Rackspace Cloud DNS
Rackspace API key setup: create a dedicated Rackspace Cloud user, assign the exact Cloud DNS product role, and retrieve its username and API key.
On this page
Rackspace API key permissions
- Credential type
- Username and API key
- Preview access
- Observer (`dnsaas:observer`)
- Apply access
- Admin (`dnsaas:admin`)
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
This provider does not have a DNSControl id.
Create credentials
Create a dedicated Rackspace Cloud user, assign the exact Cloud DNS product role, and retrieve its username and API key.
Access you'll grant
Observer (dnsaas:observer)
Admin (dnsaas:admin)
dnsaas:creator) cannot delete domains or records, so it is not sufficient for apply plans that include deletions.Before you start
- A Rackspace Cloud account with Cloud DNS available in its service catalog.
- Account-owner or administrator access to create users and assign product roles.
Setup steps
0 of 6 done
Create a dedicated user
Sign in to the Rackspace portal and open Account → User Management → Create New User. Create a separate user for DNSMigrator rather than sharing the account owner's key.
Assign the Cloud DNS role
Assign the product-specific Cloud DNS Observer role for preview only, or Admin for apply. Do not choose Creator for apply because it lacks delete permission.
Preview rolednsaas:observerApply rolednsaas:adminOpen the user's API key
As an administrator, open Account → User Management → the username → Rackspace API Key → Show. Alternatively, sign in as that user and open My Profile & Settings → Security Settings → Rackspace API Key → Show.
Copy the username and API key
Copy the exact Rackspace username and the displayed API key. Unlike many provider secrets, a Rackspace API key remains viewable until it is reset.
Choose a domain contact email
Optionally enter SOA contact email for the SOA contact used only when DNSMigrator creates a domain. If blank, the connector uses
hostmaster@<domain>.Enter the Rackspace credentials
Paste the values into Cloud username, API key and optional SOA contact email here. DNSMigrator exchanges them with Rackspace Identity and discovers the Cloud DNS endpoint automatically.
Troubleshooting
Rackspace rejects the username or API key
Make sure the key belongs to the entered Cloud username, not another account user. If the key was reset, retrieve the current value.
Rackspace returns no usable Cloud DNS endpoint
Confirm that Cloud DNS is enabled for the account and appears in the authenticated user's service catalog.
Preview works but deletion fails
Observer is read-only and Creator cannot delete. Assign Admin (dnsaas:admin) for a destination connection.
Domain creation rejects the SOA contact
Enter a valid email address, or leave the optional field blank to use hostmaster@<domain>.
Official documentation
- View and reset your API key
- Manage API keys for other users
- Detailed Cloud DNS permissions matrix
- Cloud DNS role-based access control
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| Cloud usernameusername | Required | The exact username of the Rackspace Cloud user that owns the API key. |
| API keyapiKey | Required | The value shown under Rackspace API Key; it remains viewable until reset. |
| SOA contact emailemailAddress | Optional | Optional SOA contact used only when creating a domain; blank defaults to hostmaster@<domain>. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Not available through this connection
- Minimum TTL
- 300 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- NS
- SRV
- TXT
Caveats
- Apex NS and SOA records are managed by Rackspace and can't be changed.
- PTR records are only managed through Rackspace's reverse-DNS API for its own cloud devices, so they aren't migrated.
- TTLs below 300 seconds are raised to 300.
- Rackspace removes quote and backslash characters from TXT data.
- Changes run as asynchronous Rackspace jobs; we wait for each job to finish, so large plans take longer.
- New domains use the connection's SOA contact email, or hostmaster@<domain> when none is set.
- Subdomains that Rackspace hosts as separate domains are listed as their own zones.
Troubleshooting
- Rackspace rejects the username or API key
- Make sure the key belongs to the entered Cloud username, not another account user. If the key was reset, retrieve the current value.
- Rackspace returns no usable Cloud DNS endpoint
- Confirm that Cloud DNS is enabled for the account and appears in the authenticated user's service catalog.
- Preview works but deletion fails
- Observer is read-only and Creator cannot delete. Assign Admin (dnsaas:admin) for a destination connection.
- Domain creation rejects the SOA contact
- Enter a valid email address, or leave the optional field blank to use hostmaster@<domain>.