Infrastructure software gets judged on the worst night it ever has, not the best demo it ever gives. Everything below exists because of a night like that.
Imports, migrations, CIDR planning, DNSSEC key operations — each shows the resulting diff before anything is written. Most famous DNS outages were a valid-looking change pushed straight to production; a preview is the cheapest guard against the whole class.
The DNS and DHCP engines run as containers the control plane owns but does not gate. If the manager is down, resolution keeps working. A management plane that can take out the data plane is a liability, not a feature.
A new image is written to the inactive slot while the current one keeps serving, and only a healthy boot gets to keep it. Rollback is not a runbook step someone has to remember at 3am; it is the default outcome of a bad boot.
An evaluation runs beside your production system with nothing dispatched to your servers. We replay your real queries at both systems and diff the answers. Cutover happens one zone at a time, with the old server kept warm.
Append-only, tamper-evident, and complete enough that compliance evidence collects itself. If you cannot show who changed what and when, you do not have a control — you have a hope.
We manage existing Windows DNS and DHCP over WinRM with nothing installed on your domain controllers. Every agent is a thing to patch, break and explain to a security review.
We use AI heavily and say so, because the alternative — quietly using it and implying artisanal hand-craft — is the dishonest option.
AI is why our migration prices are a fraction of the incumbents’: it does the heavy lifting on the repetitive parts, and our specialists own everything that requires judgment.
Beyond the product, this is the ground we actually stand on. If your problem is next door to it, ask — and if it is not something we should be doing, we will say so.
DNS, DHCP and address management in production — including the incumbent DDI platforms, which is how we know precisely where they are excellent and where they overcharge.
AWS, Azure, Google Cloud and Cloudflare as places we actually work. Multi-cloud DNS is a first-class driver in the product because it was a first-class problem for us.
Infrastructure as code, CI/CD, config management and the discipline that comes with them: reproducible builds, reviewable changes, no snowflake servers.
Docker and Kubernetes in anger. It’s why the appliance embeds k3s, why the product also ships as a Helm chart and a Compose file, and why the engines keep serving when the control plane is down.
AI used where it earns its place: migration workflows, config import, an operator copilot. Every change it proposes is reviewed and approved by a human before it commits.
DNSSEC, RBAC against LDAP/OIDC/SAML/RADIUS/TACACS+, tamper-evident audit trails, and the evidence collection that turns an audit from weeks into days.
SpatiumDDI is feature-complete and in beta. It goes into business-critical production only after an explicit production-readiness bar is met — a hardening and QA program we run against a synthetic environment built to break it. Until then the honest path is the one we recommend to everyone: run it free, prove it beside your incumbent, and cut over when the evidence says you should.