> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Get global DNS > The Global DNS: forwarders and rules every supervisor's central DNS **Authorisation:** `settings:Read` on `krn:celum:settings:global`. **Assistant tool:** `get_global_dns` ## OpenAPI ````yaml /openapi.json get /api/dns openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/dns: get: tags: - networking summary: Get global DNS description: |- The Global DNS: forwarders and rules every supervisor's central DNS **Authorisation:** `settings:Read` on `krn:celum:settings:global`. **Assistant tool:** `get_global_dns` operationId: get_dns responses: '200': content: application/json: schema: $ref: '#/components/schemas/api.globalDNSResponse' description: Success. '401': description: Not authenticated — no valid session cookie or API token. '403': description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '500': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Internal Server Error. '503': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Service Unavailable. components: schemas: api.globalDNSResponse: properties: encryptedDnsDefault: type: boolean encryptedDnsShipped: items: $ref: '#/components/schemas/api.EncryptedDNSServer' nullable: true type: array feeds: items: $ref: '#/components/schemas/api.dnsFeedStatus' nullable: true type: array revision: type: string settings: $ref: '#/components/schemas/api.GlobalDNS' supervisors: items: $ref: '#/components/schemas/api.globalDNSPush' type: array threatsDefault: type: boolean updatedAt: format: date-time type: string updatedBy: type: string required: - encryptedDnsShipped - feeds - settings type: object x-go-type: backend/internal/api.globalDNSResponse api.ErrorBody: properties: error: type: string required: - error type: object api.EncryptedDNSServer: properties: hostnames: items: type: string nullable: true type: array name: type: string protocols: items: type: string nullable: true type: array required: - hostnames - name - protocols type: object x-go-type: backend/internal/api.EncryptedDNSServer api.dnsFeedStatus: properties: attemptedAt: format: date-time type: string entryCount: format: int64 type: integer fetchedAt: format: date-time type: string kind: type: string rejectedCount: format: int64 type: integer rejectedSamples: items: type: string nullable: true type: array status: type: string truncated: type: boolean url: type: string required: - entryCount - kind - rejectedCount - rejectedSamples - url type: object x-go-type: backend/internal/api.dnsFeedStatus api.GlobalDNS: properties: encryptedDns: $ref: '#/components/schemas/api.EncryptedDNSPolicy' rules: items: $ref: '#/components/schemas/k8s.NodeDNSRule' nullable: true type: array threats: $ref: '#/components/schemas/api.ThreatDNSPolicy' upstreams: items: type: string nullable: true type: array required: - rules - upstreams type: object x-go-type: backend/internal/api.GlobalDNS api.globalDNSPush: properties: detail: type: string state: type: string supervisor: type: string required: - state - supervisor type: object x-go-type: backend/internal/api.globalDNSPush api.EncryptedDNSPolicy: properties: block: type: boolean feeds: items: $ref: '#/components/schemas/api.DNSListFeed' nullable: true type: array servers: items: $ref: '#/components/schemas/api.EncryptedDNSServer' nullable: true type: array required: - block - feeds - servers type: object x-go-type: backend/internal/api.EncryptedDNSPolicy k8s.NodeDNSRule: properties: action: type: string answers: items: type: string type: array comment: type: string name: type: string pattern: type: string servers: items: type: string type: array ttl: format: int64 type: integer types: items: type: string type: array zone: type: string required: - action type: object x-go-type: backend/internal/k8s.NodeDNSRule api.ThreatDNSPolicy: properties: allow: items: type: string nullable: true type: array block: type: boolean feeds: items: $ref: '#/components/schemas/api.DNSListFeed' nullable: true type: array honeypot: type: boolean names: items: type: string nullable: true type: array sinkholeIpv4: type: string sinkholeIpv6: type: string required: - allow - block - feeds - honeypot - names - sinkholeIpv4 - sinkholeIpv6 type: object x-go-type: backend/internal/api.ThreatDNSPolicy api.DNSListFeed: properties: enabled: type: boolean kind: type: string url: type: string required: - enabled - kind - url type: object x-go-type: backend/internal/api.DNSListFeed securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.