---
title: "DNS Zones"
canonical: "https://docs.infoblox.com/space/nios90/1348567092/DNS%20Zones"
format: markdown
---
Consider the following authority delegation guidelines mentioned in the table below when you create, modify, or delete a DNS zone. See *[Sample Cloud API Requests](https://infoblox-docs.atlassian.net/wiki/spaces/nios90/pages/280667760)* for a sample cloud API request.  
For information about how to create DNS zones, *[Configuring Authoritative Zones](https://infoblox-docs.atlassian.net/wiki/spaces/nios90/pages/280763330)*. 

*Authority* *Delegation* *for* *DNS* *Zones*

| **Cloud** **API** **Requests** | **Standard** **API** **and** **WAPI Requests** | **Comments** |
| --- | --- | --- |
| - The Grid primary of a DNS zone automatically gains authority for the zone if the primary is a Cloud Platform Appliance. When there are multiple primaries configured for the zone, multiple delegations to these primaries are allowed as long as they are Cloud Platform Appliances.
- You cannot assign both a Microsoft server and a Grid member as primaries at the same time, although you can assign a Microsoft server as the Grid primary and a Cloud Platform Appliance as the Grid secondary. This allows the Microsoft server to serve changes sent from the cloud adapter.
- All resource records in a DNS zone inherit authority delegation from the zone. However, you cannot modify the NS record through a cloud API request.
- You can modify all the fields for a zone whose authority has been explicitly delegated.
- The cloud member to which authority for a network view is delegated automatically gains authority for authoritative zones defined in that network view. This Cloud Platform Appliance is the only cloud member that can be the Grid primary for the zones defined in this network view. The Grid Master does not have authority for any zone in this network view unless it is assigned as a Grid primary.
- The Cloud Platform Appliance can create, modify, and delete a DNS zone in any DNS view defined in a network view whose authority has been delegated to that cloud member.
- The Cloud Platform Appliance that is authoritative for a DNS zone can perform changes to the assigned Grid primaries, Grid secondaries, and external servers assigned to the zone as long as the Cloud Platform Appliance remains a Grid primary. But it cannot create, modify, or delete the NS record.
- The Cloud Platform Appliance that is authoritative for a DNS zone can create, modify, and delete DNS delegations that are directly parented to that zone. In particular, it may specify any Grid primary, Grid secondary, or external server for that zone.
- DNSSEC operations, network associations, and zone locking are not supported if at least one Cloud Platform Appliance is assigned as the Grid primary for any DNS zones.
- Although no DHCP service restart is required, you can perform a DHCP service restart on a Cloud Platform Appliance through a cloud API request. | - You cannot create, modify, or delete a DNS zone in a network view whose authority has been delegated to a Cloud Platform Appliance.
- You cannot assign a Cloud Platform Appliance as the Grid primary for a zone that is locked or disabled.
- You can modify extensible attributes of any DNS zone whose authority has been delegated from the Grid Master. | - Only authority for authoritative forward-mapping and reverse-mapping zones can be delegated. You cannot delegate authority for forward zones, stub zones, and delegated zones even though they may exist in a delegated network view.
- When you create a DNS zone using a cloud API request, you must include the following extensible attributes in the request: Tenant ID, Cloud API Owned, and CMP Type. |