docs: Draft changelog for November 11-12, 2026

changelog.mdx

@@ -6,10 +6,63 @@
 
 Each entry links to the original announcement in our [changelog discussions](https://github.com/orgs/datum-cloud/discussions/categories/changelog), where you can ask questions and leave feedback. To see what is coming next, read the [roadmap](/platform/roadmap).
 
+<Update label="November 12, 2026" description="datumctl" tags={["Fix"]}>
+  ## Pick the right private zone with `--vpc`
+
+  The `datumctl dns` plugin no longer guesses when several zones share a domain, so a record can't land in another VPC's zone.
+
+  - **Ambiguous zones are refused:** every VPC's default private zone is `datum.internal`. When more than one zone matches the domain you typed, the command stops and lists each zone's object name and the VPCs that use it.
+  - **New `--vpc <name>` flag:** uses the zone that VPC resolves. It works on every `record` command and on `zone describe`, `delete`, `nameservers`, `import`, and `export`, for private zones only.
+  - **Name a zone directly:** pass a zone's object name in place of the domain, for example `datumctl dns record list managed-3f9c2a`.
+  - Deleting a private zone asks you to confirm with its object name.
+  - Projects where each domain has only one zone see no change.
+
+  See [Private DNS](/domain-dns/private-dns).
+</Update>
+
+<Update label="November 11, 2026" description="Private DNS" tags={["Fix", "Early access"]}>
+  ## Private DNS is faster and more reliable
+
+  Instances can look up names in their own VPC through a private zone, and answers stay current as instances come and go.
+
+  - **Answers follow your instances:** when an instance is deleted, its old answers disappear within 1 to 2 seconds. A replacement's new address answers about 4 seconds after the instance is ready. Answers are cached for 30 seconds.
+  - **First lookup answers right away:** new instances get an answer to their first lookup immediately. Before, DNS gave no answer for 0 to 11 seconds after a deploy or restart, and apps that looked up a name at startup failed with `Temporary failure in name resolution`.
+  - **No failed lookups during rollouts:** DNS stays up through platform restarts, software updates and edge reboots, because servers drain traffic before they stop. Before, a single rollout caused about 75 seconds of failed lookups. Staging rollouts with steady lookups now lose none.
+  - **Several servers per resolver address:** several healthy DNS servers share one resolver address, with health checks, in all three regions. A lost host or edge affects only the instances on that host. Requests to a server on another host now get replies instead of timing out.
+  - **Status you can trust:** zone status shows within seconds whether your records are being served.
+  - **Isolation between VPCs:** each VPC's answers are isolated from every other VPC. Removing a zone from a VPC returns `NXDOMAIN`, and deleting a VPC withdraws its access from every DNS server. Only the platform can change which DNS a VPC uses.
+
+  Private DNS is in preview. See [Private DNS](/domain-dns/private-dns).
+</Update>
+
+<Update label="November 11, 2026" description="Application Load Balancer" tags={["Fix"]}>
+  ## New proxies answer within seconds
+
+  A new proxy now answers its first request within seconds in every region, including when its workload runs in a different region than the edge.
+
+  - **Before:** a cross-region proxy returned `503` for about 2 minutes 48 seconds, and sometimes until an unrelated change rebuilt the edge.
+  - **Now:** in production, a new cross-region proxy answered in 17.5 seconds with no `503` responses, and 30 follow-up requests all succeeded.
+  - **Network settings reach every instance:** every instance reliably sees changes to VPC network settings, including after a platform restart.
+
+  See [ALB troubleshooting](/alb/troubleshooting).
+</Update>
+
+<Update label="November 11, 2026" description="Cloud Portal" tags={["AX/DX/UX"]}>
+  ## Keyboard access and plain permission messages
+
+  The [Cloud Portal](https://cloud.datum.net) is easier to use from the keyboard and explains permission errors in plain language.
+
+  - **Keyboard access:** clickable table rows open with Enter or Space, and the copy badge copies with Enter or Space.
+  - **Plain permission errors:** raw access-control text is replaced with "You don't have permission to do this." Messages about quota or suspension keep their own wording.
+  - **Restricted pages** say "An organization owner or admin can give you access."
+  - **Labelled buttons:** a secret's edit and delete buttons are named for screen readers after the key they act on.
+  - A DNS zone's settings show DNSSEC as off, with the note "DNSSEC is not available for DNS zones yet."
+</Update>
+
 <Update label="November 10, 2026" description="Application Load Balancer" tags={["Fix"]}>
   ## New load balancers serve traffic sooner
 
   - **Fixed:** a new ALB no longer returns `503` for several minutes when its compute workload runs in a different location than the edge serving the request. Datum now rebuilds the load balancer's routing as soon as it learns which network the workload is on.
 
   See [ALB troubleshooting](/alb/troubleshooting).
 </Update>
@@ -37,7 +90,7 @@
   - **Fixed:** deleting a listener works on the first try.
   - **Fixed:** the **Add listener** dialog no longer flashes a warning as it closes.
 
   NLBs are early access. See [Network services](/galactic-vpc/networks/network-services).
 </Update>
 
 <Update label="November 6, 2026" description="datumctl" tags={["AX/DX/UX"]}>
@@ -150,7 +203,7 @@
   - **Managed zone:** every network gets its own `datum.internal` zone. Compute publishes each Instance at `<instance-name>.instances.datum.internal`. See [Private DNS for Compute](/compute/private-dns).
   - **Your own private zones:** associate private zones with a network for internal names. The zone class is now optional for private zones.
   - **Network isolation:** a network can't be pointed at another network's private DNS, and the same names can be reused across networks without leaking answers.
   - **Availability:** lookups go only to healthy DNS servers, so server updates no longer stall lookups until they time out.
   - **Regions:** a private zone is served only in the regions its networks use, and is withdrawn from regions it leaves.
   - **Fixed:** a CNAME that points into another private zone now returns the target's answer over UDP, not just the CNAME.
   - **Fixed:** the managed `datum.internal` zone can't be deleted while its network uses it. Deleting a project still removes it.
@@ -165,11 +218,11 @@
   Publish a network service on a public TCP or UDP port with a network load balancer (NLB).
 
   - **Addresses and hostnames:** each location gets a public IPv6 address and a generated hostname you can point a CNAME at. IPv4 is available for single-port listeners where Datum has enabled it.
   - **Health checks:** NLBs actively check backends and send new connections only to healthy ones.
   - **UDP ports:** network services now accept UDP ports, and the create-service dialog has a TCP/UDP selector per port. A UDP listener also needs a TCP port on the backend for its health check.
   - **Portal:** create an NLB, copy its hostname and address, and add, edit, or delete listeners in the [Cloud Portal](https://cloud.datum.net).
 
   NLBs are early access. TLS listeners aren't supported yet, but a TCP listener forwards TLS traffic unchanged to your backend. Each route serves one backend. An ALB that points at a UDP port now reports a clear unsupported-protocol error.
 
   See [Network services](/galactic-vpc/networks/network-services).
 </Update>
@@ -191,7 +244,7 @@
   When a custom hostname's DNS is hosted outside Datum, the [Cloud Portal](https://cloud.datum.net) now shows whether it points at your ALB.
 
   - **DNS Ready** appears once Datum sees the CNAME or matching IPs pointing at the ALB.
   - **Awaiting DNS** appears until then, with a tooltip that names the record to add. The chip no longer spins indefinitely.
   - **Fixed:** an ALB whose single backend carries the Host override can now be edited in the portal instead of showing **Managed with datumctl**.
 
   See [Custom domains](/alb/operations/custom-domains).