← Back to Docs

Connecting DNS Providers

Step-by-step guides for generating API credentials from each supported provider.

☁️

Cloudflare

API Token

1. Log in to your Cloudflare Dashboard.

2. Go to My Profile (top right) → API Tokens.

3. Click Create Token.

4. Use the Edit zone DNS template, or create a custom token with these permissions:

Zone → DNS → Edit
Zone → Zone → Read
Account → Account Settings → Read (optional, for account info)

5. Under Zone Resources, select All zones (or specific zones).

6. Click Continue to Summary → Create Token.

7. Copy the token and paste it into the DNS SaaS API Token field.

Field mapping: API Token → api_token

🏰

Hetzner DNS

API Token

1. Log in to your Hetzner DNS Console.

2. Click your avatar (top right) → API Tokens.

3. Click Create API Token.

4. Give it a name (e.g. "DNS SaaS") and select permissions:

Read — list zones and records
Write — create/update zones and records

5. Click Create Access Token.

6. Copy the token immediately (it won't be shown again) and paste it into the DNS SaaS API Token field.

Field mapping: API Token → api_token

🌊

DigitalOcean

Personal Access Token

1. Log in to your DigitalOcean Control Panel.

2. Go to API (left sidebar) → Tokens/Keys.

3. Click Generate New Token.

4. Give it a name (e.g. "DNS SaaS") and select scopes:

Check Write (includes read) for full DNS management

5. Click Generate Token.

6. Copy the token and paste it into the DNS SaaS API Token field.

Field mapping: Personal Access Token → api_token

🚀

Vultr

API Key

1. Log in to your Vultr Account.

2. Go to Account → API (or direct link).

3. Under API Access, click Enable API if it isn't already.

4. Set the Allowed IP Addresses field to allowlist the DNS SaaS server IP (or leave blank for any IP).

5. Under API Key, click Copy.

6. Paste the key into the DNS SaaS API Token field.

Field mapping: API Key → api_token

🗺️

AWS Route53

IAM Access Key + Secret Key

1. Log in to your AWS Console.

2. Go to IAM → Users.

3. Click Create user (or select an existing one). Name it e.g. dns-saas.

4. Attach the following policy directly (or create a custom one):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZones",
                "route53:GetHostedZone",
                "route53:ListResourceRecordSets",
                "route53:ChangeResourceRecordSets"
            ],
            "Resource": "*"
        }
    ]
}

5. Click Create user.

6. Go to the user → Security credentials → Create access key.

7. Choose Other (not CLI/SSH/Code) → Next → Create.

8. Copy the Access Key ID and Secret Access Key.

9. In DNS SaaS, set API Key = Access Key ID, API Secret = Secret Key, API Endpoint (Region) = your AWS region (e.g. us-east-1).

Field mapping: Access Key ID → api_key, Secret Key → api_secret, Region → api_endpoint

👻

GoDaddy

API Key + API Secret

1. Log in to your GoDaddy Developer Portal.

2. Go to API Keys.

3. Click Create New API Key.

4. Select Production (not Test/O TE).

5. Give it a name (e.g. "DNS SaaS") and set the scope to include:

Domains — Read/Write (for listing domains)
DNS — Read/Write (for managing records)

6. Click Create.

7. Copy both the API Key and API Secret. The secret is only shown once.

8. In DNS SaaS, paste them into the API Key and API Secret fields.

Note: GoDaddy only allows DNS management for domains registered through their platform. If your domain is registered elsewhere, use Cloudflare or another provider.

Field mapping: API Key → api_key, API Secret → api_secret

🖧

Custom DNS (TSIG)

TSIG Key Name + Secret

For self-hosted DNS servers (BIND, PowerDNS, Knot) that support TSIG (RFC 2136 dynamic DNS updates).

1. SSH into your DNS server and generate a TSIG key:

# Generate a TSIG key

tsig-keygen dns-saas-key

Or if you're on an older BIND version: dnssec-keygen -a HMAC-SHA256 -b 256 -n HOST dns-saas-key

2. View the generated key (look for Key: in the .private or .key file):

cat Kdns-saas-key.*.key

3. Add the key to your named.conf (or equivalent):

key "dns-saas-key" {
    algorithm hmac-sha256;
    secret "BASE64_SECRET_HERE";
};

zone "example.com" {
    type master;
    file "/var/named/example.com.zone";
    allow-update { key "dns-saas-key"; };
};

4. Reload BIND:

rndc reload

rndc reload example.com # or reload a specific zone

5. In DNS SaaS, create a Custom DNS connection:

TSIG Key Name — the key name you used (e.g. dns-saas-key)
TSIG Secret — the base64 secret from the key file
Nameserver IP — your DNS server's IP address
Port — usually 53
Algorithm — must match what you used (default: hmac-sha256)
Zone Domains — list the domains this key can manage (one per line)

⚠️ Important: TSIG authenticates the connection, not the user. Make sure your firewall restricts access to trusted IPs. The TSIG secret gives full update access to the zones you allow in named.conf.

Field mapping: TSIG Key Name → api_key, TSIG Secret → api_secret, Server IP → api_endpoint

🔄

Other DNS Server Software

PowerDNS, Knot, NSD

🦸 PowerDNS Authoritative Server

⚠️ Important: DNS update (RFC 2136) support was removed from the open source PowerDNS Authoritative Server starting from version 4.5.0 (released 2022). It is only available in the commercial PowerDNS DNS product or older PDNS 4.4.x and earlier.

PowerDNS uses a dnsupdate directive in its configuration instead of allow-update.

1. Generate a TSIG key using pdnsutil:

pdnsutil generate-tsig-key dns-saas-key hmac-sha256

2. Enable DNS update for a domain:

pdnsutil set-meta example.com ALLOW-DNSUPDATE 1

pdnsutil set-meta example.com TSIG-ALLOW-DNSUPDATE dns-saas-key

pdnsutil set-meta example.com ALLOW-DNSUPDATE-FROM 0.0.0.0/0

3. Restart PowerDNS:

systemctl restart pdns

4. Test DNS update:

echo "update add test.example.com 300 A 1.2.3.4" | nsupdate -y hmac-sha256:dns-saas-key:SECRET

On PowerDNS 4.5+ open source, use Knot or BIND instead for DNS update support.

🎀 Knot DNS

✅ Verified: Knot DNS 3.5.4 tested with TSIG dynamic updates. Full CRUD confirmed working.

1. Generate a TSIG key with keymgr:

keymgr -t dns-saas-key hmac-sha256

Outputs: BASE64_SECRET

2. Add the key and ACL to knot.conf:

key:
  - id: dns-saas-key
    algorithm: hmac-sha256
    secret: BASE64_SECRET

acl:
  - id: dns-saas-acl
    key: dns-saas-key
    action: update

zone:
  - domain: example.com
    acl: dns-saas-acl

3. Reload Knot:

knotc reload

🌐 NSD (NLnet Labs)

❌ Not supported: NSD does not support TSIG dynamic updates (RFC 2136) natively. It is authoritative-only.

For dynamic updates with NSD, use a secondary BIND or Knot server that receives zone transfers from NSD.

Alternatively, use Knot or BIND directly if you need RFC 2136 dynamic update support.

�� Windows Server DNS

1. Open DNS Manager (dnsmgmt.msc).

2. Right-click the server → Properties → Security tab.

3. Add a TSIG key via PowerShell:

Add-DnsServerResourceRecord -ZoneName "example.com" -Name "dns-saas-key"

# Not directly supported — use BIND-style key generation

4. Windows DNS Server does not natively support TSIG for dynamic updates. Use the dnscmd tool or deploy a BIND/Docker sidecar:

# Use WSL2 with BIND as a TSIG proxy:

wsl --install -d Ubuntu

sudo apt install bind9

# Configure BIND as forwarder to Windows DNS

⚠️ Note: Windows DNS Server has limited TSIG support. For production, use BIND/PowerDNS/Knot on a Linux VM or container alongside your Windows DNS server.

🖥️

OS-Specific Setup Guides

Install & configure BIND on various platforms

🐧 Debian / Ubuntu

# Install BIND

sudo apt update && sudo apt install bind9 bind9utils bind9-doc

# Config path: /etc/bind/named.conf

# Zone files: /var/lib/bind/

# Generate TSIG key

tsig-keygen dns-saas-key | sudo tee -a /etc/bind/named.conf

# Reload

sudo systemctl restart bind9

📦 RHEL / Rocky Linux / AlmaLinux / CentOS

# Install BIND

sudo dnf install bind bind-utils

# Config path: /etc/named.conf

# Zone files: /var/named/

# Generate TSIG key

tsig-keygen dns-saas-key | sudo tee -a /etc/named.conf

# Enable on boot

sudo systemctl enable --now named

🟦 Fedora

# Install BIND

sudo dnf install bind bind-utils

# Config path: /etc/named.conf

# Config directory: /etc/named/

# Zone files: /var/named/

# Generate TSIG key

tsig-keygen dns-saas-key | sudo tee -a /etc/named.conf

# Reload

sudo rndc reload

# Firewall

sudo firewall-cmd --add-service=dns --permanent && sudo firewall-cmd --reload

🦎 openSUSE

# Install BIND

sudo zypper install bind bind-utils

# Config path: /etc/named.conf

# Zone files: /var/lib/named/

# Generate TSIG key

tsig-keygen dns-saas-key | sudo tee -a /etc/named.conf

# Reload

sudo rndc reload

🧑‍💻 Arch Linux

# Install BIND

sudo pacman -S bind

# Config path: /etc/named.conf

# Zone files: /var/named/

# Generate TSIG key

tsig-keygen dns-saas-key | sudo tee -a /etc/named.conf

# Enable on boot

sudo systemctl enable --now named

🐳 Docker (BIND on any OS)

# Run a BIND container with TSIG support

docker run -d --name=bind --restart=unless-stopped \

-p 53:53/tcp -p 53:53/udp \

-v /path/to/named.conf:/etc/bind/named.conf \

-v /path/to/zones:/var/bind/zones \

ubuntu/bind9

# Or use the official image:

docker run -d --name=bind -p 53:53/tcp -p 53:53/udp \

-e NAMED_CONF=/etc/bind/named.conf \

internetsystemsconsortium/bind9:9.18

BIND inside Docker works identically — follow the BIND TSIG guide above for config.

🍎 macOS (Homebrew)

# Install BIND via Homebrew

brew install bind

# Config path: /usr/local/etc/named.conf (Intel) or /opt/homebrew/etc/named.conf (Apple Silicon)

# Zone files: /usr/local/var/named/

# Run as a service

brew services start bind

# Generate TSIG key

tsig-keygen dns-saas-key | sudo tee -a /usr/local/etc/named.conf

# Reload

sudo rndc reload

😈 FreeBSD

# Install BIND

pkg install bind918

# Config path: /usr/local/etc/namedb/named.conf

# Zone files: /usr/local/etc/namedb/dynamic/

# Enable on boot

sysrc named_enable=YES && service named start

# Generate TSIG key

tsig-keygen dns-saas-key | sudo tee -a /usr/local/etc/namedb/named.conf

# Reload

sudo rndc reload

Quick Reference

Provider	Field 1	Field 2	Field 3
Cloudflare	API Token → `api_token`	—	—
Hetzner DNS	API Token → `api_token`	—	—
DigitalOcean	PAT → `api_token`	—	—
Vultr	API Key → `api_token`	—	—
AWS Route53	Access Key → `api_key`	Secret Key → `api_secret`	Region → `api_endpoint`
GoDaddy	API Key → `api_key`	API Secret → `api_secret`	—
Custom DNS (TSIG)	TSIG Key Name → `api_key`	TSIG Secret → `api_secret`	Server IP → `api_endpoint`

Testing Your Connection

After connecting a provider, you can test the connection from the command line:

# Test a provider with credentials

php artisan dns:test-providers --provider=cloudflare --token=abc123

php artisan dns:test-providers --provider=godaddy --key=key --secret=secret

php artisan dns:test-providers --provider=route53 --key=AKI... --secret=... --endpoint=us-east-1

# Run mock tests (no real API calls)

php artisan dns:test-providers --mock

More Docs

🚀 Getting Started 📁 Managing Zones 📝 DNS Records 🔗 Connecting Providers ⚡ API Reference

Connecting DNS Providers

Cloudflare

Hetzner DNS

DigitalOcean

Vultr

AWS Route53

GoDaddy

Custom DNS (TSIG)

Other DNS Server Software

🦸 PowerDNS Authoritative Server

🎀 Knot DNS

🌐 NSD (NLnet Labs)

��� Windows Server DNS

OS-Specific Setup Guides

🐧 Debian / Ubuntu

📦 RHEL / Rocky Linux / AlmaLinux / CentOS

🟦 Fedora

🦎 openSUSE

🧑‍💻 Arch Linux

🐳 Docker (BIND on any OS)

🍎 macOS (Homebrew)

😈 FreeBSD

Quick Reference

Testing Your Connection

More Docs

�� Windows Server DNS