Skip to content
DNSmigrator
betaDNS betaSelf-hostedSetup guide checked 2026-09-27

MikroTik RouterOS

MikroTik API credentials setup: create a source-restricted RouterOS user for the HTTPS REST API and grant only read/rest-api, plus write when applying changes.

On this page

MikroTik API credentials permissions

Credential type
RouterOS user
Preview access
User-group policies: read, rest-api
Apply access
User-group policies: read, rest-api, write
API endpoint
You provide a public API endpoint.

Additional access

The check reads /rest/ip/dns/static, then tries to inspect /rest/user and /rest/user/group. If policy inspection is denied, it assumes write access; no write request is attempted.

DNSControl id

creds.json TYPE
{
  "TYPE": "MIKROTIK"
}

Create credentials

Create a source-restricted RouterOS user for the HTTPS REST API and grant only read/rest-api, plus write when applying changes.

Access you'll grant

Preview

User-group policies: read, rest-api

Apply

User-group policies: read, rest-api, write

The check reads /rest/ip/dns/static, then tries to inspect /rest/user and /rest/user/group. If policy inspection is denied, it assumes write access; no write request is attempted.

Before you start

  • RouterOS v7.1 or later and administrator access to the terminal or WinBox/WebFig.
  • A public hostname with a publicly trusted certificate and a firewall path restricted to our egress IP.

Setup steps

0 of 6 done

  1. Install a trusted certificate

    Import a certificate and full chain whose name matches the public router hostname. RouterOS supports self-signed certificates, but DNSMigrator never disables TLS verification, so use a publicly trusted certificate for this connection.

  2. Create a minimal user group

    Create one custom group with read,rest-api for preview only, or add write for apply. Do not add policy: it grants user-management rights and is not needed for DNS changes.

    Preview-only group/user/group/add name=dnsmigrator policy=read,rest-api
    Preview and apply group/user/group/add name=dnsmigrator policy=read,write,rest-api

  3. Create a source-restricted user

    Create a dedicated user in that group with a strong password. Set address to our egress IP/32 so this login cannot be used from another source.

    RouterOS user/user/add name=dnsmigrator group=dnsmigrator password="<strong-password>" address=our egress IP/32

  4. Enable and restrict www-ssl

    Under IP → Services, enable www-ssl, assign the trusted certificate, and restrict Available From/address to our egress IP/32. If administrators also use HTTPS WebFig, include their trusted management CIDRs before applying this command.

    HTTPS REST service/ip/service/set www-ssl disabled=no port=443 certificate=<certificate-name> address=our egress IP/32,<admin-cidr>

  5. Permit public HTTPS from DNSMigrator

    Allow our egress IP to the chosen www-ssl port in the RouterOS input firewall and any upstream NAT/firewall; block other Internet sources. DNSMigrator calls from its servers over the public Internet. Its SSRF guard rejects private, loopback, link-local, CGNAT, metadata, documentation/reserved, and other non-public addresses, checks every DNS answer, and pins one validated IP. Do not enable the plaintext www service.

    Required flowour egress IP → router:443/tcp

  6. Enter the REST connection

    Set RouterOS URL to the public HTTPS origin; a trailing /rest is optional. Enter the dedicated Username and Password. Add Domains when static names need grouping under suffixes longer than two labels, then check access.

    RouterOS URLhttps://router.example.com
    Domain hintshome.example.com, internal.example.org

Troubleshooting

401 Unauthorized

Confirm the user password, rest-api group policy, and per-user address includes our egress IP. The api policy is for the binary API and does not replace rest-api.

TLS verification fails

Assign a publicly trusted certificate and full chain to www-ssl, and use the matching DNS hostname rather than an IP or self-signed name.

The check reports write for a read-only group

This can happen when the user lacks policy permission to inspect users/groups. Treat the configured group as authoritative; add write only when you intend to apply.

Records are grouped under the wrong zone

RouterOS has no zones. Enter explicit suffixes in Domains, especially for private TLDs or delegated names with three or more labels.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
RouterOS URLurlRequiredPublic HTTPS origin of the RouterOS www-ssl service. A trailing /rest is removed automatically.
UsernameusernameRequiredDedicated RouterOS user in the custom read/rest-api group (plus write for apply).
PasswordpasswordRequiredStrong password assigned to the dedicated RouterOS user; the API uses HTTP Basic authentication.
DomainszonesOptionalOptional comma- or whitespace-separated suffixes used to group RouterOS's flat static-DNS entries. Longest match wins.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
0 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV

MikroTik-only types

  • MIKROTIK_FORWARDER
  • MIKROTIK_FWD
  • MIKROTIK_NXDOMAIN

These records need translation or review when you move to another provider.

Caveats

  • Routers usually sit on a private network; we refuse private addresses by design, so the REST API (www-ssl) is only reachable if you expose it publicly over HTTPS.
  • RouterOS has no zones: we group static entries by the domains you list (or the last two labels of each name). Regexp entries, dynamic entries and disabled entries are not imported, and match-subdomain / address-list settings are kept on existing entries but not migrated elsewhere.
  • MIKROTIK_FORWARDER records live in the virtual zone _forwarders.mikrotik and need RouterOS 7.17 or newer.

Troubleshooting

401 Unauthorized
Confirm the user password, rest-api group policy, and per-user address includes {egressIp}. The api policy is for the binary API and does not replace rest-api.
TLS verification fails
Assign a publicly trusted certificate and full chain to www-ssl, and use the matching DNS hostname rather than an IP or self-signed name.
The check reports write for a read-only group
This can happen when the user lacks policy permission to inspect users/groups. Treat the configured group as authoritative; add write only when you intend to apply.
Records are grouped under the wrong zone
RouterOS has no zones. Enter explicit suffixes in Domains, especially for private TLDs or delegated names with three or more labels.

Related links

MikroTik RouterOS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → MikroTikRoute 53 → MikroTikAzure DNS → MikroTikCloud DNS → MikroTik