--- name: vpc-nlb-private-dns-integration title: Integrating a network load balancer with IBM Cloud DNS Services description: IBM Cloud® Network Load Balancer for VPC allows you to bind a DNS zone from IBM Cloud DNS Services to move all DNS resolutions into private networks. last-updated: 2026-08-14 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Integrating a network load balancer with IBM Cloud DNS Services {: #nlb-dns} IBM Cloud® Network Load Balancer for VPC allows you to bind a DNS zone from [IBM Cloud DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-getting-started&format=markdown) to move all DNS resolutions into private networks. {: shortdesc} IBM Cloud DNS Services provides private DNS to VPC users. Private DNS zones are resolvable only on IBM Cloud, and only from explicitly permitted networks in an account or with cross-account access. Do not remove or modify the DNS records created by the load balancer. Doing so can result in your private DNS and load balancer configurations becoming out of sync, which can cause data path issues. {: attention} For more information about linking your own private DNS record name to a load balancer, refer to the solution tutorial [Team based privacy using IAM, VPC, Transit Gateway and DNS](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-tg-dns-iam&interface=ui&format=markdown). {: tip} ## Before you begin {: #prerequisite-integration-with-dns-service-nlb} Before binding DNS zones to load balancers, you must first create DNS zones and grant load balancer access. 1. DNS zones must be created before they can be bound to a load balancer. For more information, see [Managing DNS zones](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-zones&format=markdown). 1. To give a load balancer access to your DNS zone, you must enable service-to-service authorization. This grants your load balancer access to the DNS zone. For more information, see [Granting access between services](https://cloud.ibm.com/docs/iam?topic=iam-serviceauth&interface=ui&format=markdown#create-auth). Make sure to choose **VPC Infrastructure Services** as the source service, **Load Balancer for VPC** as the resource type, **DNS Services** as the target service, and assign the **Manager** service access role. ## Working with DNS zones in the console {: #dns-zones-ui-nlb} {: ui} You can bind and unbind DNS zones to a network load balancer during provisioning, or to an existing load balancer. ### Binding DNS zones when creating a load balancer in the console {: #create-lb-with-dns-zone-ui-nlb} You can bind a DNS zone to a load balancer when you create a load balancer. If you do not specify a DNS zone during load balancer creation, the default zone is used. By default, the load balancer hostname is a subdomain of `lb.appdomain.cloud` and is publicly visible. To bind a DNS zone when [creating a load balancer](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-ui-creating-network-load-balancer&format=markdown), follow these steps: 1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login){: external} and log in to your account. 1. Select the **Navigation menu** ![Menu icon](../icons/icon_hamburger.svg), then click **Infrastructure** ![VPC icon](../../icons/vpc.svg) > **Network** > **Load balancers**. 1. Click **Create**. 1. Configure the VPC, type, subnet, listeners, and pools as needed. 1. Under the DNS type section, choose **Private**. 2. Click **Bind+** to enter DNS instance, and DNS zone information. 3. Click **Create** to provision the load balancer. ### Binding a DNS zone to an existing load balancer in the console {: #binding-dns-zone-to-lb-ui-nlb} To bind a DNS zone to an existing load balancer, follow these steps: 1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login){: external} and log in to your account. 1. Select the **Navigation menu** ![Menu icon](../../icons/icon_hamburger.svg), then click **Infrastructure > Network > Load balancers**. 1. From the list of load balancers, select the load balancer to view its details page. 1. Click **Bind private DNS** in the Private DNS section. 1. Enter the DNS instance, and DNS zone information. 1. Click **Bind private DNS** to bind the DNS zone to your load balancer. When migrating to a private DNS zone for an existing load balancer, the default A records in `lb.appdomain.cloud` are removed. To prepare your client devices, create a CNAME record with the default hostname under the wanted private DNS zone before the migration. After configuring all client devices to use the new private DNS zone, you can then delete the CNAME record and begin the migration. This allows the client devices to cache the private DNS hostname until the A records are created. {: tip} ### Unbinding a DNS zone to an existing load balancer in the console {: #unbinding-dns-zone-to-lb-ui-nlb} To unbind a DNS zone from a load balancer, follow these steps: 1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login){: external} and log in to your account. 1. Select the **Navigation menu** ![Menu icon](../../icons/icon_hamburger.svg), then click **Infrastructure > Network > Load balancers**. 1. From the list of load balancers, select the load balancer to view its details page. 1. Click the **Unbind** button in the Private DNS section 1. Verify the action by clicking **Unbind** again. ## Working with DNS zones from the CLI {: #dns-zones-cli-nlb} {: cli} You can bind and unbind DNS zones to a network load balancer during provisioning, or to an existing load balancer. ### Creating a load balancer bound to a private DNS zone from the CLI {: #create-lb-with-dns-zone-cli-nlb} You need the CRN of the private DNS that you want to bind to your load balancer. To find it, click **Navigation menu** ![Navigation menu icon](../../icons/icon_hamburger.svg) > **Resource List** from the IBM Cloud console. Click the table row of the DNS whose CRN you want to find. The CRN is shown in the side panel that appears. {: tip} To create a network load balancer with a private DNS zone, follow these steps: 1. Set up your [CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment&interface=cli&format=markdown). 1. Use the terminal to log in to your account. After you enter the password, the system prompts which account and region that you want to use: ```sh ibmcloud login --sso ``` {: pre} 1. Create your load balancer: ```sh ibmcloud is lbc pdns-nlb-example private --subnet 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 --family application --dns-instance-crn crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c:: --dns-zone-id 0671b738-57f0-468e-8086-10bc480ac00e ``` {: pre} Sample output: ```sh ID r014-e424acb0-24af-49a0-ab50-c5969304eb94 Name pdns-nlb-example CRN crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::load-balancer:r014-e424acb0-24af-49a0-ab50-c5969304eb94 Family Application Datapath logging active false Host name e424acb0-us-east.example.com Subnets ID Name 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 lb-subnet Public IPs Private IPs Provision status create_pending Operating status offline Is public false Listeners Pools ID Name Resource group ID Name 42c4f51adc3147b4b4049ad9826c30a1 Default Created 2023-02-10T13:18:11-06:00 DNS Instance CRN Zone crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c:: 0671b738-57f0-468e-8086-10bc480ac00e Instance Group Supported - SourceIP Session Supported - Security groups ID Name r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e astonish-backing-shadiness-frostlike-cosmos-hunk UDP Supported false ``` {: screen} ### Binding an existing load balancer to a private DNS zone from the CLI {: #binding-dns-zone-to-lb-cli-nlb} You need the CRN of the private DNS that you want to bind to your load balancer. To find it, click **Navigation menu** ![Navigation menu icon](../../icons/icon_hamburger.svg) > **Resource List** from the IBM Cloud console. Click the table row of the DNS whose CRN you want to find. The CRN is shown in the side panel that appears. {: tip} To use the CLI to update a network load balancer with a private DNS zone, follow these steps: 1. Set up your CLI environment. 1. Log in to your account using the CLI. After you enter the password, the system prompts which account and region that you want to use: ```sh ibmcloud login --sso ``` 1. Update your load balancer with the private DNS zone information: ```sh ibmcloud is load-balancer-update pdns-nlb-update-example --dns-instance-crn crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c:: --dns-zone-id 0671b738-57f0-468e-8086-10bc480ac00e ``` {: pre} Sample output: ```sh ID r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3 Name pdns-nlb-update-example CRN crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::load-balancer:r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3 Family Application Datapath logging active false Host name e68a40fb-us-east.example.com Subnets ID Name 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 lb-subnet Public IPs Reserved IPs ID Address Subnet 0767-16871e0f-c43a-4b6e-8491-a3e075362046 10.241.64.11 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 0767-a7db5d37-42cf-473e-ab27-07b679d64ceb 10.241.64.12 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 Provision status update_pending Operating status online Is public false Listeners Pools ID Name Resource group ID Name 42c4f51adc3147b4b4049ad9826c30a1 Default Created 2023-02-10T13:36:44-06:00 DNS Instance CRN Zone crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c:: 0671b738-57f0-468e-8086-10bc480ac00e Instance Group Supported - SourceIP Session Supported - Security groups ID Name r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e astonish-backing-shadiness-frostlike-cosmos-hunk UDP Supported false ``` {: screen} ### Unbinding an existing load balancer from a private DNS zone from the CLI {: #unbinding-dns-zone-to-lb-cli-nlb} To update a network load balancer with the default public DNS zone, follow these steps: 1. Set up your CLI environment. 1. Log in to your account. After you enter the password, the system prompts which account and region that you want to use: ```sh ibmcloud login --sso ``` {: pre} 1. Update your load balancer with `reset-dns` flag. ```sh ibmcloud is load-balancer-update pdns-nlb-update-example --reset-dns ``` {: pre} Sample output: ```sh ID r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3 Name pdns-nlb-update-example CRN crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::load-balancer:r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3 Family Application Datapath logging active false Host name e68a40fb-us-east.lb.appdomain.cloud Subnets ID Name 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 lb-subnet Public IPs Reserved IPs ID Address Subnet 0767-16871e0f-c43a-4b6e-8491-a3e075362046 10.241.64.11 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 0767-a7db5d37-42cf-473e-ab27-07b679d64ceb 10.241.64.12 0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 Provision status update_pending Operating status online Is public false Listeners Pools ID Name Resource group ID Name 42c4f51adc3147b4b4049ad9826c30a1 Default Created 2023-02-10T13:36:44-06:00 Instance Group Supported - SourceIP Session Supported - Security groups ID Name r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e astonish-backing-shadiness-frostlike-cosmos-hunk UDP Supported false ``` {: screen} ## Working with DNS zones with the API {: #dns-zones-api-nlb} {: api} You can bind and unbind DNS zones to a network load balancer during provisioning, or to an existing load balancer. ### Creating a load balancer bound to a private DNS zone with the API {: #create-lb-with-dns-zone-api-nlb} You need the CRN of the private DNS that you want to bind to your load balancer. To find it, click **Navigation menu** ![Navigation menu icon](../../icons/icon_hamburger.svg) > **Resource List** from the IBM Cloud console. Click the table row of the DNS whose CRN you want to find. The CRN is shown in the side panel that appears. {: tip} To specify a private DNS zone during creation: Specify the `dns` information in the `POST /load_balancers` call. For more information about this creation payload, see [Creating an application load balancer with the API](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers&interface=api&format=markdown#lb-api-creating-application-load-balancer). {: note} ```sh { "name": "pdns-nlb-example", "is_public": false, "dns": { "instance": { "crn": "crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c::" }, "zone": { "id": "0671b738-57f0-468e-8086-10bc480ac00e" } }, "subnets": [ { "id": "0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024" } ] } ``` {: pre} Sample output: ```sh { "id": "r014-eac21cde-a4ce-4980-b037-fc3507112955", "name": "pdns-nlb-example", "href": "https://us-east.iaas.cloud.ibm.com/v1/load_balancers/r014-eac21cde-a4ce-4980-b037-fc3507112955", "crn": "crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::load-balancer:r014-eac21cde-a4ce-4980-b037-fc3507112955", "is_public": false, "created_at": "2023-02-13T18:58:12Z", "hostname": "eac21cde-us-east.example.com", "listeners": [], "operating_status": "offline", "pools": [], "private_ips": [], "provisioning_status": "create_pending", "public_ips": [], "subnets": [ { "id": "0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "crn": "crn:v1:bluemix:public:is:us-east-2:a/be636a7a6e4d4b6296bedf669ce8f757::subnet:0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "name": "lb-subnet" } ], "resource_group": { "id": "42c4f51adc3147b4b4049ad9826c30a1", "href": "https://resource-controller.cloud.ibm.com/v1/resource_groups/42c4f51adc3147b4b4049ad9826c30a1", "name": "Default" }, "resource_type": "load_balancer", "logging": { "datapath": { "active": false } }, "profile": { "href": "https://us-east.iaas.cloud.ibm.com/v1/load_balancer/profiles/dynamic", "name": "dynamic", "family": "Application" }, "security_groups": [ { "id": "r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "href": "https://us-east.iaas.cloud.ibm.com/v1/security_groups/r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "crn": "crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::security-group:r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "name": "astonish-backing-shadiness-frostlike-cosmos-hunk" } ], "security_group_supported": true, "route_mode": false, "udp_supported": false, "dns": { "instance": { "crn": "crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c::" }, "zone": { "id": "0671b738-57f0-468e-8086-10bc480ac00e" } } } ``` {: screen} ### Binding an existing load balancer to a private DNS zone with the API {: #binding-dns-zone-to-lb-api-nlb} You need the CRN of the private DNS that you want to bind to your load balancer. To find it, click **Navigation menu** ![Navigation menu icon](../../icons/icon_hamburger.svg) > **Resource List** from the IBM Cloud console. Click the table row of the DNS whose CRN you want to find. The CRN is shown in the side panel that appears. {: tip} To use the API to bind an existing load balancer to a private DNS zone: Specify the `dns` information in the `PATCH /load_balancers` call. For more information about this `PATCH` payload, see [Creating an application load balancer with the API](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers&interface=api&format=markdown#lb-api-creating-application-load-balancer). {: note} ```sh { "dns": { "instance": { "crn": "crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c::" }, "zone": { "id": "0671b738-57f0-468e-8086-10bc480ac00e" } } } ``` {: pre} Sample output: ```sh { "id": "r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3", "name": "pdns-nlb-update-example", "href": "https://us-east.iaas.cloud.ibm.com/v1/load_balancers/r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3", "crn": "crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::load-balancer:r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3", "is_public": false, "created_at": "2023-02-10T19:36:44Z", "hostname": "e68a40fb-us-east.example.com", "listeners": [], "operating_status": "online", "pools": [], "private_ips": [ { "address": "10.241.64.11", "href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024/reserved_ips/0767-16871e0f-c43a-4b6e-8491-a3e075362046", "id": "0767-16871e0f-c43a-4b6e-8491-a3e075362046", "name": "yapping-extract-reawake-bullhorn", "resource_type": "subnet_reserved_ip" }, { "address": "10.241.64.12", "href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024/reserved_ips/0767-a7db5d37-42cf-473e-ab27-07b679d64ceb", "id": "0767-a7db5d37-42cf-473e-ab27-07b679d64ceb", "name": "dioxide-stylized-headway-despise", "resource_type": "subnet_reserved_ip" } ], "provisioning_status": "update_pending", "public_ips": [], "subnets": [ { "id": "0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "crn": "crn:v1:bluemix:public:is:us-east-2:a/be636a7a6e4d4b6296bedf669ce8f757::subnet:0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "name": "lb-subnet" } ], "resource_group": { "id": "42c4f51adc3147b4b4049ad9826c30a1", "href": "https://resource-controller.cloud.ibm.com/v1/resource_groups/42c4f51adc3147b4b4049ad9826c30a1", "name": "Default" }, "resource_type": "load_balancer", "logging": { "datapath": { "active": false } }, "profile": { "href": "https://us-east.iaas.cloud.ibm.com/v1/load_balancer/profiles/dynamic", "name": "dynamic", "family": "Application" }, "security_groups": [ { "id": "r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "href": "https://us-east.iaas.cloud.ibm.com/v1/security_groups/r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "crn": "crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::security-group:r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "name": "astonish-backing-shadiness-frostlike-cosmos-hunk" } ], "security_group_supported": true, "route_mode": false, "udp_supported": false, "dns": { "instance": { "crn": "crn:v1:bluemix:public:dns-svcs:global:a/be636a7a6e4d4b6296bedf669ce8f757:c7295f57-4d25-4832-9d7e-a032de0c278c::" }, "zone": { "id": "0671b738-57f0-468e-8086-10bc480ac00e" } } } ``` {: screen} ### Unbinding an existing load balancer from a private DNS zone with the API {: #unbinding-dns-zone-to-lb-api-nlb} To use the API to unbind an existing load balancer to a private DNS zone: Specify null `dns` information in the `PATCH /load_balancers call`. For more information about this `PATCH` payload, see [Creating an application load balancer with the API](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers&interface=api&format=markdown#lb-api-creating-application-load-balancer). {: note} ```sh { "dns": null } ``` {: pre} Sample output: ```sh { "id": "r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3", "name": "pdns-nlb-update-example", "href": "https://us-east.iaas.cloud.ibm.com/v1/load_balancers/r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3", "crn": "crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::load-balancer:r014-e68a40fb-2b94-4a92-b8bd-dc9bb92c3ef3", "is_public": false, "created_at": "2023-02-10T19:36:44Z", "hostname": "e68a40fb-us-east.lb.appdomain.cloud", "listeners": [], "operating_status": "online", "pools": [], "private_ips": [ { "address": "10.241.64.11", "href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024/reserved_ips/0767-16871e0f-c43a-4b6e-8491-a3e075362046", "id": "0767-16871e0f-c43a-4b6e-8491-a3e075362046", "name": "yapping-extract-reawake-bullhorn", "resource_type": "subnet_reserved_ip" }, { "address": "10.241.64.12", "href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024/reserved_ips/0767-a7db5d37-42cf-473e-ab27-07b679d64ceb", "id": "0767-a7db5d37-42cf-473e-ab27-07b679d64ceb", "name": "dioxide-stylized-headway-despise", "resource_type": "subnet_reserved_ip" } ], "provisioning_status": "update_pending", "public_ips": [], "subnets": [ { "id": "0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "crn": "crn:v1:bluemix:public:is:us-east-2:a/be636a7a6e4d4b6296bedf669ce8f757::subnet:0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024", "name": "lb-subnet" } ], "resource_group": { "id": "42c4f51adc3147b4b4049ad9826c30a1", "href": "https://resource-controller.cloud.ibm.com/v1/resource_groups/42c4f51adc3147b4b4049ad9826c30a1", "name": "Default" }, "resource_type": "load_balancer", "logging": { "datapath": { "active": false } }, "profile": { "href": "https://us-east.iaas.cloud.ibm.com/v1/load_balancer/profiles/dynamic", "name": "dynamic", "family": "Application" }, "security_groups": [ { "id": "r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "href": "https://us-east.iaas.cloud.ibm.com/v1/security_groups/r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "crn": "crn:v1:bluemix:public:is:us-east:a/be636a7a6e4d4b6296bedf669ce8f757::security-group:r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e", "name": "astonish-backing-shadiness-frostlike-cosmos-hunk" } ], "security_group_supported": true, "route_mode": false, "udp_supported": false, "dns": null } ``` {: screen}