Skip to content
DNSmigrator
betaRegistrar betaRegistrarSetup guide checked 2026-09-27

DNS over HTTPS (read-only)

DoH DNS access setup: choose a public DNS-over-HTTPS resolver to read published nameserver and DS records when your registrar has no supported API.

On this page

DoH DNS access permissions

Credential type
No credentials
Preview access
Public NS and DS lookups only
Apply access
Not available; change nameservers and DS records manually at your registrar
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

This connection cannot list registered domains or change anything. It reads cached public DNS data from the selected recursive resolver.

DNSControl id

creds.json TYPE
{
  "TYPE": "DNSOVERHTTPS"
}

Create credentials

Choose a public DNS-over-HTTPS resolver to read published nameserver and DS records when your registrar has no supported API.

Access you'll grant

Preview

Public NS and DS lookups only

Apply

Not available; change nameservers and DS records manually at your registrar

This connection cannot list registered domains or change anything. It reads cached public DNS data from the selected recursive resolver.

Before you start

  • No provider account or API key is required.

Setup steps

0 of 3 done

  1. Choose a public resolver

    Under Public resolver, choose Cloudflare (1.1.1.1), Google Public DNS, or Quad9. Cloudflare is the default. No login or key is sent.

    Cloudflare endpointhttps://cloudflare-dns.com/dns-query
    Google endpointhttps://dns.google/resolve

  2. Check resolver access

    Create the connection. DNSMigrator queries example.com for an NS answer to confirm the selected resolver is reachable.

  3. Make registrar changes manually

    Use this connection to read a domain's published NS and DS records and to verify when manual registrar changes become visible. DNSMigrator never sends a write through DoH.

Troubleshooting

The resolver returns NXDOMAIN

The queried domain does not exist in that resolver's public DNS view. Check the spelling and registration status.

The resolver returns SERVFAIL or REFUSED

Retry with Cloudflare or Google. A resolver can fail DNSSEC validation or temporarily refuse a query even though the domain exists.

Old nameservers or DS records are still shown

Recursive resolvers cache DNS answers. Wait until the prior answer's TTL expires, then query again; this connection cannot purge a public resolver's cache.

Quad9 fails Check access

Use Cloudflare or Google. DNSMigrator currently calls a Quad9 :5053 endpoint that is not listed in Quad9's current service documentation.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Public resolverresolverOptionalOptional public resolver. Cloudflare is the default; Google uses dns.google. The current Quad9 adapter URL includes port 5053, which Quad9's published service page does not list, so prefer Cloudflare or Google until Quad9 passes Check access.

Caveats

  • Read-only: nameservers and DS records are looked up through public DNS-over-HTTPS resolvers, so changes must be made at your registrar.
  • Results can lag behind the registry by the NS record's TTL, often 24–48 hours.

Troubleshooting

The resolver returns NXDOMAIN
The queried domain does not exist in that resolver's public DNS view. Check the spelling and registration status.
The resolver returns SERVFAIL or REFUSED
Retry with Cloudflare or Google. A resolver can fail DNSSEC validation or temporarily refuse a query even though the domain exists.
Old nameservers or DS records are still shown
Recursive resolvers cache DNS answers. Wait until the prior answer's TTL expires, then query again; this connection cannot purge a public resolver's cache.
Quad9 fails Check access
Use Cloudflare or Google. DNSMigrator currently calls a Quad9 :5053 endpoint that is not listed in Quad9's current service documentation.

Related links

DNS over HTTPS (read-only) migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.