[tptacek]

Yes; the original purpose of private DNS at Fly was for service discovery. `your-app.internal` is the AAAA's of every instance for your-app; `nrt.your-app.internal` every instance in Japan, `aws-rds-1._peer.internal` is AAAA for the other side of a WireGuard gateway you created to bridge your apps to an RDS database, etc.

[tucif]

When you say "the public key for that root certificate is hosted in our private DNS", does that mean the public key is in.. a txt record?

[tptacek]

Ayup.