Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Oracle Cloud DNS

Oracle Cloud API key setup: create a dedicated OCI user, grant access to the public DNS zones in one compartment, and add an RSA API signing key.

On this page

Oracle Cloud API key permissions

Credential type
API signing key
Preview access
read dns-zones + read dns-records
Apply access
use dns-zones + use dns-records; manage dns-zones only to create zones
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

OCI's aggregate `dns` resource also covers steering policies, TSIG keys, views, and resolvers. The narrower dns-zones and dns-records resource types cover the API calls DNSMigrator makes. Scope each statement to the compartment that contains the zones.

DNSControl id

creds.json TYPE
{
  "TYPE": "ORACLE"
}

Create credentials

Create a dedicated OCI user, grant access to the public DNS zones in one compartment, and add an RSA API signing key.

Access you'll grant

Preview

read dns-zones + read dns-records

Apply

use dns-zones + use dns-records; manage dns-zones only to create zones

OCI's aggregate dns resource also covers steering policies, TSIG keys, views, and resolvers. The narrower dns-zones and dns-records resource types cover the API calls DNSMigrator makes. Scope each statement to the compartment that contains the zones.

Before you start

  • An Oracle Cloud Infrastructure tenancy with public DNS zones.
  • An administrator who can create an IAM user, group, policy, and API key.
  • The name and OCID of the compartment that contains the zones.

Setup steps

0 of 6 done

  1. Create a dedicated user and group

    In the OCI Console, open Identity & Security → Users, create a user for DNSMigrator, create an IAM group such as DNSMigrator, and add the user to that group.

    Open the OCI Console

  2. Create a DNS policy

    Open Identity & Security → Policies, select Create Policy, and under Policy Builder select Show manual editor. Use the preview statements below for read-only access. For changes to existing zones, replace read with use; add the manage dns-zones statement only if DNSMigrator should create zones.

    Oracle: create an IAM policy
    Preview policyAllow group DNSMigrator to read dns-zones in compartment <compartment-name> Allow group DNSMigrator to read dns-records in compartment <compartment-name>
    Apply to existing zonesAllow group DNSMigrator to use dns-zones in compartment <compartment-name> Allow group DNSMigrator to use dns-records in compartment <compartment-name>
    Also create zonesAllow group DNSMigrator to manage dns-zones in compartment <compartment-name> Allow group DNSMigrator to use dns-records in compartment <compartment-name>

  3. Generate an API signing key

    Open the new user's details, then Resources → API Keys → Add API Key. Generate a key pair, select Download Private Key, and then select Add. OCI requires an RSA key in PEM format with at least 2,048 bits.

    Oracle: generate an API signing key

  4. Copy the configuration values

    Keep the downloaded private key. In Configuration File Preview, copy tenancy, user, fingerprint, and region. To reopen the preview later, use the key's Actions menu → View configuration file.

    Tenancy valuetenancy
    User valueuser
    Fingerprint valuefingerprint
    Region valueregion

  5. Copy the compartment OCID

    Open the compartment that contains the public zones and copy its OCID. You may leave Compartment OCID empty only when the zones are in the tenancy's root compartment; DNSMigrator then uses the tenancy OCID.

  6. Paste the key and identifiers

    Paste each configuration value into its matching field. For API private key (PEM), paste the complete -----BEGIN … PRIVATE KEY----- through -----END … PRIVATE KEY----- block, not the key_file path. Fill Key passphrase only for an encrypted private key.

Troubleshooting

Oracle rejects the request signature

Make sure the private key belongs to the uploaded public key and that the tenancy OCID, user OCID, fingerprint, region, and optional passphrase all come from the same key configuration.

Oracle reports NotAuthorizedOrNotFound

Check that the policy names the user's group and the compartment containing the zone. Read access needs both dns-zones and dns-records.

The zone list is empty

Confirm the public zones are in the entered compartment. This connection does not search child compartments or read private resolver zones.

The private key cannot be read

Paste the PEM contents rather than a filename. If the key is encrypted, also enter its passphrase; otherwise generate a replacement API key pair.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Tenancy OCIDtenancyOcidRequiredThe `tenancy` value in Configuration File Preview; it starts with ocid1.tenancy.oc1..
User OCIDuserOcidRequiredThe `user` value in Configuration File Preview; it starts with ocid1.user.oc1..
Key fingerprintfingerprintRequiredThe `fingerprint` value in Configuration File Preview or beside the key in API Keys; 16 colon-separated byte pairs.
API private key (PEM)privateKeyRequiredThe complete PEM private-key block from the file downloaded before you selected Add. Do not paste the key_file path or the public key.
Key passphrasepassphraseOptionalOnly the passphrase used when you manually generated an encrypted private key; otherwise leave empty.
RegionregionRequiredThe `region` value in Configuration File Preview, for example us-ashburn-1.
Compartment OCIDcompartmentIdOptionalThe OCID of the compartment holding the public zones. Leave empty only for the tenancy root compartment.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • ALIAS
  • NAPTR
  • SSHFP
  • TLSA
  • HTTPS
  • SVCB
  • DS
  • CERT
  • LOC
  • SPF
  • DNAME

Caveats

  • Only public zones in the commercial realm (oraclecloud.com) are supported. Private resolver zones are skipped.
  • Apex NS records are fixed by Oracle Cloud, and records marked as protected can't be changed.
  • DNSSEC key-signing-key rollovers still need a manual promote step in Oracle Cloud after the DS record is updated at the registrar.

Troubleshooting

Oracle rejects the request signature
Make sure the private key belongs to the uploaded public key and that the tenancy OCID, user OCID, fingerprint, region, and optional passphrase all come from the same key configuration.
Oracle reports NotAuthorizedOrNotFound
Check that the policy names the user's group and the compartment containing the zone. Read access needs both dns-zones and dns-records.
The zone list is empty
Confirm the public zones are in the entered compartment. This connection does not search child compartments or read private resolver zones.
The private key cannot be read
Paste the PEM contents rather than a filename. If the key is encrypted, also enter its passphrase; otherwise generate a replacement API key pair.

Related links

Oracle Cloud DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → Oracle CloudRoute 53 → Oracle CloudAzure DNS → Oracle CloudCloud DNS → Oracle Cloud