Skip to content
DNSmigrator
betaDNS betaRegistrar betaRegistrarSetup guide checked 2026-09-27

CentralNic Reseller

CentralNic API credentials setup: create a CentralNic Reseller sub-user with only the KeyDNS and domain commands needed for previews, DNS changes, and cutovers.

On this page

CentralNic API credentials permissions

Credential type
API sub-user login
Preview access
QUERY and STATUS on the account, DNS-zone, and domain locations used by StatusAccount, QueryDNSZoneList, QueryDNSZoneRRList, StatusDNSZone, QueryDomainList, and StatusDomain
Apply access
MODIFY on the DNS-zone and domain locations; ADD on the DNS-zone location only when zone creation is needed
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Check access sends a read command only. CentralNic ACLs assign rights such as QUERY, STATUS, MODIFY, and ADD at specific locations; the API command list here shows what DNSMigrator exercises.

DNSControl id

creds.json TYPE
{
  "TYPE": "CNR"
}

Create credentials

Create a CentralNic Reseller sub-user with only the KeyDNS and domain commands needed for previews, DNS changes, and cutovers.

Access you'll grant

Preview

QUERY and STATUS on the account, DNS-zone, and domain locations used by StatusAccount, QueryDNSZoneList, QueryDNSZoneRRList, StatusDNSZone, QueryDomainList, and StatusDomain

Apply

MODIFY on the DNS-zone and domain locations; ADD on the DNS-zone location only when zone creation is needed

Check access sends a read command only. CentralNic ACLs assign rights such as QUERY, STATUS, MODIFY, and ADD at specific locations; the API command list here shows what DNSMigrator exercises.

Before you start

  • A CentralNic Reseller account with permission to manage users and ACLs.
  • An OT&E password configured in the live control panel if you will use the test system.

Setup steps

0 of 6 done

  1. Open user management

    Sign in to the CentralNic Reseller control panel, select your login name in the upper-right, then open User management.

    Open CentralNic Reseller

  2. Create a dedicated user

    Create a user for DNSMigrator and set its password. The API login is your account name, a colon, and the username: account:user.

    Login formataccount:user

  3. Grant the required ACL rights

    Assign QUERY and STATUS at the account, DNS-zone, and domain locations needed for the preview operations below. Add MODIFY at the DNS-zone and domain locations for apply; add ADD at the DNS-zone location only if DNSMigrator may create a billable KeyDNS zone.

    Preview commands exercisedStatusAccount, QueryDNSZoneList, QueryDNSZoneRRList, StatusDNSZone, QueryDomainList, StatusDomain
    Apply commands exercisedModifyDNSZone, ModifyDomain
    Create-zone command (optional)AddDNSZone

  4. Allow the DNSMigrator address

    If IP whitelisting is enabled under your system settings, add our IPv4 address. CentralNic says the whitelist is off by default and, when enabled, applies to every API gateway.

    CentralNic API security
    Allowed IPv4 addressour egress IP

  5. Prepare OT&E access

    Skip this for production. For OT&E, use the live control panel path Account → Settings → Passwords to set the OT&E password, then choose OT&E (test) in the connection form.

    CentralNic HTTPS and OT&E gateway

  6. Enter the API login

    Paste account:user into API login, the sub-user password into Password, and select Live or OT&E (test) under System.

Troubleshooting

CentralNic returns code 530

The API login or password is wrong. For a sub-user, include the account prefix and colon. For OT&E, use the OT&E password.

CentralNic returns code 531

The sub-user lacks the ACL right or location for the command. Compare the failed command with the preview/apply lists above.

CentralNic returns code 535

IP whitelisting is enabled and does not include our egress IP. Add that address under system settings and reconnect.

Check access succeeds but apply is denied

The access check only runs a list/status command. Add MODIFY on the relevant DNS-zone/domain locations and retry.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API loginloginRequiredThe reseller account name, or the restricted sub-user form account:user documented by CentralNic.
PasswordpasswordRequiredThe password for that account or sub-user. For OT&E, use the OT&E password configured from the live control panel.
SystemenvironmentOptionalChoose Live for api.rrpproxy.net or OT&E (test) for api-ote.rrpproxy.net. Live is used when omitted.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • ALIAS
  • DNAME
  • NAPTR
  • SSHFP
  • TLSA
  • SMIMEA
  • LOC
  • SVCB
  • DHCID

Caveats

  • Creating a KeyDNS zone can incur a charge on your reseller account.
  • ALIAS records only work on unsigned zones; they can't be used with DNSSEC signing.
  • Web and mail forwards are separate objects in the API and aren't migrated as DNS records.

Troubleshooting

CentralNic returns code 530
The API login or password is wrong. For a sub-user, include the account prefix and colon. For OT&E, use the OT&E password.
CentralNic returns code 531
The sub-user lacks the ACL right or location for the command. Compare the failed command with the preview/apply lists above.
CentralNic returns code 535
IP whitelisting is enabled and does not include {egressIp}. Add that address under system settings and reconnect.
Check access succeeds but apply is denied
The access check only runs a list/status command. Add MODIFY on the relevant DNS-zone/domain locations and retry.

Related links

CentralNic Reseller migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → CentralNicRoute 53 → CentralNicAzure DNS → CentralNicCloud DNS → CentralNic