Skip to content
DNSmigrator
betaDNS betaDNS hostingSetup guide checked 2026-09-27

NexDNS

NexDNS API key setup: create a NexDNS key with zone and record read scopes, then add record or zone write only for the operations DNSMigrator will perform.

On this page

NexDNS API key permissions

Credential type
Scoped API key
Preview access
zones.read + records.read
Apply access
zones.read + records.read + records.write
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Add zones.write to create zones or enable/disable DNSSEC. NexDNS's current API does not define separate dnssec.read or dnssec.write scopes.

DNSControl id

creds.json TYPE
{
  "TYPE": "NEXDNS"
}

Create credentials

Create a NexDNS key with zone and record read scopes, then add record or zone write only for the operations DNSMigrator will perform.

Access you'll grant

Preview

zones.read + records.read

Apply

zones.read + records.read + records.write

Add zones.write to create zones or enable/disable DNSSEC. NexDNS's current API does not define separate dnssec.read or dnssec.write scopes.

Before you start

  • A NexDNS Pro, Business, or Enterprise plan; Starter does not include REST API access.
  • This is NexDNS at nexdns.tech, not the NextDNS filtering resolver at my.nextdns.io.

Setup steps

0 of 6 done

  1. Open API keys

    Sign in to NexDNS and open Settings → API keys.

    Open NexDNS API keys

  2. Create a preview key

    Create a named key and select zones.read and records.read. Both are required: records are nested under a zone, and DNSMigrator lists zones before reading records.

    Zoneszones.read
    Recordsrecords.read

  3. Add the required write scopes

    Add records.write to apply record changes. Add zones.write only when DNSMigrator should create a missing zone or enable or disable DNSSEC.

    Apply recordsrecords.write
    Create zones or change DNSSECzones.write

  4. Set an expiration

    Choose an optional future expiration date that covers migration and verification. An expired key returns 401 and must be replaced.

  5. Create and copy the key

    Create the key and copy its full value immediately. NexDNS shows it only once, and it begins with nxd_.

  6. Paste the key

    Paste the value into API key, then check access. DNSMigrator reads the key's permission list when NexDNS makes it available and reports a read-only connection when records.write is absent.

Troubleshooting

NexDNS returns 403

Confirm the account is on Pro or above and that the key has the scope for the attempted action. The plan gate and missing scopes both return 403.

NexDNS rejected the API key

The key is incomplete, expired, revoked, or belongs to a canceled account. Create a replacement and copy the complete nxd_ value.

Preview says zones.read or records.read is missing

Edit or replace the key with both scopes. records.read alone is insufficient because record routes also require zones.read.

You have an API key from my.nextdns.io

That key belongs to NextDNS, a different resolver product. Create this connection with a NexDNS key from nexdns.tech instead.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API keyapiKeyRequiredThe one-time API key shown after creation in NexDNS Settings → API keys; it begins with nxd_.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
0 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • ALIAS
  • DNAME
  • DS
  • TLSA

Caveats

  • The SOA record and the apex NS records are managed by NexDNS and can't be changed, so dual-hosting a zone with a second provider isn't possible.
  • Records are written one value per request against a per-account rate limit, so large zones take a while to apply.
  • Only A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, PTR, ALIAS, DNAME, DS and TLSA are supported; ALIAS is the way to point the apex at a hostname.

Troubleshooting

NexDNS returns 403
Confirm the account is on Pro or above and that the key has the scope for the attempted action. The plan gate and missing scopes both return 403.
NexDNS rejected the API key
The key is incomplete, expired, revoked, or belongs to a canceled account. Create a replacement and copy the complete nxd_ value.
Preview says zones.read or records.read is missing
Edit or replace the key with both scopes. records.read alone is insufficient because record routes also require zones.read.
You have an API key from my.nextdns.io
That key belongs to NextDNS, a different resolver product. Create this connection with a NexDNS key from nexdns.tech instead.

Related links

NexDNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → NexDNSRoute 53 → NexDNSAzure DNS → NexDNSCloud DNS → NexDNS