Supported Providers
Integrated providers
Section titled “Integrated providers”All of the following providers are implemented. Field-tested means: verified with real credentials and real zones against the provider’s production API.
| Provider | Identifier | Status |
|---|---|---|
| Hetzner Cloud DNS | hetzner | ✅ field-tested |
| IONOS | ionos | ✅ field-tested |
| hosting.de | hostingde | ✅ field-tested |
| netcup | netcup | ✅ field-tested |
| PowerDNS | powerdns | implemented |
| Cloudflare | cloudflare | implemented |
| AWS Route 53 | route53 | implemented |
| Google Cloud DNS | gclouddns | implemented |
| Azure DNS | azuredns | implemented |
| GoDaddy | godaddy | implemented |
| DigitalOcean DNS | digitalocean | implemented |
| deSEC | desec | implemented |
| Porkbun | porkbun | implemented |
On top of that, demo mode adds an in-memory provider (demo) that sends
nothing to the outside.
Planned providers
Section titled “Planned providers”These widely used providers are on the list for future integrations (ordered by demand):
- OVHcloud
- Gandi
- Namecheap
- INWX
- STRATO
- Akamai (Linode) DNS
- Vultr
- DNSimple
- NS1 (IBM)
Capturing credentials
Section titled “Capturing credentials”Every integration brings its own fields — sometimes a single API token, sometimes key plus secret plus zone identifier. The form shows exactly the fields of the selected provider, along with:
- a portal link to where the key is created at the provider,
- a docs link to its API documentation,
- a short guide in text form, because the way there differs with every provider.
Test connection verifies the details immediately against the API. The account then carries one of the states connected, auth error, unreachable, or disabled.
When the probe fails, the provider’s own message appears verbatim below the status — HTTP status and error text, or the address that could not be reached on a network failure. That tells apart the cases which otherwise all look the same: a wrong key, a missing permission, a blocked egress, or an IPv6 address without a route.
Credentials are stored envelope-encrypted in the database and are never returned via the API.
Capabilities
Section titled “Capabilities”Not every provider can do the same things. Every integration reports its capabilities, and the interface follows them — instead of offering buttons that lead nowhere at the provider:
| Capability | Meaning |
|---|---|
ZoneManagement | create/remove zones via the API |
DNSSEC | DNSSEC management via the API |
DynDNS | provider’s own DynDNS service |
ZoneTransfer | AXFR/zone transfer |
Protection | deletion protection on the provider side |
AliasAtApex | ALIAS/ANAME at the zone apex |
AtomicBulk | multiple changes in a single call |
ReadOnlyNS | apex NS entries cannot be changed via the API |
SupportedTypes | restriction to specific record types |
A provider with AtomicBulk (such as deSEC) receives all changes of a zone
in a single call; for the rest, writes happen per record set.
New integration
Section titled “New integration”An adapter implements the provider interface (Zones, RRsets,
ApplyChanges, Health) and registers its descriptor and capabilities with
the registry. Details in Contributing.