3 ms·

For the love of god, switch to a DNS provider with an API. Whatever legacy behemoth you’re working with doesn’t justify a gap this wide.

by 9dev 8mo ago

amluto 8mo ago
Name one that doesn’t have an AWS-style per-query cost. (There might well be a nice one, but I haven’t found it yet.)
- nfredericks 8mo ago
  Might be obvious, but Cloudflare
  - amluto 8mo ago
    No. Cloudflare will give a key scoped to an entire administrative domain in the Cloudflare sense like “a.com”. They will not give you a key scoped to a single entry within that domain. (That entry would be a domain in the RFC 9499 sense, but do you really expect anyone to agree on the terminology?) In particular, there is no support for getting a key scoped to _acme-challenge.a.b.c or, even better, to a particular RR. Maybe if you have an enterprise plan you can very awkwardly fudge it using lots of CNAMEs and subdomains. Some DNS hosts that support old-school dynamic dns can do this. dns.he.net is an example, but they have a login system that very much stuck in the nineties.
  - dboreham 8mo ago
    Cloudflare DNS isn't fully functional (at least for me). Can't be used for general purpose DNS hosting imho.
- radiator 8mo ago
  Hetzner DNS
- toast0 8mo ago
  If it's for a business, I would contact them to see if they have a commercial offering, but I think the Hurricane Electric Free DNS might actually fit. https://dns.he.net/ https://dns.he.net/
  - amluto 8mo ago
    Interestingly, HE’s commercial offerings are in some respects excellent, but their login system is every bit as primitive as the free stuff.
- zufallsheld 8mo ago
  Hetzner does not charge any money for their dns service and they have an api.
  - Hetzner_OL 8mo ago
    Hi there, Hetzner here. Thanks for mentioning us. For anyone who is interested: - https://www.hetzner.com/dns/ https://www.hetzner.com/dns/ - https://docs.hetzner.com/networking/dns https://docs.hetzner.com/networking/dns - https://docs.hetzner.cloud/reference/cloud#tag/zones https://docs.hetzner.cloud/reference/cloud#tag/zones --Katie
    - amluto 8mo ago
      Are there docs for how to create and configure the API keys?
      - Hetzner_OL 8mo ago
        Hi there, Please see: https://docs.hetzner.com/cloud/api/getting-started/generating-api-token/ https://docs.hetzner.com/cloud/api/getting-started/generatin... --Katie
- jcgl 8mo ago
  desec.io
eichin 8mo ago
What open source DNS servers have an API? (I saw someone elsewhere in the thread talking about doing this with dnsmasq, but it sounded like they'd cobbled something together, rather than the software handling it.)
- skinner927 8mo ago
  BIND 9, for starters https://datatracker.ietf.org/doc/html/rfc2136 https://datatracker.ietf.org/doc/html/rfc2136
- aragilar 8mo ago
  I personally wouldn't use dnsmasq for this (as its far more suited as a recursive server and DHCP provider with some basic authoritative records, rather than an authoritative-only server), but every open source authoritative DNS server worth using about has RFC 2136 support.
- quicksilver03 8mo ago
  PowerDNS has an API which is working pretty well, I've been using it to generate ACME certificates since a few years and I also built a DNS hosting service around it.

For the love of god, switch to a DNS provider with an API. Whatever legacy behemoth you’re working with doesn’t justify a gap this wide.

by 9dev 8mo ago

For the love of god, switch to a DNS provider with an API. Whatever legacy behemoth you’re working with doesn’t justify a gap this wide.

amluto 8mo ago

Name one that doesn’t have an AWS-style per-query cost. (There might well be a nice one, but I haven’t found it yet.)

nfredericks 8mo ago
Might be obvious, but Cloudflare
- amluto 8mo ago
  No. Cloudflare will give a key scoped to an entire administrative domain in the Cloudflare sense like “a.com”. They will not give you a key scoped to a single entry within that domain. (That entry would be a domain in the RFC 9499 sense, but do you really expect anyone to agree on the terminology?) In particular, there is no support for getting a key scoped to _acme-challenge.a.b.c or, even better, to a particular RR. Maybe if you have an enterprise plan you can very awkwardly fudge it using lots of CNAMEs and subdomains. Some DNS hosts that support old-school dynamic dns can do this. dns.he.net is an example, but they have a login system that very much stuck in the nineties.
- dboreham 8mo ago
  Cloudflare DNS isn't fully functional (at least for me). Can't be used for general purpose DNS hosting imho.
radiator 8mo ago
Hetzner DNS
toast0 8mo ago
If it's for a business, I would contact them to see if they have a commercial offering, but I think the Hurricane Electric Free DNS might actually fit. https://dns.he.net/ https://dns.he.net/
- amluto 8mo ago
  Interestingly, HE’s commercial offerings are in some respects excellent, but their login system is every bit as primitive as the free stuff.
zufallsheld 8mo ago
Hetzner does not charge any money for their dns service and they have an api.
- Hetzner_OL 8mo ago
  Hi there, Hetzner here. Thanks for mentioning us. For anyone who is interested: - https://www.hetzner.com/dns/ https://www.hetzner.com/dns/ - https://docs.hetzner.com/networking/dns https://docs.hetzner.com/networking/dns - https://docs.hetzner.cloud/reference/cloud#tag/zones https://docs.hetzner.cloud/reference/cloud#tag/zones --Katie
  - amluto 8mo ago
    Are there docs for how to create and configure the API keys?
    - Hetzner_OL 8mo ago
      Hi there, Please see: https://docs.hetzner.com/cloud/api/getting-started/generating-api-token/ https://docs.hetzner.com/cloud/api/getting-started/generatin... --Katie
jcgl 8mo ago
desec.io

eichin 8mo ago

What open source DNS servers have an API? (I saw someone elsewhere in the thread talking about doing this with dnsmasq, but it sounded like they'd cobbled something together, rather than the software handling it.)

skinner927 8mo ago
BIND 9, for starters https://datatracker.ietf.org/doc/html/rfc2136 https://datatracker.ietf.org/doc/html/rfc2136
aragilar 8mo ago
I personally wouldn't use dnsmasq for this (as its far more suited as a recursive server and DHCP provider with some basic authoritative records, rather than an authoritative-only server), but every open source authoritative DNS server worth using about has RFC 2136 support.
quicksilver03 8mo ago
PowerDNS has an API which is working pretty well, I've been using it to generate ACME certificates since a few years and I also built a DNS hosting service around it.