Allow root admin to configure DNS servers on behalf of a specific user/domain and support project-scoped DNS servers

[sudo87]

The required feature described as a wish

Currently, a DNS server can only be set up for the calling account/domain, there is no way for a root admin to configure one on behalf of a different account or domain, and no way for a DNS server to belong to a project.

As a root admin, I would like to be able to:

1. Set up a DNS server on behalf of a specific user/account
2. Set up a DNS server on behalf of a specific domain
3. Attach a DNS server to a project

Additional constraint:

4. If a DNS server was set up by root admin on behalf of a user/domain, that user/domain should not be able to modify its URL themselves. Only root admin (or whoever provisioned it) should be able to change it.

Motivation:

Asks 1 and 2 are primarily driven by the recent restriction that only root admin can configure a DNS server on a private/internal (RFC1918) address, domain admins and regular users can no longer do so directly (see PR #13821). Without a way for root admin to provision such a server on behalf of another account/domain, that use case is lost entirely for non-root-admin users.

Ask 3 (project support) wasn't part of the initial scope for this feature. It's being tracked here as a follow-up enhancement rather than a gap in the original design.

Ask 4 follows directly from 1 and 2: if the owning user/domain could freely change the URL afterward, they could redirect an admin-provisioned DNS server anywhere they like, defeating the purpose of restricting private-address setup to root admin in the first place.

[github-actions]

🎯 Triage report

Requests that root admins be able to configure DNS servers on behalf of another account/domain (not just their own), and for DNS servers to optionally be scoped to a project, with a constraint that admin-provisioned DNS servers can't have their URL changed by the target account/domain. Motivated by a recent restriction (PR #13821) limiting private-address DNS server configuration to root admin only, which otherwise removes this capability entirely for non-root-admin users.

📊 Assessment

Dimension	Value	Reasoning
Type	type:new-feature	Adds new capability (cross-account/domain provisioning, project scoping) not previously possible
Component	component:networking	DNS server configuration is a networking feature
Severity	n/a	Not a bug
Labels	type:new-feature, component:networking
Coding agent	Needs more info	Clear motivation and constraints (1-4) are given, but API parameter/permission design and exact enforcement points aren't specified — needs a design pass before implementation

🔗 Similar issues

No similar open issues found. (References PR #13821 as related prior work that created the need for this feature.)

💡 Notes and suggestions

Consider whether this should be scoped as one FS (for account/domain provisioning) with project support tracked as a separate, smaller follow-up enhancement, as the issue itself notes project support wasn't part of the original design scope.

Generated by Daily Issue Triage · sonnet50 233.4K · ◷

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9