Netnod Primary DNS
Netnod API token setup: obtain a Primary DNS API token from Netnod; its public documentation does not describe a self-service token creation flow.
On this page
Netnod API token permissions
- Credential type
- Primary DNS API token
- Preview access
- A Primary DNS API token authorized for ListZones and GetZone.
- Apply access
- A Primary DNS API token also authorized for CreateZone and PatchZoneRRsets.
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "NETNOD"
}Create credentials
Obtain a Primary DNS API token from Netnod; its public documentation does not describe a self-service token creation flow.
Access you'll grant
A Primary DNS API token authorized for ListZones and GetZone.
A Primary DNS API token also authorized for CreateZone and PatchZoneRRsets.
Before you start
- An active Netnod Primary DNS service for your organization.
- A Netnod account authorized for the zones you want to connect.
Setup steps
0 of 4 done
Confirm Primary DNS is active
Verify that your organization has Netnod Primary DNS service. If it does not, contact Netnod before trying to create a connection.
Request an API token
Ask your Netnod contact for a Primary DNS API token for the account that owns these zones. State whether DNSMigrator only needs to list and read zones or also needs to create zones and replace or delete RRsets.
Preview operationsListZones, GetZoneApply operationsCreateZone, PatchZoneRRsetsOpen the customer portal
If Netnod has already provisioned token management for your account, sign in through Login and use the Primary DNS area. The public docs do not publish the labels inside that authenticated flow.
Paste the token
Paste the issued value into API token. DNSMigrator sends it to
primarydnsapi.netnod.seasAuthorization: Token <token>.API hostprimarydnsapi.netnod.se
Troubleshooting
The token is rejected
Confirm it is a Primary DNS account token and not a per-label DynDNS or ACME token. Ask Netnod to verify that it is active for primarydnsapi.netnod.se.
No zones appear
The token can only list zones assigned to its account. Ask Netnod to confirm the zone ownership or end-customer assignment attached to the token.
Preview works but apply is denied
The connection check only lists one zone. Ask Netnod to enable CreateZone and PatchZoneRRsets access, or keep the connection preview-only.
Official documentation
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| API tokenapiKey | Required | The Primary DNS API token issued for your Netnod account. Do not use a DynDNS or ACME label token. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Not available through this connection
- Minimum TTL
- 60 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- ALIAS
- PTR
- DS
- HTTPS
- SVCB
- NAPTR
- SSHFP
- TLSA
Caveats
- Netnod publishes no public API reference; the adapter follows Netnod's official Go client, and TTL limits are not documented.
- Each change replaces a whole name+type set, so records disabled in the Netnod portal are dropped when that set is edited.
- New zones get Netnod's default nameservers; zone transfer keys and NOTIFY targets must be set up with Netnod separately.
Troubleshooting
- The token is rejected
- Confirm it is a Primary DNS account token and not a per-label DynDNS or ACME token. Ask Netnod to verify that it is active for primarydnsapi.netnod.se.
- No zones appear
- The token can only list zones assigned to its account. Ask Netnod to confirm the zone ownership or end-customer assignment attached to the token.
- Preview works but apply is denied
- The connection check only lists one zone. Ask Netnod to enable CreateZone and PatchZoneRRsets access, or keep the connection preview-only.