Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Akamai Cloud (Linode) DNS

Linode access token setup: create a personal access token whose Domains scope and underlying IAM roles match preview or apply access.

On this page

Linode access token permissions

Credential type
Personal access token
Preview access
**Domains**: **Read Only** (`domains:read_only`)
Apply access
**Domains**: **Read Write** (`domains:read_write`)
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

A token cannot exceed its user's IAM roles. Apply needs `domain_admin` on existing domains; `account_domain_creator` is also needed when DNSMigrator creates a missing domain.

DNSControl id

creds.json TYPE
{
  "TYPE": "LINODE"
}

Create credentials

Create a personal access token whose Domains scope and underlying IAM roles match preview or apply access.

Access you'll grant

Preview

Domains: Read Only (domains:read_only)

Apply

Domains: Read Write (domains:read_write)

A token cannot exceed its user's IAM roles. Apply needs domain_admin on existing domains; account_domain_creator is also needed when DNSMigrator creates a missing domain.

Before you start

  • An Akamai Cloud (Linode) account with at least one active Linode; without one, DNS records are not served.
  • A user with domain_viewer for preview, and domain_admin plus account_domain_creator when applying or creating domains.

Setup steps

0 of 6 done

  1. Confirm the user's domain roles

    Use a user with domain_viewer for preview. For apply, assign domain_admin to the destination domains and account_domain_creator if a destination domain may need to be created.

    Preview roledomain_viewer
    Apply roledomain_admin
    Create domainsaccount_domain_creator

  2. Open API Tokens

    Open your username menu and select API Tokens, or go to My Profile → API Tokens.

    Open Akamai Cloud API tokens

  3. Start a personal access token

    Select Create a Personal Access Token, enter a Label, and choose an Expiry that covers the migration.

  4. Set the Domains access

    Set Domains to Read Only for a source or preview-only connection, or Read Write for a destination. Leave unrelated services at No Access.

    Preview OAuth scopedomains:read_only
    Apply OAuth scopedomains:read_write

  5. Create and copy the token

    Select Create Token and copy the secret immediately. Akamai Cloud displays it only once.

  6. Enter the credentials

    Paste the secret into Personal access token. If DNSMigrator may create a domain, also enter a valid SOA email for its Start of Authority record.

Troubleshooting

The token is rejected

The one-time value may be incomplete, expired or revoked. Create a replacement token and paste the full secret.

A request returns 403 despite the correct token scope

Check both layers: the token needs the Domains scope, and its user needs the corresponding domain_viewer, domain_admin or account_domain_creator IAM role.

The new domain cannot be created

Use Read Write plus account_domain_creator and enter an SOA email address. The domain must also be unique across Akamai Cloud accounts.

DNS records exist but are not served

Akamai Cloud requires at least one active Linode on the account for DNS Manager to serve domains.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Personal access tokentokenRequiredThe one-time secret displayed after Create Token; paste it without a Bearer prefix.
SOA emailsoaEmailOptionalA valid administrative email address used only when DNSMigrator creates a new primary domain, for example dns@example.com.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
30 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR

Caveats

  • Linode only accepts fixed TTLs (30s, 2m, 5m, 1h, 2h, 4h, 8h, 16h, 1d, 2d, 4d, 1w, 2w, 4w). Other values are rounded up.
  • CAA records always have flag 0 and only the issue, issuewild and iodef tags.
  • Linode DNS Manager doesn't support DNSSEC, so turn it off at the registrar before switching nameservers.

Troubleshooting

The token is rejected
The one-time value may be incomplete, expired or revoked. Create a replacement token and paste the full secret.
A request returns 403 despite the correct token scope
Check both layers: the token needs the Domains scope, and its user needs the corresponding domain_viewer, domain_admin or account_domain_creator IAM role.
The new domain cannot be created
Use Read Write plus account_domain_creator and enter an SOA email address. The domain must also be unique across Akamai Cloud accounts.
DNS records exist but are not served
Akamai Cloud requires at least one active Linode on the account for DNS Manager to serve domains.

Related links

Akamai Cloud (Linode) DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → LinodeRoute 53 → LinodeAzure DNS → LinodeCloud DNS → Linode