Skip to content
DNSmigrator
betaDNS betaDNS hostingSetup guide checked 2026-09-27

IBM NS1 Connect

NS1 API key setup: create an NS1 Connect API key secret with DNS zone visibility, zone management for apply, and an IP allow list for DNSMigrator.

On this page

NS1 API key permissions

Credential type
API key secret
Preview access
DNS → View zones
Apply access
DNS → View zones + Manage zones
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Manage zones covers record changes, zone creation, and zone settings such as DNSSEC. Leave unrelated account and traffic-steering permissions off.

DNSControl id

creds.json TYPE
{
  "TYPE": "NS1"
}

Create credentials

Create an NS1 Connect API key secret with DNS zone visibility, zone management for apply, and an IP allow list for DNSMigrator.

Access you'll grant

Preview

DNS → View zones

Apply

DNS → View zones + Manage zones

Manage zones covers record changes, zone creation, and zone settings such as DNSSEC. Leave unrelated account and traffic-steering permissions off.

Before you start

  • An IBM NS1 Connect user allowed to create API keys.
  • DNSSEC must be available on the NS1 Connect account if DNSMigrator will enable it.

Setup steps

0 of 7 done

  1. Open API keys

    In NS1 Connect, select the User Settings icon → Users & teams → API keys, then select Create API key.

    IBM: create an NS1 Connect API key

  2. Name and expire the key secret

    Enter a name for the connection. Under API key secrets expire after, choose a duration that covers migration and verification; select Custom if you need a specific number of days.

  3. Grant DNS permissions

    Under Access to DNS resources, enable View zones for preview. Also enable Manage zones if DNSMigrator will create zones, change records, or manage DNSSEC.

    PreviewView zones
    ApplyView zones + Manage zones

  4. Limit access to existing zones

    For existing zones, clear Allow by default, then add each target under Allowed zones and records. Keep Allow by default selected only when the key must create a zone that does not exist yet.

  5. Allow the DNSMigrator egress IP

    Under Manage IP allow list, add our egress IP/32. Select Apply this IP allow list exclusively if this key should ignore broader global or team lists and authenticate only from that address.

    Allowed CIDRour egress IP/32

  6. Create and copy the secret

    Finish creating the key and copy the autogenerated API key secret. NS1 Connect does not let you retrieve an existing secret later; it can only be rotated or replaced.

  7. Paste the secret

    Paste the secret value—not the key name or secret ID—into API key, then check access.

Troubleshooting

NS1 rejected the API key

Confirm you pasted the API key secret. If its configured lifetime ended, rotate the key secret and replace the value here.

The key cannot see a zone

Add the zone under Allowed zones and records, or select Allow by default when the key must create new zones.

The key can preview but cannot apply

Edit the API key and add DNS → Manage zones. View zones alone is read-only.

Access is blocked by source IP

Add our egress IP/32 to the key's IP allow list and review any global or team IP allow lists that also apply.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API keyapiKeyRequiredThe autogenerated API key secret shown when you create or rotate an NS1 Connect API key; do not paste the key name or secret ID.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • ALIAS
  • DNAME
  • DS
  • DHCID
  • HTTPS
  • SVCB
  • TLSA
  • NAPTR
  • SPF

Caveats

  • Records that use filter chains, answer metadata, data feeds or record links are copied as plain answers only and flagged in their comment. We never overwrite them on NS1.
  • DNSSEC has to be available on the NS1 account before it can be turned on for a zone.
  • NS1 changes one record set per request, so large zones take longer and count against the API rate limit.

Troubleshooting

NS1 rejected the API key
Confirm you pasted the API key secret. If its configured lifetime ended, rotate the key secret and replace the value here.
The key cannot see a zone
Add the zone under Allowed zones and records, or select Allow by default when the key must create new zones.
The key can preview but cannot apply
Edit the API key and add DNS → Manage zones. View zones alone is read-only.
Access is blocked by source IP
Add {egressIp}/32 to the key's IP allow list and review any global or team IP allow lists that also apply.

Related links

IBM NS1 Connect migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → NS1Route 53 → NS1Azure DNS → NS1Cloud DNS → NS1