Providers
Registrars
Connect a domain registrar to change nameservers and DNSSEC DS records during cutover. Compare automated and guided flows, access, and safety checks.
4 min read
On this page
Registrar connections let DNSMigrator change a domain’s nameservers and, where the registrar API supports it, remove or publish DS records during cutover. Registrar access is optional: We switch it uses an active connection, while I'll switch it gives you the values and verifies each public change.
DNS provider versus registrar#
The DNS provider serves the zone’s records. The registrar controls the domain’s delegation at the registry. They may be the same company, but DNSMigrator treats the two roles separately so a source or destination DNS credential does not automatically receive domain-registration access.
Connect the source and destination under Connections for preview and apply. Add a registrar connection only if you want automatic delegation changes or want a managed zone associated with the account that holds its domain.
Connect the registrar#
You need the Admin or Owner role.
Open the registrar picker
Go to Connections, select Connect a provider, then filter by Registrar. From a migration with no active registrar connection, Cut over → We switch it also tells you to connect the registrar first.
Grant domain-level access
Open the generated provider page and create the requested registrar credential. It needs to read the domain and change nameservers. Add DS-record permissions if that registrar exposes them and the domain uses DNSSEC.
Connect and check access
Enter a useful Name, fill the fields, then select Connect. The account must be Active before the automatic cutover list includes it. Use Check access after changing its permissions or IP allow-list.
Choose it for the domain
After the migration is Applied or Verified, open Cut over, choose We switch it, and select the Registrar account that holds the domain. DNSMigrator records the current delegation before starting.
See Namecheap, Amazon Route 53, GoDaddy or the full provider directory for credential fields and official setup links.
Automation coverage#
Every implemented registrar adapter except DNS over HTTPS can request a nameserver change. DNS-over-HTTPS is read-only and works only with guided cutover; DS support is optional in writable adapters, so an otherwise automatic cutover can still pause for a manual DNSSEC registry step.
| Registrar API coverage | Providers |
|---|---|
| Nameservers and DS records | Amazon Route 53, AutoDNS, CentralNic Reseller, ClouDNS, CSC Global, DNSimple, Dynadot, Gandi, hosting.de, INWX, Name.com, OpenSRS, OVHcloud, Porkbun, Realtime Register |
| Nameservers; DS steps are guided | easyname, GidiNET, GoDaddy, Internet.bs, Loopia, Namecheap, Tencent Cloud DNSPod |
| Read-only discovery | DNS over HTTPS |
“Nameservers and DS records” means the adapter implements both operations. A provider can still reject a particular domain, top-level domain, DS algorithm or account policy. DNSMigrator pauses the step and shows the returned message rather than assuming the registry changed.
23 providers
| Provider | DNS | Registrar | DNSControl id | Authentication |
|---|---|---|---|---|
| Amazon Route 53cloud | stable | beta | ROUTE53 | Cross-account IAM role with an external ID |
| ClouDNShosting | beta | beta | CLOUDNS | API user auth ID (or sub-user ID/name) + password |
| DNSimpleregistrar | beta | beta | DNSIMPLE | Account API access token |
| Gandi LiveDNSregistrar | beta | beta | GANDI_V5 | Personal access token (legacy API key also accepted) |
| GoDaddy DNSregistrar | stable | beta | — | Production API key + secret |
| Name.comregistrar | beta | beta | NAMEDOTCOM | Username + API token (Core API, HTTP Basic) |
| Namecheap BasicDNSregistrar | stable | beta | NAMECHEAP | API user + API key, with our egress IP allow-listed |
| OVHcloud DNSregistrar | beta | beta | OVH | Application key + application secret + consumer key (EU, CA or US API) |
| Porkbunregistrar | beta | beta | PORKBUN | API key + secret API key |
| AutoDNS (InterNetX)registrar | beta | beta | AUTODNS | API user + password + context (Basic auth), optional TOTP 2FA secret |
| CentralNic Resellerregistrar | beta | beta | CNR | Reseller (or sub-user) login + password over the HTTPS gateway |
| CSC Global Domain Managerregistrar | beta | beta | CSCGLOBAL | API key + bearer (user) token |
| DNS over HTTPS (read-only)registrar | — | beta | DNSOVERHTTPS | None: reads nameservers through public DNS |
| Dynadotregistrar | — | beta | DYNADOT | API key |
| easynameregistrar | — | beta | EASYNAME | User ID + email + API key + signing salt |
| GidiNETregistrar | beta | beta | GIDINET | Username + dedicated API password (SOAP) |
| hosting.deregistrar | beta | beta | HOSTINGDE | API key (authToken), optional sub-account ID |
| Internet.bsregistrar | — | beta | INTERNETBS | API key + password |
| INWXregistrar | beta | beta | INWX | Username + password session login, with optional TOTP 2FA secret |
| Loopiaregistrar | beta | beta | LOOPIA | LoopiaAPI username + password |
| OpenSRSregistrar | — | beta | OPENSRS | Reseller username + API key |
| Realtime Registerregistrar | beta | beta | REALTIMEREGISTER | API key (Authorization: ApiKey) |
| Tencent Cloud DNSPodcloud | beta | beta | TENCENTDNS | CAM SecretId + SecretKey |
Automatic cutover#
Automatic cutover requires the one-time Automated tier for that migration. It is available only after the migration has been applied or verified, the destination has returned nameservers, and the selected registrar connection is Active.
The sequence is built from the domain’s current DNSSEC state:
- If you selected Lower TTLs to 5 minutes at the old provider first, DNSMigrator updates eligible source records and waits out the previous maximum TTL. This is the only optional cutover step that writes to the source.
- If a registry DS record exists, DNSMigrator asks the registrar to remove it when the adapter supports DS writes. Otherwise it pauses with a dashboard instruction.
- It waits a day for resolvers to forget the old DS record.
- It requests the new nameserver set and polls public registry/DNS data until that delegation appears.
- It watches nameserver propagation.
- If DNSSEC was previously on, it enables DNSSEC at the destination when the DNS adapter supports that operation, then publishes the new DS through the registrar when possible. Unsupported operations become guided instructions.
Read DNSSEC transitions before moving a signed domain and Nameserver cutover for the complete state machine.
DNSMigrator sends cutover-step, completion and failure notifications to channels subscribed under Notifications. See Notifications and webhooks.
Guided cutover#
Guided cutover requires Migrate + cutover or higher and needs no registrar credential.
Select I'll switch it to see set these nameservers at your registrar and Copy all. DNSMigrator pauses at registry actions and checks public DNS every five minutes. After making a requested DS or nameserver change, select I've done this, check now to queue an immediate check.
Guided mode follows the same DNSSEC order as automatic mode. It does not mark a manual action complete merely because you clicked confirmation; the service checks the public result.
Revert a delegation#
At cutover start, DNSMigrator records the old nameserver set. Switch back to the old provider requests that set through the registrar in automatic mode. In guided mode it shows the old values for you to restore. The source zone remains unchanged unless you opted into the TTL-lowering step.
A revert changes delegation; it does not undo records written to the destination. Use migration Rollback separately if you also need to reverse DNSMigrator’s destination writes.