Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Vultr DNS

Vultr API key setup: create an API-only service user with a granular DNS policy, then allow DNSMigrator's egress IP if you restrict API access by address.

On this page

Vultr API key permissions

Credential type
API key
Preview access
`network.dns.List` and `network.dns.Read`
Apply access
`network.dns.List`, `network.dns.Read`, `network.dns.Create`, `network.dns.Update` and `network.dns.Delete`
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The API key inherits its user or service user's roles; the key has no separate scope selector.

DNSControl id

creds.json TYPE
{
  "TYPE": "VULTR"
}

Create credentials

Create an API-only service user with a granular DNS policy, then allow DNSMigrator's egress IP if you restrict API access by address.

Access you'll grant

Preview

network.dns.List and network.dns.Read

Apply

network.dns.List, network.dns.Read, network.dns.Create, network.dns.Update and network.dns.Delete

The API key inherits its user or service user's roles; the key has no separate scope selector.

Before you start

  • A Vultr organization with DNS access.
  • Organization-owner access or IAM permissions to manage permission policies, roles, users and API keys.

Setup steps

0 of 8 done

  1. Create a DNS permission policy

    In the Vultr Console, select the organization name → Manage Organization → Permission Policies → +. Enter a Name and optional Description, then allow only the DNS actions needed below.

    Open the Vultr Console
    Previewnetwork.dns.List, network.dns.Read
    Applynetwork.dns.List, network.dns.Read, network.dns.Create, network.dns.Update, network.dns.Delete

  2. Save the permission policy

    Set each selected DNS action to Allow, leave unrelated actions unselected, and select Add Permission Policy.

  3. Create an assignable role

    Open Manage Organization → Roles → +, choose Assignable Role, enter a Name, select the new policy under Permission Policies, and select Add Role.

    Vultr: create a role

  4. Create a service user

    Open Users → +. In Add User, set User Type to Service User, enter Service User Name and Email Address, assign the role, then select Review and add → Add service user.

    Vultr: create a service user

  5. Create the API key

    Open the service user, select API Access → Create API Key, enter Key Name, choose Should the API key expire? and, if applicable, Expiration Date, then select Generate API Key.

  6. Copy and finalize the key

    Select Copy to Clipboard, store the one-time key, check I have successfully copied the key, and select Finalize Key Generation.

  7. Allow the DNSMigrator egress IP

    Only if API IP restrictions are enabled, open API Access → Access Control List → Add IP to Allowlist. Enter our egress IP as Subnet Address and the host Prefix (32 for IPv4), select Add Subnet, and verify it is saved before removing Any IPv4 or Any IPv6.

    Subnet Addressour egress IP
    IPv4 host Prefix32

  8. Paste the API key

    Paste the finalized value into API key here without a Bearer prefix.

Troubleshooting

Vultr returns 401 for the new key

Confirm that key generation was finalized, the key has not expired, and the complete value was pasted without a prefix.

Vultr returns 403 for DNS

Check that the permission policy is attached through the service user's role. Preview needs List and Read; apply also needs Create, Update and Delete.

The connection times out or is blocked by the API allowlist

Add our egress IP to the service user's Access Control List before disabling Any IPv4/Any IPv6 entries.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API keyapiKeyRequiredThe one-time value copied before Finalize Key Generation; paste it without a Bearer prefix.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • SSHFP

Caveats

  • Vultr API keys can't be limited to read-only, so use a dedicated user that only has the Manage DNS permission.
  • If API Access Control is enabled, requests from IP addresses that aren't on the allow-list are rejected.
  • TXT values can't contain double quotes.

Troubleshooting

Vultr returns 401 for the new key
Confirm that key generation was finalized, the key has not expired, and the complete value was pasted without a prefix.
Vultr returns 403 for DNS
Check that the permission policy is attached through the service user's role. Preview needs List and Read; apply also needs Create, Update and Delete.
The connection times out or is blocked by the API allowlist
Add {egressIp} to the service user's Access Control List before disabling Any IPv4/Any IPv6 entries.

Related links

Vultr DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → VultrRoute 53 → VultrAzure DNS → VultrCloud DNS → Vultr