Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Exoscale DNS

Exoscale API key setup: create a restricted IAM role and an attached API key for Exoscale DNS, including operation polling for apply.

On this page

Exoscale API key permissions

Credential type
API key and secret
Preview access
DNS read operations: `list-dns-domains`, `get-dns-domain`, `list-dns-domain-records` and `get-dns-domain-record`
Apply access
DNS service `allow`, plus compute operation `get-operation`
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The connector polls `get-operation` after asynchronous DNS writes. A role that allows only the DNS service can start a write but fail while waiting for it.

DNSControl id

creds.json TYPE
{
  "TYPE": "EXOSCALE"
}

Create credentials

Create a restricted IAM role and an attached API key for Exoscale DNS, including operation polling for apply.

Access you'll grant

Preview

DNS read operations: list-dns-domains, get-dns-domain, list-dns-domain-records and get-dns-domain-record

Apply

DNS service allow, plus compute operation get-operation

The connector polls get-operation after asynchronous DNS writes. A role that allows only the DNS service can start a write but fail while waiting for it.

Before you start

  • An Exoscale organization with an active paid DNS zone-bundle subscription.
  • Permission to create IAM roles and API keys in the organization.

Setup steps

0 of 6 done

  1. Open IAM roles

    In the Exoscale Portal, navigate to IAM → ROLES and add a new role for DNSMigrator.

    Open the Exoscale Portal

  2. Set the role policy

    Set Default service strategy to DENY. Use the preview policy for a source-only key, or the apply policy for a destination key. The latter allows DNS and only get-operation from the compute service class.

    Preview policy{"default-service-strategy":"deny","services":{"dns":{"type":"rules","rules":[{"action":"allow","expression":"operation in ['list-dns-domains', 'get-dns-domain', 'list-dns-domain-records', 'get-dns-domain-record']"}]}}}
    Apply policy{"default-service-strategy":"deny","services":{"dns":{"type":"allow"},"compute":{"type":"rules","rules":[{"action":"allow","expression":"operation == 'get-operation'"}]}}}

  3. Create an API key

    Navigate to IAM → KEYS, add an API key, give it a recognizable name, and select the role you just created.

  4. Copy both key values

    Copy the displayed API Key and API Secret immediately. The secret is shown only once and the key cannot later be moved to a different role.

  5. Choose an API zone

    Use an Exoscale zone name such as ch-gva-2 for the API endpoint. You may leave API zone empty to use this connector's default, ch-gva-2.

    Default API zonech-gva-2

  6. Enter the Exoscale credentials

    Paste the values into API key, API secret and, if set, API zone. Do not combine the key and secret into one value.

Troubleshooting

The key or signature is rejected

Check that API Key and API Secret were pasted into separate fields and that the API zone is a valid Exoscale zone name.

DNS requests return 403

The key's role is immutable. Create a new key attached to a role with the required DNS read policy or DNS service allow policy.

A write starts but apply fails while waiting

Add an allow rule for operation == 'get-operation' under the compute service class; DNS writes are asynchronous.

No DNS domains are available

Confirm that the organization has an active DNS zone-bundle subscription and that the role allows list-dns-domains.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API keyapiKeyRequiredThe identifier labeled API Key when the key is created; it starts with EXO.
API secretapiSecretRequiredThe API Secret displayed only once beside the new key.
API zonezoneOptionalOptional Exoscale API zone name, for example ch-gva-2; blank uses ch-gva-2.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • ALIAS
  • SSHFP
  • NAPTR
  • SPF

Caveats

  • Exoscale DNS needs an active DNS subscription on the organization before zones can be created.
  • PTR and TLSA records aren't supported, and SRV records can't have an empty target.
  • Apex NS records are fixed by Exoscale and can't be changed.

Troubleshooting

The key or signature is rejected
Check that API Key and API Secret were pasted into separate fields and that the API zone is a valid Exoscale zone name.
DNS requests return 403
The key's role is immutable. Create a new key attached to a role with the required DNS read policy or DNS service allow policy.
A write starts but apply fails while waiting
Add an allow rule for operation == 'get-operation' under the compute service class; DNS writes are asynchronous.
No DNS domains are available
Confirm that the organization has an active DNS zone-bundle subscription and that the role allows list-dns-domains.

Related links

Exoscale DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → ExoscaleRoute 53 → ExoscaleAzure DNS → ExoscaleCloud DNS → Exoscale