps.example.com | ns1.ml.ink |
| NS | apps.example.com | ns2.ml.ink |
This delegates DNS authority to Ink for the zone.
Step 5: Complete delegation
Click Verify again. Once Ink detects the NS records, the zone status moves to provisioning → active. A wildcard TLS certificate is issued automatically via Let's Encrypt.
What Ink manages
Once delegated, Ink handles:
- A/AAAA records for services assigned to the zone
- Wildcard TLS certificates via Let's Encrypt (DNS-01 challenge)
- Traffic routing through Ink's load balancers
- Any DNS records your agent creates via MCP tools
Removing a delegation
You can remove a delegation at any time from the DNS settings page. This removes all Ink DNS records and returns control to your registrar.
Troubleshooting
- Verification stuck — DNS propagation can take up to 48 hours. Use
dig TXT _dp-verify.apps.example.comto check if the record is visible - Zone expired — Unverified zones expire after 7 days. Initiate a new delegation if this happens
- Wrong records — Double-check the record type, name, and value at your registrar. The TXT name must include
_dp-verify.prefix - NS records not detected — Ensure NS records point to exactly
ns1.ml.inkandns2.ml.ink(not the zone's parent nameservers)