Skip to content
DNSmigrator
betaDNS betaDNS hostingSetup guide checked 2026-09-27

deSEC

deSEC API token setup: generate a deSEC API token, restrict its client subnet and lifetime, and use RRset token policies when you need read-only or domain-limited writes.

On this page

deSEC API token permissions

Credential type
API token
Preview access
RRset default policy → perm_write=false
Apply access
RRset policy for each target domain → perm_write=true
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Every token can read RRsets. Creating a new domain also requires perm_create_domain=true; an unrestricted new token can write existing RRsets unless you add policies.

DNSControl id

creds.json TYPE
{
  "TYPE": "DESEC"
}

Create credentials

Generate a deSEC API token, restrict its client subnet and lifetime, and use RRset token policies when you need read-only or domain-limited writes.

Access you'll grant

Preview

RRset default policy → perm_write=false

Apply

RRset policy for each target domain → perm_write=true

Every token can read RRsets. Creating a new domain also requires perm_create_domain=true; an unrestricted new token can write existing RRsets unless you add policies.

Before you start

  • A deSEC account and a current login token allowed to manage tokens.
  • Use the token-policy API for true preview-only or per-domain write access; the web form does not expose RRset policies.

Setup steps

0 of 7 done

  1. Open Tokens

    Sign in to deSEC and open Tokens.

    Open deSEC Tokens

  2. Generate a named token

    Select Generate New Token and fill in Token name (for your convenience only) so you can identify this connection later.

  3. Set the lifetime and client subnet

    Open the advanced settings. Set Maximum age or Maximum unused period, and add our egress IP/32 under Allowed client subnets. Leaving that field empty permits all IPv4 and IPv6 sources.

    Allowed client subnetour egress IP/32

  4. Keep administrative permissions off

    Leave Can delete domains and Can manage tokens off. Leave Can create domains off for existing zones; turn it on only when DNSMigrator should create a destination zone.

  5. Add RRset policies when needed

    For a preview-only token, create a default RRset policy with perm_write=false. To apply to selected existing domains, add a more-specific domain policy with perm_write=true for each one. Authenticate these policy calls with your current token-management token, not the restricted new token. RRset policies are currently configured through the deSEC API, not the token web form.

    deSEC token scoping policies
    Preview defaultperm_write=false
    Apply to target domainperm_write=true

  6. Copy the secret

    Submit the form and copy the new token's Secret immediately. deSEC returns the token value only once.

  7. Paste the token

    Paste the complete secret into API token, then check access.

Troubleshooting

deSEC rejected the token

Check that you copied the Secret rather than the token ID, that Maximum age or Maximum unused period has not elapsed, and that the token was not deleted.

Authentication fails after adding a client subnet

Allowed client subnets is exhaustive. Add our egress IP/32 exactly, or remove subnet restrictions and generate a replacement token.

Preview works but apply is denied

Check the RRset policies. The default deny policy needs a more-specific perm_write=true policy for each target domain.

The destination zone cannot be created

Edit the token and turn on Can create domains. If you use restrictive policies, also arrange write access for records in the newly created domain.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API tokentokenRequiredThe Secret shown once after Generate New Token; this is not the token's UUID in the Tokens table.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
3600 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • DS
  • HTTPS
  • SVCB
  • TLSA
  • SSHFP
  • NAPTR
  • SPF
  • LOC
  • CERT
  • URI
  • DHCID
  • DNAME
  • OPENPGPKEY
  • RP
  • SMIMEA

Caveats

  • The minimum TTL is 3600 seconds for most domains (deSEC sets it per domain) and the maximum is 86400.
  • ALIAS/ANAME records and apex CNAMEs aren't supported; use A/AAAA or HTTPS records at the apex.
  • Every zone is DNSSEC-signed automatically. Give the DS records to your registrar to complete the chain.

Troubleshooting

deSEC rejected the token
Check that you copied the Secret rather than the token ID, that Maximum age or Maximum unused period has not elapsed, and that the token was not deleted.
Authentication fails after adding a client subnet
Allowed client subnets is exhaustive. Add {egressIp}/32 exactly, or remove subnet restrictions and generate a replacement token.
Preview works but apply is denied
Check the RRset policies. The default deny policy needs a more-specific perm_write=true policy for each target domain.
The destination zone cannot be created
Edit the token and turn on Can create domains. If you use restrictive policies, also arrange write access for records in the newly created domain.

Related links

deSEC migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → deSECRoute 53 → deSECAzure DNS → deSECCloud DNS → deSEC