Providers
Self-hosted providers
Connect self-hosted DNS servers and appliances without exposing private networks. Learn endpoint requirements, IP pinning, TLS, AXFR, and SSRF safeguards.
5 min read
On this page
Self-hosted connections let DNSMigrator work with authoritative servers, DNS update protocols, routers and appliances, but only through a public endpoint that passes the outbound request guard. The key point is that a private VPN address, loopback address or split-horizon internal name will be refused even when the DNSMigrator host could route to it.
Supported self-hosted connections#
The release catalog exposes HTTP API connections for PowerDNS Authoritative, AdGuard Home, FortiGate, MikroTik RouterOS, NetBird, OpenWrt, and UniFi Network. It also exposes one DNS protocol connection: RFC 2136 with AXFR.
Each provider page lists its exact records, credentials and product-specific limitations. Some appliances have no real zone model; their adapter groups local entries under the domains you configure. Preview the result before applying.
8 providers
| Provider | DNS | Registrar | DNSControl id | Authentication |
|---|---|---|---|---|
| PowerDNS Authoritativeself hosted | beta | — | POWERDNS | API URL + API key (X-API-Key) + server ID |
| AdGuard Homeself hosted | beta | — | ADGUARDHOME | Server URL + web interface username + password (HTTP Basic) |
| FortiGate DNSself hosted | beta | — | FORTIGATE | Management URL + REST API admin token (Bearer) + VDOM |
| MikroTik RouterOSself hosted | beta | — | MIKROTIK | RouterOS REST API URL + username + password (HTTP Basic, RouterOS v7.1+) |
| NetBirdself hosted | beta | — | NETBIRD | Personal access token (Authorization: Token) + optional self-hosted management URL |
| OpenWrtself hosted | beta | — | OPENWRT | LuCI URL + username + password (LuCI JSON-RPC, luci-mod-rpc) |
| RFC 2136 dynamic DNS (AXFR + DDNS)self hosted | beta | — | AXFRDDNS | Primary server + TSIG key (HMAC-SHA256/512; SHA1/MD5 for legacy servers) |
| UniFi Networkself hosted | beta | — | UNIFI | API key (X-API-Key) + controller URL or UniFi console ID (via api.ui.com) |
Reachability model#
DNSMigrator jobs run on the server, not in your browser. A URL that opens from your workstation may still be unreachable from the service. Hosted connections use HTTPS; DNS transfer and RFC 2136 connections use TCP port 53.
| Check | Hosted behavior |
|---|---|
| Scheme | The connect form accepts a full https:// API URL. Plain HTTP is disabled in production. |
| Hostname | Empty names, localhost, and names ending in .localhost, .local, .internal, .home.arpa or .localdomain are blocked. |
| Address | Every resolved IPv4 or IPv6 address must be public. A hostname with even one private or reserved answer is rejected. |
| API ports | HTTPS ports 443, 8443, 8080, 8081, 3000, 10443 and 33073 are allowed by default. |
| DNS ports | The AXFR and RFC 2136 connection is limited to TCP port 53. |
| Credentials in URL | Usernames and passwords in URL authority are rejected. Use the connection’s separate credential fields. |
| Response size | Guarded responses larger than 10 MB are refused. |
| Redirects | Provider requests can follow at most three redirects; every target is validated again, and sensitive headers are not forwarded across origins. Customer webhooks do not follow redirects. |
The blocked IPv4 ranges include unspecified, private, CGNAT, loopback, link-local, protocol-assignment, documentation, benchmarking, multicast and reserved space. IPv6 checks reject non-global unicast space, local/reserved allocations, documentation ranges and transition addresses that embed blocked IPv4 destinations.
DNS resolution and IP pinning#
For a hostname, the guard resolves all addresses before opening the connection. If any answer is invalid or non-public, the request stops. It then selects the first validated address and pins the socket lookup to that address while preserving the original hostname for HTTPS certificate and SNI checks.
This prevents a hostname from passing validation with one address and resolving to a different private address at connection time. Redirect destinations go through the same validation. Cross-origin redirects keep only safe request headers such as Accept, Accept-Language, Content-Type and User-Agent.
The TLS certificate must therefore be valid for the URL hostname and chain to a trusted root. DNSMigrator does not offer an “ignore TLS errors” mode. This matters for appliance defaults such as UniFi’s self-signed console certificate.
Prepare an HTTPS API#
Use a dedicated public hostname and a reverse proxy rather than exposing a native management UI broadly.
Choose the smallest reachable surface
Publish only the provider API paths needed by the adapter. Keep unrelated administration interfaces private when your proxy or appliance supports path separation.
Install trusted TLS
Serve the exact hostname over HTTPS with a publicly trusted certificate and complete chain. Choose one of the permitted ports, preferably the provider’s standard HTTPS port.
Restrict inbound traffic
At the firewall or reverse proxy, allow requests from DNSMigrator’s configured static egress address. Use the address shown in the provider setup guide when available. Do not allow-list your browser’s address instead; worker jobs originate from the service.
Create a dedicated account
Grant read-only API rights for a source preview when the product supports them. Add record-write access only for a destination. Some products expose only an all-administrator credential; their provider page calls that out.
Connect and test
Go to Connections → Connect a provider, filter by Self-hosted, and enter the public URL plus separate credential fields. Select Connect, then confirm the connection is Active. After network or firewall changes, run Check access again.
PowerDNS is a representative HTTP setup: its API key can read and write every zone on that server, so put the API behind TLS and restrict the source address. Read the PowerDNS guide before connecting it.
Prepare AXFR and RFC 2136#
RFC 2136 dynamic DNS reads each configured zone through a full AXFR and applies changes through DNS UPDATE. Its TSIG identity needs transfer rights for preview and update-policy rights for writes. Zones must already exist and must be listed in the connection because these protocols cannot enumerate or create them.
- Publish the primary, and an optional separate transfer server, on a public address at TCP port 53.
- Permit DNSMigrator’s egress address through the firewall.
- Restrict transfers and updates with a dedicated TSIG key.
- Enter the TSIG name, algorithm, and base64 secret exactly as configured.
- List every zone the connection may use.
Check access performs an AXFR of the first configured zone and sends an empty DNS UPDATE to determine whether the key has read-only or read/write scope. A refused transfer is reported as permission, a bad TSIG signature as authentication, and a blocked address as IP not allowed.
Product-specific boundaries#
| Provider family | Important boundary |
|---|---|
| PowerDNS | API keys are not read-only and cover every zone on the server; constrain the endpoint itself |
| AdGuard Home and OpenWrt | The login can change broader server or router settings even though DNSMigrator touches only DNS entries |
| FortiGate | Use a REST API administrator profile and trusted-host restrictions; writes replace the zone’s DNS-entry table after a read/merge |
| MikroTik | Use RouterOS REST over www-ssl; a preview needs read and rest-api, while apply also needs write |
| NetBird | Hosted NetBird can use its fixed public API; a custom management URL must pass the same public-endpoint guard |
| UniFi | A console ID uses the public UniFi API path; a direct controller URL needs public HTTPS and a trusted certificate |
If the server must stay private#
A private-only API cannot be connected to the hosted web app. Do not publish it solely by removing authentication or opening it to all sources. Instead, use a supported public API path with source filtering, or export a BIND zone file and use the zone-file workflow when read-only transfer is sufficient.