The Herald

What it is

The Herald is authoritative DNS with DNSSEC, geo steering, and instant record updates. Zones you create in the dashboard are published automatically.

Cloudflare analogue: Cloudflare DNS. SLA 100% · p99 12ms. Admins publish records. Viewers may read.

• ▸DNSSEC
• ▸Geo steering
• ▸API-first records
• ▸Low-TTL cutovers

How it works

Each zone is an authoritative DNS product. Zipper nameservers are published after you add the hostname.

Records can be DNS-only or proxied through The Crown.

DNSSEC is on by default with ECDSAP256SHA256.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Herald. Publish records. Check “Proxy through The Crown” for web traffic.

API

Control-plane: POST /api/v1/herald/records. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/herald/records \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"type":"A","name":"@","content":"198.51.100.40","ttl":300,"proxied":true}'

const res = await fetch("https://tinyzipper.com/api/v1/herald/records", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

MX and CAA are usually DNS-only. Do not proxy mail.

• ▸DNSSEC
• ▸SOC 2

Runbook

Lower TTL before a cutover. Enable DNSSEC after the last record is published.