DNS setup

A routeup deployment needs an address record for every namespace base it serves. The suffix apex itself is not the client control endpoint and does not need to point at routeup. The examples below use edge.tunnel.example.com as the control host; it is covered by the root wildcard.

Records

DNS wildcards do not replace records for nested namespace bases. For a suffix of tunnel.example.com on a server at 203.0.113.10:

*.tunnel.example.com.         A  203.0.113.10  # edge + root-tier routes
*.try.tunnel.example.com.     A  203.0.113.10  # if public_namespace is try
*.alice.tunnel.example.com.   A  203.0.113.10  # for *.alice.tunnel.example.com tokens

Add matching AAAA records when the server has IPv6. Add one wildcard record for every token namespace, such as *.team-x.tunnel.example.com. A root wildcard resolves edge.tunnel.example.com and acme.tunnel.example.com; it does not replace the nested *.try.tunnel.example.com or *.alice.tunnel.example.com records.

DNS for the ACME challenge

In the default acme TLS mode, the server proves domain control with the DNS-01 challenge, which writes temporary TXT records under _acme-challenge. That requires API access to your DNS provider. routeup uses Cloudflare by default (CLOUDFLARE_API_TOKEN with Zone.DNS:Edit on the zone). Cloudflare address records must be DNS only (grey cloud). A proxied record terminates TLS at Cloudflare instead of passing the routeup wildcard certificate and tunnel connection through to your server.

So the DNS provider serves two roles:

1. Hosts the A/AAAA records for the root tier and every enabled namespace.
2. Lets the server publish challenge TXT records for certificate issuance.

See TLS for the certificate side.

Verify

terminal

dig +short edge.tunnel.example.com
dig +short acme.tunnel.example.com
dig +short random.try.tunnel.example.com
dig +short acme.alice.tunnel.example.com

Verify the root tier and every enabled namespace before clients use them. Each command should return the server IP.