Supported Providers

Integrated providers

Provider	Identifier
PowerDNS	`powerdns`
Hetzner Cloud DNS	`hetzner`
IONOS	`ionos`
hosting.de	`hostingde`
netcup	`netcup`
Cloudflare	`cloudflare`
AWS Route 53	`route53`
Google Cloud DNS	`gclouddns`
Azure DNS	`azuredns`
GoDaddy	`godaddy`
DigitalOcean DNS	`digitalocean`
deSEC	`desec`

On top of that, demo mode adds an in-memory provider (demo) that sends nothing to the outside.

Capturing credentials

Every integration brings its own fields — sometimes a single API token, sometimes key plus secret plus zone identifier. The form shows exactly the fields of the selected provider, along with:

a portal link to where the key is created at the provider,
a docs link to its API documentation,
a short guide in text form, because the way there differs with every provider.

Test connection verifies the details immediately against the API. The account then carries one of the states connected, auth error, unreachable, or disabled.

Credentials are stored envelope-encrypted in the database and are never returned via the API.

Capabilities

Not every provider can do the same things. Every integration reports its capabilities, and the interface follows them — instead of offering buttons that lead nowhere at the provider:

Capability	Meaning
`ZoneManagement`	create/remove zones via the API
`DNSSEC`	DNSSEC management via the API
`DynDNS`	provider’s own DynDNS service
`ZoneTransfer`	AXFR/zone transfer
`Protection`	deletion protection on the provider side
`AliasAtApex`	ALIAS/ANAME at the zone apex
`AtomicBulk`	multiple changes in a single call
`ReadOnlyNS`	apex NS entries cannot be changed via the API
`SupportedTypes`	restriction to specific record types

A provider with AtomicBulk (such as deSEC) receives all changes of a zone in a single call; for the rest, writes happen per record set.

New integration

An adapter implements the provider interface (Zones, RRsets, ApplyChanges, Health) and registers its descriptor and capabilities with the registry. Details in Contributing.