Skip to content
DNSmigrator
betaDNS betaDNS hostingSetup guide checked 2026-09-27

RWTH Aachen DNS-Admin

RWTH API token setup: create a DNS-Admin API token and connect only from a DNSMigrator deployment inside the RWTH Aachen network.

On this page

RWTH API token permissions

Credential type
DNS-Admin API token
Preview access
A DNS-Admin API token inheriting your DNS-Admin rights, restricted to the required domain or subdomain.
Apply access
The same DNS-Admin API token used for preview; public RWTH documentation does not describe a separate read-only token mode.
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

DNSMigrator checks access with list_zones. Applying also creates, updates, or deletes records and calls deploy_zone. Restrict the token to the smallest domain subtree you need.

DNSControl id

creds.json TYPE
{
  "TYPE": "RWTH"
}

Create credentials

Create a DNS-Admin API token and connect only from a DNSMigrator deployment inside the RWTH Aachen network.

Access you'll grant

Preview

A DNS-Admin API token inheriting your DNS-Admin rights, restricted to the required domain or subdomain.

Apply

The same DNS-Admin API token used for preview; public RWTH documentation does not describe a separate read-only token mode.

DNSMigrator checks access with list_zones. Applying also creates, updates, or deletes records and calls deploy_zone. Restrict the token to the smallest domain subtree you need.

Before you start

  • You must be a registered network contact or IT administrator with DNS-Admin access for the zone.
  • DNSMigrator's outbound connection must originate on the RWTH campus network or through RWTH VPN; the public hosted service cannot reach this API.

Setup steps

0 of 5 done

  1. Use an RWTH-reachable deployment

    Run a self-hosted DNSMigrator deployment whose outbound traffic is inside the RWTH network, or route that deployment through RWTH VPN. Do this before checking the token: noc-portal.rz.rwth-aachen.de is not reachable from the public hosted worker.

    RWTH VPN instructions

  2. Open API tokens

    Sign in to DNS-Admin and open API tokens. If you do not have DNS-Admin access, ask the IT ServiceDesk to register you as a contact for the domain first.

    Open DNS-Admin API tokens

  3. Create a restricted token

    Create a token and restrict it to the domain or subdomain being moved. RWTH says a token inherits your DNS-Admin permissions but can be restricted further, for example to a subdomain.

  4. Set the token lifetime

    Choose an expiry no more than one year away. RWTH API tokens have a maximum validity of one year and can be extended later.

    Maximum validity1 year

  5. Copy and paste the token

    Copy the generated value and paste it into DNS-Admin API token. DNSMigrator sends it in the PRIVATE-TOKEN request header.

    Request headerPRIVATE-TOKEN

Troubleshooting

The connection times out or the portal does not open

The DNS-Admin API is intranet-only. Move DNSMigrator inside the RWTH network or establish RWTH VPN from the deployment host; opening VPN only on your laptop does not route a remote hosted worker.

The token works but the zone is missing

Confirm you are a registered contact for that zone and that the token's domain restriction includes it. RWTH assigns zones through the IT Center; the API cannot create one.

A previously working token is rejected

Check whether its one-year validity ended or it was blocked or deleted in DNS-Admin. Extend it or create a replacement token.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
DNS-Admin API tokenapiTokenRequiredThe token created under DNS-Admin → API tokens, restricted to the required domain subtree.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Managed in the provider console
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • SSHFP

Caveats

  • The DNS-Admin API is only reachable from the RWTH network (campus or VPN), so the hosted service cannot connect; use the DNSMigrator CLI from inside the network.
  • Changes are staged and published by a zone deploy; RWTH deploys zones in 15-minute cycles, so updates can take that long to appear.
  • Zones are assigned by the RWTH IT Center and cannot be created through the API; the SOA record is locked.

Troubleshooting

The connection times out or the portal does not open
The DNS-Admin API is intranet-only. Move DNSMigrator inside the RWTH network or establish RWTH VPN from the deployment host; opening VPN only on your laptop does not route a remote hosted worker.
The token works but the zone is missing
Confirm you are a registered contact for that zone and that the token's domain restriction includes it. RWTH assigns zones through the IT Center; the API cannot create one.
A previously working token is rejected
Check whether its one-year validity ended or it was blocked or deleted in DNS-Admin. Extend it or create a replacement token.

Related links

RWTH Aachen DNS-Admin migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → RWTHRoute 53 → RWTHAzure DNS → RWTHCloud DNS → RWTH