Dynadot
Dynadot API key setup: generate a matching Dynadot RESTful API key and secret, optionally restrict it to the DNSMigrator egress IP, and choose production or sandbox.
On this page
Dynadot API key permissions
- Credential type
- RESTful API key and secret
- Preview access
- RESTful API account, domain, nameserver, and DNSSEC GET operations
- Apply access
- RESTful API external-nameserver add, nameserver update, and DNSSEC update/delete operations
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "DYNADOT"
}Create credentials
Generate a matching Dynadot RESTful API key and secret, optionally restrict it to the DNSMigrator egress IP, and choose production or sandbox.
Access you'll grant
RESTful API account, domain, nameserver, and DNSSEC GET operations
RESTful API external-nameserver add, nameserver update, and DNSSEC update/delete operations
Before you start
- A Dynadot account with API access.
- Permission to unlock the account before viewing or changing API settings.
Setup steps
0 of 5 done
Open API settings
Sign in, choose Tools → API from the left menu, and follow the page link to unlock your account.
Unlock the account
Select the unlock link on the API page and complete Dynadot's account verification. Production and sandbox values are shown after the page is unlocked.
Generate a matching key pair
For live domains, generate/copy Production Key and Secret Key. For testing, use Sandbox Key with Sandbox Secret Key. Do not mix values from the two pairs.
Production pairProduction Key + Secret KeySandbox pairSandbox Key + Sandbox Secret KeyRestrict the source IP (recommended)
Under IP Address, enter our egress IP and select Set IP Address. Dynadot recommends this restriction for individual users; RESTful v2 no longer requires every reseller account to set one. Allow at least 10 minutes for a change to reach the API servers.
IP Addressour egress IPEnter the key pair
Paste the selected values into API key and API secret. Turn on Use the API sandbox only for the sandbox pair, then check access.
Troubleshooting
Dynadot rejects the key or signature
Pair Production Key with Secret Key, or Sandbox Key with Sandbox Secret Key. A mixed pair cannot produce a valid X-Signature.
Dynadot says the source IP is not allowed
Add our egress IP under IP Address, select Set IP Address, and wait at least 10 minutes before checking again.
Sandbox access fails
Use keys generated specifically under Sandbox and confirm the required endpoint is marked as supported by the API sandbox.
Replacing DS records briefly clears the set
Dynadot's API clears all DNSSEC records before rebuilding the desired set when an existing record must be removed. Schedule the DNSSEC transition through the guided cutover.
Official documentation
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| API keyapiKey | Required | Production Key for live use, or Sandbox Key when the sandbox switch is on. It is sent as the Bearer credential. |
| API secretapiSecret | Required | The matching Secret Key or Sandbox Secret Key. DNSMigrator uses it to generate Dynadot's required X-Signature. |
| Use the API sandboxsandbox | Optional | Off uses api.dynadot.com. On uses api-sandbox.dynadot.com and requires the separate sandbox key pair. |
Caveats
- Dynadot's RESTful v2 API is itself marked beta by Dynadot.
- DS records can't be removed one at a time, so replacing them briefly clears all DS records.
- API calls must come from an allow-listed IP address.
Troubleshooting
- Dynadot rejects the key or signature
- Pair Production Key with Secret Key, or Sandbox Key with Sandbox Secret Key. A mixed pair cannot produce a valid X-Signature.
- Dynadot says the source IP is not allowed
- Add {egressIp} under IP Address, select Set IP Address, and wait at least 10 minutes before checking again.
- Sandbox access fails
- Use keys generated specifically under Sandbox and confirm the required endpoint is marked as supported by the API sandbox.
- Replacing DS records briefly clears the set
- Dynadot's API clears all DNSSEC records before rebuilding the desired set when an existing record must be removed. Schedule the DNSSEC transition through the guided cutover.