Tencent Cloud DNSPod
DNSPod API key setup: create a CAM sub-user API key on the same Tencent Cloud site as your DNSPod account, then attach DNS and optional registrar permissions.
On this page
DNSPod API key permissions
- Credential type
- CAM sub-user API key
- Preview access
- QcloudDNSPodReadOnlyAccess
- Apply access
- QcloudDNSPodFullAccess
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "TENCENTDNS"
}Create credentials
Create a CAM sub-user API key on the same Tencent Cloud site as your DNSPod account, then attach DNS and optional registrar permissions.
Access you'll grant
QcloudDNSPodReadOnlyAccess
QcloudDNSPodFullAccess
Before you start
- A Tencent Cloud China or Tencent Cloud International account with DNSPod zones.
- A root or admin user that can create CAM sub-users, policies, and API keys.
- For automated nameserver cutover, the domain must be registered in the same Tencent Cloud account and site.
Setup steps
0 of 6 done
Choose the matching Tencent Cloud site
Use the site where the account was created: China (cloud.tencent.com) for mainland China or International (tencentcloud.com) for international accounts. Users and API keys are site-specific.
China site valuecnInternational site valueintlCreate a CAM sub-user
In the matching CAM console, open User → User List → Create User. Choose Custom Creation, select Access Resources and Receive Messages, and create a dedicated sub-user. Do not grant console access when the user is only for API calls.
Attach the DNSPod policy
On the user permission page, bind
QcloudDNSPodReadOnlyAccessfor preview only orQcloudDNSPodFullAccessfor record and zone changes.PreviewQcloudDNSPodReadOnlyAccessApplyQcloudDNSPodFullAccessAdd registrar actions for cutover (optional)
If DNSMigrator should change authoritative nameservers for Tencent-registered domains, add a custom CAM policy for the matching site. These are the exact API actions the registrar adapter calls; no registrar permission is needed for guided cutover.
China registrar actionsdomain:DescribeDomainNameList, domain:DescribeDomainBaseInfo, domain:ModifyDomainDNSBatch, domain:DescribeBatchOperationLogDetailsInternational registrar actionsdomain:DescribeIntlDomainList, domain:BatchModifyIntlDomainDNS, domain:DescribeIntlDomainBatchDetailsCreate the sub-user API key
Open the sub-user's details, select API Keys, then Create Key. Save both SecretId and SecretKey from Create SecretKey. Tencent Cloud no longer lets you retrieve the SecretKey after creation.
Paste the key and select the site
Paste the pair into SecretId and SecretKey, then set Site to the account's China or International site. A valid key from the wrong site will not list the expected zones or domains.
Troubleshooting
AuthFailure or a signature error
Use the SecretId and SecretKey from the same enabled sub-user key, and make sure Site matches the account that issued it.
UnauthorizedOperation when reading or applying DNS
Bind QcloudDNSPodReadOnlyAccess for preview or QcloudDNSPodFullAccess for apply to this exact sub-user.
DNS zones or registered domains are missing
Switch Site only if the resources belong to the other Tencent Cloud site. China and International use different API endpoints and account inventories.
DNS preview works but automated cutover is forbidden
Add the site-specific Domain Registration actions listed in the cutover step. DNSPod policies alone do not authorize registrar nameserver APIs.
Official documentation
- Create and authorize a CAM sub-user
- Manage sub-account API keys
- DNSPod CAM policies
- International domain nameserver API
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| SecretIdsecretId | Required | The SecretId displayed for the dedicated CAM sub-user's API key. |
| SecretKeysecretKey | Required | The SecretKey shown when that key is created. If it was not saved, disable the key and create a replacement. |
| Sitesite | Optional | China for cloud.tencent.com accounts; International for tencentcloud.com accounts. Defaults to China. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Managed in the provider console
- Minimum TTL
- 600 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- SPF
Caveats
- DNSSEC and DS records are managed in the DNSPod console; the API can't change them.
- The minimum TTL depends on the DNSPod plan: 600 seconds on the free plan, lower on paid plans.
- China-site and International-site accounts use different API endpoints; pick the matching site.
- Records on non-default resolution lines (ISP or region routing) are read as geo-routed records.
Troubleshooting
- AuthFailure or a signature error
- Use the SecretId and SecretKey from the same enabled sub-user key, and make sure Site matches the account that issued it.
- UnauthorizedOperation when reading or applying DNS
- Bind QcloudDNSPodReadOnlyAccess for preview or QcloudDNSPodFullAccess for apply to this exact sub-user.
- DNS zones or registered domains are missing
- Switch Site only if the resources belong to the other Tencent Cloud site. China and International use different API endpoints and account inventories.
- DNS preview works but automated cutover is forbidden
- Add the site-specific Domain Registration actions listed in the cutover step. DNSPod policies alone do not authorize registrar nameserver APIs.