Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Selectel DNS Hosting

Selectel API credentials setup: create a Selectel service user scoped to one project and assign the current reader or member role for DNS Hosting (actual).

On this page

Selectel API credentials permissions

Credential type
Project-scoped service user
Preview access
Projects scope → reader
Apply access
Projects scope → member
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The current English Selectel console and role reference use the lowercase role names reader and member. Scope the permission to only the project that holds the DNS Hosting zones.

DNSControl id

This provider does not have a DNSControl id.

Create credentials

Create a Selectel service user scoped to one project and assign the current reader or member role for DNS Hosting (actual).

Access you'll grant

Preview

Projects scope → reader

Apply

Projects scope → member

The current English Selectel console and role reference use the lowercase role names reader and member. Scope the permission to only the project that holds the DNS Hosting zones.

Before you start

  • The zones must use DNS Hosting (actual), not DNS Hosting (legacy API v1).
  • The Account Owner or a user with the iam.admin role must create the service user.
  • Selectel currently requires an account balance of at least 200 ₽ to assign the member role used for apply.

Setup steps

0 of 5 done

  1. Open service users

    In Selectel's English control panel, select IAM in the top menu, open Service users, and select Add service user.

    Open Selectel service users

  2. Set the service-user credentials

    Under Service user details, enter a username and generate or enter a password. The current console requires at least 20 characters with uppercase and lowercase Latin letters, a digit, and a special character. Save the password now; it cannot be viewed after creation.

  3. Scope access to the DNS project

    Under Access settings, choose the Projects scope and select only the project that holds the zones. Choose reader for preview or member for apply, then select Add user.

    Preview rolereader
    Apply rolemember

  4. Copy the account number and project name

    Copy the account number from the upper-right corner of the control panel. Copy the selected project's name exactly. Selectel's API documentation calls the first value <account_id> even though the UI describes it as the account number.

    Selectel: project-scoped IAM tokens

  5. Paste the four values

    Enter the account number in Account ID, then enter the service user's Service user name, Service user password, and the selected Project name. DNSMigrator exchanges them for a 24-hour project-scoped IAM token automatically.

Troubleshooting

Selectel rejects the service user

Check all four identity values together: numeric account number, service-user name, password, and project name. Reset the password if it was not saved.

Preview works but apply returns 403

Change the project-scoped role from reader to member. The member role manages resources in the selected project.

No zones appear

Confirm the user is scoped to the correct project and the zones are in DNS Hosting (actual). Legacy DNS Hosting zones use a different API and must be moved in the control panel first.

The member role cannot be assigned

Check the account balance. Selectel's current user-creation documentation requires at least 200 ₽ before assigning member.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Account IDaccountIdRequiredThe numeric account number shown in the upper-right corner of the Selectel control panel.
Service user nameusernameRequiredThe username entered under Service user details, visible later in IAM → Service users.
Service user passwordpasswordRequiredThe service-user password saved at creation. It must meet Selectel's current 20-character complexity rules; reset it if lost.
Project nameprojectNameRequiredThe exact name of the project selected under the user's Projects access scope.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • ALIAS
  • DNAME
  • HTTPS
  • SVCB
  • SSHFP

Caveats

  • Only DNS Hosting (actual) zones are supported. Zones still on DNS Hosting (legacy, API v1) must be moved to the actual version in the control panel first.
  • Zones belong to a project; this connection only sees the project it signs in to.
  • Apex NS and SOA records are created and managed by Selectel and can't be changed.
  • A CNAME can't be placed at the zone apex; use ALIAS instead.
  • Each record set can hold at most 100 values.
  • Records you disabled in Selectel are left untouched and aren't imported.
  • Selectel doesn't publish API rate limits; requests are retried with backoff when throttled.

Troubleshooting

Selectel rejects the service user
Check all four identity values together: numeric account number, service-user name, password, and project name. Reset the password if it was not saved.
Preview works but apply returns 403
Change the project-scoped role from reader to member. The member role manages resources in the selected project.
No zones appear
Confirm the user is scoped to the correct project and the zones are in DNS Hosting (actual). Legacy DNS Hosting zones use a different API and must be moved in the control panel first.
The member role cannot be assigned
Check the account balance. Selectel's current user-creation documentation requires at least 200 ₽ before assigning member.

Related links

Selectel DNS Hosting migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → SelectelRoute 53 → SelectelAzure DNS → SelectelCloud DNS → Selectel