DNS

DNS keeps the records of your domains in one readable place. It reads a zone from the provider that hosts it, plans the records a finished zone should hold, publishes them, and checks that the internet agrees. It can also move a domain's DNS from its registrar to Cloudflare.

In the sidebar under Domains & network → DNS. Needs: Domains.

Two things are easy to confuse here:

What MaxSuite has recorded: the list of records on this page. It is a ledger of what somebody wrote down or read from the provider.
What the zone actually answers: what public resolvers return. A DNS plan, and the agent tools that publish and resolve, deal with this.

Editing a row in the list changes only the stored record. Publishing a plan, or an agent's publish tools, changes the zone at the provider for real.

The DNS screen

Pick a domain from Domain at the top, or open it from the DNS button on the Domains page. The picker says which account each listing comes from, and marks a listing whose copy is out of date. You see:

The record list ("Records as Max knows them"): Type, Name, Value, Domain, At provider, TTL and Pri (priority). A record that was confirmed at the provider says so. One marked Recorded here only may differ from what the name actually answers.
What the zone holds now: the newest copy read from the provider.
DNS plan: the records a finished zone holds, published together and checked against live resolvers. The plan reads Planned, not published, Published, waiting, or DNS phase done once every resolver serves every planned record and nothing else answers beside them. Show the zone as it was before shows the copy taken when the plan was made.

If nothing is recorded for a domain, the page says so plainly and does not claim the zone is empty.

Read a zone from its provider

Choose the domain.
Click Read from provider.
MaxSuite reads the zone, adds what is missing here, and reports what it read. Records it holds that the provider does not list are kept and counted. Anything it would have refused is listed as a problem. Nothing at the provider changes.

When a domain's zone is already on Cloudflare, a record you save is written to the zone's own live listing first, so it does not stay "here only".

Plan and publish the records for a site

Choose the domain and click Plan DNS (or Plan again).
Choose the Purpose: Website, Mail or Both.
Choose the Canonical host: the bare domain or its www name. Every link is built from this name.
Review the suggested records. Each is marked keep, add, change or needs a value. For mail, suggestions come from the connected mail server that handles the domain. Use Add record or Remove, then Save plan.
Click Publish. Every planned record is written at the provider, then the resolvers are asked whether they serve them.
Click Check again until the plan reads DNS phase done.

Before anything is published, the zone as it stands is copied, so there is something to roll back to. A plan never deletes a record.

Move a domain to Cloudflare

For a domain whose DNS is still at its registrar (for example Spaceship, GoDaddy, Namecheap or Porkbun):

Click Move to Cloudflare.
Read the plan: the registrar, the nameservers now, and the records that will be copied.
Choose the Cloudflare login, then the Cloudflare account when the login reaches more than one.
Confirm. MaxSuite creates the zone, copies every known record in, and only then points the registrar at Cloudflare's nameservers. If a record will not copy, it stops before the nameservers change and says Not finished.

Add or edit a stored record

Click Add record above the list, or Edit on a row.
Fill in Domain, Type, Name, Value, TTL, and Priority where the type needs one. Proxied applies only to A, AAAA and CNAME records.
Save.

Deleting a row removes the stored record; the record at the provider keeps answering unless it is unpublished.

Point records at a new server

When you move a site, an agent can find every address record aimed at the old server, in every zone of every connected DNS account, and aim them all at the new address under one approval. Each record keeps its proxying and TTL, and every zone touched is copied first.

Who can do what

Permission	Label	Lets you
`dns:read`	View dns	See recorded records, plans and their status, and resolve names
`dns:write`	Manage dns	Add, edit and delete records; read a zone from the provider; plan and publish; move a domain to Cloudflare

Your role on the domain also counts. Changing a record needs at least DNS editor on that name in Domains. A DNS editor share can be limited to some record types, or to one name and those beneath it. See Sharing and visibility.

What happens on its own

Job	When	What it does
`observe-zones`	Every day at 04:45 UTC	Reads every zone the workspace's domains say Cloudflare hosts, and keeps the newest copy beside the domain's listing. Nothing at the provider changes.

Needs

Domains switched on. DNS works on the names listed there.
A DNS provider account connected under Integrations (provider accounts) to read or publish a zone. Without it, DNS can record but not publish.

What agents can do

Reads run straight away. Every other tool asks a person first unless a standing rule allows it. See Agents and approvals.

The publish tools keep these rules: a name holds one CNAME and nothing beside it; a record is corrected rather than given a second answer (so never two SPF policies); the last MX or NS record is not removed unless you say so; the zone is copied before every change.

Look (read-only)

dns.resolve: what four public resolvers and the zone's own nameservers answer, and whether they agree.
dns.list: the records recorded here.
dns.suggestPhase: the records a plan should hold.
dns.phaseStatus: whether a plan is done, asking live resolvers.
dns.zoneBefore: what the zone held before each recent change.
dns.pointingAt: every address record aimed at an address, in every connected zone.

Change the live zone (asks first)

dns.publish: write a record at the provider and record it here.
dns.unpublish: take a record out of the zone.
dns.runPhase: publish every planned record and check the resolvers.
dns.repoint: aim every record pointing at one address at another, or take them out.
dns.moveToCloudflare: move a domain's DNS from its registrar to Cloudflare. Run it as a dry run first to see the plan.

Change what is recorded here only (asks first)

dns.planPhase: open a plan and copy the zone first. Nothing is published.
dns.create, dns.update, dns.remove: change the stored records only.
dns.sync: record what a provider says a zone holds.
dns.pull: read a domain's zone from its provider and record it.

Over MCP the same tools are named dns__resolve and so on. See API keys and MCP access.

DNS

DNS