DNSSEC

DNSSEC of the account’s domains, with the same fields and answers whatever the domain’s extension. The state tells you what to send, so no trial and error is needed:

Read the state: GET /client/domains/{domain}/dnssec says whether DNSSEC is supported, the record_type the domain takes, the operations available right now and the algorithms / digest_types it accepts.
Turn it on: if enable is in operations, the zone is signed for you (typically a domain using our DNS service): call POST …/dnssec/enable, no record needed. Otherwise add your records with POST …/dnssec/records, in the form record_type names: ds (key_tag, algorithm, digest_type, digest) or dnskey (flags, protocol, algorithm, public_key), using the values your DNS provider gives you.
Check the result: every call answers with the refreshed state. pending: true means the change was accepted but is not applied yet: read the state again until it is false.

DELETE …/dnssec/records removes one record, DELETE …/dnssec removes them all (DNSSEC off). Success bodies are {"data": …}; errors use the standard error envelope (ApiError, see Errors).

Get the DNSSEC state of a domain #

GET /client/domains/{domain}/dnssec

Start here: the state says what the domain accepts, so the other calls need no guessing. supported: false (never an error) means DNSSEC cannot be managed for this domain. Otherwise record_type names the record form it takes, operations the calls available right now, algorithms and digest_types the values it accepts, and active whether DNSSEC is on. Read live on every call.

DNSSEC can be changed only while the domain is active. For any other status operations is empty and blocked_reason says why; the records are still read while the registry holds the domain (grace, redemption, transferring away), and are null when it does not (not registered yet, or no longer ours).

Authentication: bearer Token
Requires permission domains
Rate limit: 30 req/min per user

Parameters

Path

domain integer required

The domain ID

Responses

200

The domain’s DNSSEC state.
Response body application/json
- data object
  10 properties
  - supported boolean
    
    true when DNSSEC can be managed for this domain through this API. false is not an error: DNSSEC is not offered for this domain here, the other fields are then empty and every other DNSSEC call answers dnssec_not_supported.
  - record_type string | null
    
    The record form this domain takes; null when not supported. ds: the hash of your key, as your DNS provider shows it (key_tag, algorithm, digest_type, digest). dnskey: the key itself (flags, protocol, algorithm, public_key). Send records in this form only: the other one is refused with invalid_request.
    
    Allowed values ds dnskey
  - operations array of string
    
    The calls available on this domain right now. add: POST …/dnssec/records. remove: DELETE …/dnssec/records. disable: DELETE …/dnssec (removes every record: DNSSEC off). enable: POST …/dnssec/enable, listed only where the zone is signed for you (typically a domain using our DNS service), which then takes no record. Empty when not supported, when the domain is not active (see blocked_reason), and it can be empty while a change is still being applied (pending: true).
    
    Allowed values add remove disable enable
  - algorithms array of integer
    
    The algorithm numbers (IANA) this domain accepts in algorithm, as plain integers: 5 RSA/SHA-1, 7 RSASHA1-NSEC3-SHA1, 8 RSA/SHA-256, 10 RSA/SHA-512, 13 ECDSA P-256/SHA-256, 14 ECDSA P-384/SHA-384, 15 Ed25519, 16 Ed448. Often a subset of these. Empty when not supported.
    
    Allowed values 5 7 8 10 13 14 15 16
  - digest_types array of integer
    
    ds domains only (absent for dnskey): the digest type numbers accepted in digest_type, as plain integers: 1 SHA-1, 2 SHA-256, 4 SHA-384.
    
    Allowed values 1 2 4
  - records array of object | null
    
    The DNSSEC records on file for the domain, each with the fields of the domain’s record_type only. Empty when there is none, and on a zone signed for you, which lists no record (see active). null when a change was accepted but the records could not be read back right after it (read the state again), and when the domain is not held at the registry: a domain that is not registered yet, or no longer ours (blocked_reason is then set). A domain in grace, redemption or transferring away is still read.
    
    7 properties
    
    key_tag integer
    
    ds only: the key tag, 0-65535.
    
    flags integer
    
    dnskey only: 257 (KSK, the usual one) or 256 (ZSK).
    
    protocol integer
    
    dnskey only: always 3.
    
    algorithm integer
    
    Both forms: the DNSSEC algorithm number (IANA), one of the domain’s algorithms.
    
    digest_type integer
    
    ds only: the digest type, one of the domain’s digest_types.
    
    digest string
    
    ds only: the digest, hexadecimal, upper case.
    
    public_key string
    
    dnskey only: the public key, Base64, without whitespace.
  - active boolean | null
    
    Whether DNSSEC is on for the domain. Usually the same as records not being empty; it also covers a zone signed for you (which lists no record) and DS records set outside this API. null when not supported, or when records is null.
  - pending boolean
    
    true when a change was accepted but is not applied yet: records and active still show the situation before it. Poll GET …/dnssec until it is false; no need to send the change again.
  - pending_message string | null
    
    A short customer-readable note about the pending change, when there is one; otherwise null.
  - blocked_reason object | null
    
    Why no change can be made right now, or null when changes are possible. Set when the domain’s status is not active: DNSSEC is changed only on an active domain, like the nameservers and the contacts. operations is then empty and every change answers 403 domain_not_active.
    
    2 properties
    
    code string
    
    The code a change would be refused with.
    
    Allowed values domain_not_active
    
    message string
    
    The reason, readable by a customer.

401 unauthenticated ApiError
403 client_token_required token_not_api_enabled token_not_client_scoped client_access_revoked client_cancelled ip_not_allowed ip_whitelist_misconfigured forbidden ApiError
404 client_not_found not_found ApiError
429 rate_limited ApiError
502 upstream_error ApiError

cURL

curl 'https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec' \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json'

PHP

<?php

$ch = curl_init('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('API_TOKEN'),
        'Accept: application/json',
    ],
]);

$body   = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

if ($status >= 400) {
    // Error envelope: {"error": {"code": "...", "message": "...", "fields": {...}}}
    echo $status . ' ' . ($body['error']['code'] ?? '') . ': ' . ($body['error']['message'] ?? '') . "\n";
} else {
    print_r($body);
}

Node.js

// Save as a .mjs file (ES module, Node 18+): it uses top-level await.
const response = await fetch('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec', {
  headers: {
    Authorization: `Bearer ${process.env.API_TOKEN}`,
    Accept: 'application/json',
  },
});

console.log(await response.json());

Response

200

{
  "data": {
    "supported": true,
    "record_type": "ds",
    "operations": [
      "add",
      "remove",
      "disable"
    ],
    "algorithms": [
      8,
      13,
      15
    ],
    "digest_types": [
      2,
      4
    ],
    "records": [
      {
        "key_tag": 12345,
        "flags": 257,
        "protocol": 3,
        "algorithm": 13,
        "digest_type": 2,
        "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766",
        "public_key": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="
      }
    ],
    "active": true,
    "pending": false,
    "pending_message": null,
    "blocked_reason": null
  }
}

Error responses share one format: see Errors.

Disable DNSSEC #

DELETE /client/domains/{domain}/dnssec

Offered when disable is in operations: removes every DNSSEC record of the domain, or stops the signing of a zone signed for you. Answers with the refreshed state.

Authentication: bearer Token
Requires permission managedomains
Rate limit: 20 req/min per user

Parameters

Path

domain integer required

The domain ID

Responses

200

The domain’s DNSSEC state after the change.
Response body application/json
- data object
  10 properties
  - supported boolean
    
    true when DNSSEC can be managed for this domain through this API. false is not an error: DNSSEC is not offered for this domain here, the other fields are then empty and every other DNSSEC call answers dnssec_not_supported.
  - record_type string | null
    
    The record form this domain takes; null when not supported. ds: the hash of your key, as your DNS provider shows it (key_tag, algorithm, digest_type, digest). dnskey: the key itself (flags, protocol, algorithm, public_key). Send records in this form only: the other one is refused with invalid_request.
    
    Allowed values ds dnskey
  - operations array of string
    
    The calls available on this domain right now. add: POST …/dnssec/records. remove: DELETE …/dnssec/records. disable: DELETE …/dnssec (removes every record: DNSSEC off). enable: POST …/dnssec/enable, listed only where the zone is signed for you (typically a domain using our DNS service), which then takes no record. Empty when not supported, when the domain is not active (see blocked_reason), and it can be empty while a change is still being applied (pending: true).
    
    Allowed values add remove disable enable
  - algorithms array of integer
    
    The algorithm numbers (IANA) this domain accepts in algorithm, as plain integers: 5 RSA/SHA-1, 7 RSASHA1-NSEC3-SHA1, 8 RSA/SHA-256, 10 RSA/SHA-512, 13 ECDSA P-256/SHA-256, 14 ECDSA P-384/SHA-384, 15 Ed25519, 16 Ed448. Often a subset of these. Empty when not supported.
    
    Allowed values 5 7 8 10 13 14 15 16
  - digest_types array of integer
    
    ds domains only (absent for dnskey): the digest type numbers accepted in digest_type, as plain integers: 1 SHA-1, 2 SHA-256, 4 SHA-384.
    
    Allowed values 1 2 4
  - records array of object | null
    
    The DNSSEC records on file for the domain, each with the fields of the domain’s record_type only. Empty when there is none, and on a zone signed for you, which lists no record (see active). null when a change was accepted but the records could not be read back right after it (read the state again), and when the domain is not held at the registry: a domain that is not registered yet, or no longer ours (blocked_reason is then set). A domain in grace, redemption or transferring away is still read.
    
    7 properties
    
    key_tag integer
    
    ds only: the key tag, 0-65535.
    
    flags integer
    
    dnskey only: 257 (KSK, the usual one) or 256 (ZSK).
    
    protocol integer
    
    dnskey only: always 3.
    
    algorithm integer
    
    Both forms: the DNSSEC algorithm number (IANA), one of the domain’s algorithms.
    
    digest_type integer
    
    ds only: the digest type, one of the domain’s digest_types.
    
    digest string
    
    ds only: the digest, hexadecimal, upper case.
    
    public_key string
    
    dnskey only: the public key, Base64, without whitespace.
  - active boolean | null
    
    Whether DNSSEC is on for the domain. Usually the same as records not being empty; it also covers a zone signed for you (which lists no record) and DS records set outside this API. null when not supported, or when records is null.
  - pending boolean
    
    true when a change was accepted but is not applied yet: records and active still show the situation before it. Poll GET …/dnssec until it is false; no need to send the change again.
  - pending_message string | null
    
    A short customer-readable note about the pending change, when there is one; otherwise null.
  - blocked_reason object | null
    
    Why no change can be made right now, or null when changes are possible. Set when the domain’s status is not active: DNSSEC is changed only on an active domain, like the nameservers and the contacts. operations is then empty and every change answers 403 domain_not_active.
    
    2 properties
    
    code string
    
    The code a change would be refused with.
    
    Allowed values domain_not_active
    
    message string
    
    The reason, readable by a customer.

401 unauthenticated ApiError
403 client_token_required token_not_api_enabled token_not_client_scoped client_access_revoked client_cancelled ip_not_allowed ip_whitelist_misconfigured forbidden domain_not_active ApiError
404 client_not_found not_found ApiError
409 dnssec_conflict ApiError
422 dnssec_not_supported dnssec_refused ApiError
429 rate_limited ApiError
502 upstream_error ApiError

cURL

curl -X DELETE 'https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec' \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json'

PHP

<?php

$ch = curl_init('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('API_TOKEN'),
        'Accept: application/json',
    ],
]);

$body   = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

if ($status >= 400) {
    // Error envelope: {"error": {"code": "...", "message": "...", "fields": {...}}}
    echo $status . ' ' . ($body['error']['code'] ?? '') . ': ' . ($body['error']['message'] ?? '') . "\n";
} else {
    print_r($body);
}

Node.js

const response = await fetch('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.API_TOKEN}`,
    Accept: 'application/json',
  },
});

console.log(await response.json());

Response

200

{
  "data": {
    "supported": true,
    "record_type": "ds",
    "operations": [
      "add",
      "remove",
      "disable"
    ],
    "algorithms": [
      8,
      13,
      15
    ],
    "digest_types": [
      2,
      4
    ],
    "records": [
      {
        "key_tag": 12345,
        "flags": 257,
        "protocol": 3,
        "algorithm": 13,
        "digest_type": 2,
        "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766",
        "public_key": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="
      }
    ],
    "active": true,
    "pending": false,
    "pending_message": null,
    "blocked_reason": null
  }
}

Error responses share one format: see Errors.

Add a DNSSEC record #

POST /client/domains/{domain}/dnssec/records

Offered when add is in operations. Send the fields of the domain’s record_type, with the values your DNS provider gives you. For ds:

{"key_tag": 12345, "algorithm": 13, "digest_type": 2, "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766"}

For dnskey:

{"flags": 257, "protocol": 3, "algorithm": 13, "public_key": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="}

Answers with the refreshed state; pending: true means the change was accepted but is not applied yet — read the state again until it is false.

Authentication: bearer Token
Requires permission managedomains
Rate limit: 20 req/min per user

Parameters

Path

domain integer required

The domain ID

Body `application/json` required

key_tag integer

ds only: the key tag, 0-65535.
- Minimum 0
- Maximum 65535
algorithm integer required

Both forms: the DNSSEC algorithm number (IANA), one of the domain’s algorithms.
digest_type integer

ds only: the digest type, one of the domain’s digest_types.
digest string

ds only: the digest, hexadecimal (case is ignored).
- Pattern ^[A-Fa-f0-9]+$
- Max length 128
public_key string

dnskey only: the public key, Base64. Whitespace is ignored.
- Max length 4096
flags integer

dnskey only: 257 (KSK, the usual one) or 256 (ZSK).

Allowed values 256 257
protocol integer

dnskey only: always 3.

Allowed values 3

Responses

201

The domain’s DNSSEC state after the change.
Response body application/json
- data object
  10 properties
  - supported boolean
    
    true when DNSSEC can be managed for this domain through this API. false is not an error: DNSSEC is not offered for this domain here, the other fields are then empty and every other DNSSEC call answers dnssec_not_supported.
  - record_type string | null
    
    The record form this domain takes; null when not supported. ds: the hash of your key, as your DNS provider shows it (key_tag, algorithm, digest_type, digest). dnskey: the key itself (flags, protocol, algorithm, public_key). Send records in this form only: the other one is refused with invalid_request.
    
    Allowed values ds dnskey
  - operations array of string
    
    The calls available on this domain right now. add: POST …/dnssec/records. remove: DELETE …/dnssec/records. disable: DELETE …/dnssec (removes every record: DNSSEC off). enable: POST …/dnssec/enable, listed only where the zone is signed for you (typically a domain using our DNS service), which then takes no record. Empty when not supported, when the domain is not active (see blocked_reason), and it can be empty while a change is still being applied (pending: true).
    
    Allowed values add remove disable enable
  - algorithms array of integer
    
    The algorithm numbers (IANA) this domain accepts in algorithm, as plain integers: 5 RSA/SHA-1, 7 RSASHA1-NSEC3-SHA1, 8 RSA/SHA-256, 10 RSA/SHA-512, 13 ECDSA P-256/SHA-256, 14 ECDSA P-384/SHA-384, 15 Ed25519, 16 Ed448. Often a subset of these. Empty when not supported.
    
    Allowed values 5 7 8 10 13 14 15 16
  - digest_types array of integer
    
    ds domains only (absent for dnskey): the digest type numbers accepted in digest_type, as plain integers: 1 SHA-1, 2 SHA-256, 4 SHA-384.
    
    Allowed values 1 2 4
  - records array of object | null
    
    The DNSSEC records on file for the domain, each with the fields of the domain’s record_type only. Empty when there is none, and on a zone signed for you, which lists no record (see active). null when a change was accepted but the records could not be read back right after it (read the state again), and when the domain is not held at the registry: a domain that is not registered yet, or no longer ours (blocked_reason is then set). A domain in grace, redemption or transferring away is still read.
    
    7 properties
    
    key_tag integer
    
    ds only: the key tag, 0-65535.
    
    flags integer
    
    dnskey only: 257 (KSK, the usual one) or 256 (ZSK).
    
    protocol integer
    
    dnskey only: always 3.
    
    algorithm integer
    
    Both forms: the DNSSEC algorithm number (IANA), one of the domain’s algorithms.
    
    digest_type integer
    
    ds only: the digest type, one of the domain’s digest_types.
    
    digest string
    
    ds only: the digest, hexadecimal, upper case.
    
    public_key string
    
    dnskey only: the public key, Base64, without whitespace.
  - active boolean | null
    
    Whether DNSSEC is on for the domain. Usually the same as records not being empty; it also covers a zone signed for you (which lists no record) and DS records set outside this API. null when not supported, or when records is null.
  - pending boolean
    
    true when a change was accepted but is not applied yet: records and active still show the situation before it. Poll GET …/dnssec until it is false; no need to send the change again.
  - pending_message string | null
    
    A short customer-readable note about the pending change, when there is one; otherwise null.
  - blocked_reason object | null
    
    Why no change can be made right now, or null when changes are possible. Set when the domain’s status is not active: DNSSEC is changed only on an active domain, like the nameservers and the contacts. operations is then empty and every change answers 403 domain_not_active.
    
    2 properties
    
    code string
    
    The code a change would be refused with.
    
    Allowed values domain_not_active
    
    message string
    
    The reason, readable by a customer.

401 unauthenticated ApiError
403 client_token_required token_not_api_enabled token_not_client_scoped client_access_revoked client_cancelled ip_not_allowed ip_whitelist_misconfigured forbidden domain_not_active ApiError
404 client_not_found not_found ApiError
409 dnssec_duplicate_record dnssec_conflict ApiError
422 dnssec_not_supported dnssec_invalid_record dnssec_limit_reached dnssec_refused invalid_request unprocessable ApiError
429 rate_limited ApiError
502 upstream_error ApiError

cURL

curl -X POST 'https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/records' \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "key_tag": 12345,
  "algorithm": 13,
  "digest_type": 2,
  "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766"
}'

PHP

<?php

$ch = curl_init('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/records');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('API_TOKEN'),
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'key_tag' => 12345,
        'algorithm' => 13,
        'digest_type' => 2,
        'digest' => 'E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766',
    ]),
]);

$body   = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

if ($status >= 400) {
    // Error envelope: {"error": {"code": "...", "message": "...", "fields": {...}}}
    echo $status . ' ' . ($body['error']['code'] ?? '') . ': ' . ($body['error']['message'] ?? '') . "\n";
} else {
    print_r($body);
}

Node.js

const response = await fetch('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/records', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.API_TOKEN}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "key_tag": 12345,
    "algorithm": 13,
    "digest_type": 2,
    "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766"
  }),
});

console.log(await response.json());

Response

201

{
  "data": {
    "supported": true,
    "record_type": "ds",
    "operations": [
      "add",
      "remove",
      "disable"
    ],
    "algorithms": [
      8,
      13,
      15
    ],
    "digest_types": [
      2,
      4
    ],
    "records": [
      {
        "key_tag": 12345,
        "flags": 257,
        "protocol": 3,
        "algorithm": 13,
        "digest_type": 2,
        "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766",
        "public_key": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="
      }
    ],
    "active": true,
    "pending": false,
    "pending_message": null,
    "blocked_reason": null
  }
}

Error responses share one format: see Errors.

Remove a DNSSEC record #

DELETE /client/domains/{domain}/dnssec/records

Offered when remove is in operations. Name the record as it appears in records: all four fields for ds ({"key_tag": 12345, "algorithm": 13, "digest_type": 2, "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766"}), the public_key alone for dnskey ({"public_key": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="}). Answers with the refreshed state.

Authentication: bearer Token
Requires permission managedomains
Rate limit: 20 req/min per user

Parameters

Path

domain integer required

The domain ID

Query

key_tag integer
- Minimum 0
- Maximum 65535
algorithm integer
digest_type integer
digest string
- Pattern ^[A-Fa-f0-9]+$
- Max length 128
public_key string
- Max length 4096

Responses

200

The domain’s DNSSEC state after the change.
Response body application/json
- data object
  10 properties
  - supported boolean
    
    true when DNSSEC can be managed for this domain through this API. false is not an error: DNSSEC is not offered for this domain here, the other fields are then empty and every other DNSSEC call answers dnssec_not_supported.
  - record_type string | null
    
    The record form this domain takes; null when not supported. ds: the hash of your key, as your DNS provider shows it (key_tag, algorithm, digest_type, digest). dnskey: the key itself (flags, protocol, algorithm, public_key). Send records in this form only: the other one is refused with invalid_request.
    
    Allowed values ds dnskey
  - operations array of string
    
    The calls available on this domain right now. add: POST …/dnssec/records. remove: DELETE …/dnssec/records. disable: DELETE …/dnssec (removes every record: DNSSEC off). enable: POST …/dnssec/enable, listed only where the zone is signed for you (typically a domain using our DNS service), which then takes no record. Empty when not supported, when the domain is not active (see blocked_reason), and it can be empty while a change is still being applied (pending: true).
    
    Allowed values add remove disable enable
  - algorithms array of integer
    
    The algorithm numbers (IANA) this domain accepts in algorithm, as plain integers: 5 RSA/SHA-1, 7 RSASHA1-NSEC3-SHA1, 8 RSA/SHA-256, 10 RSA/SHA-512, 13 ECDSA P-256/SHA-256, 14 ECDSA P-384/SHA-384, 15 Ed25519, 16 Ed448. Often a subset of these. Empty when not supported.
    
    Allowed values 5 7 8 10 13 14 15 16
  - digest_types array of integer
    
    ds domains only (absent for dnskey): the digest type numbers accepted in digest_type, as plain integers: 1 SHA-1, 2 SHA-256, 4 SHA-384.
    
    Allowed values 1 2 4
  - records array of object | null
    
    The DNSSEC records on file for the domain, each with the fields of the domain’s record_type only. Empty when there is none, and on a zone signed for you, which lists no record (see active). null when a change was accepted but the records could not be read back right after it (read the state again), and when the domain is not held at the registry: a domain that is not registered yet, or no longer ours (blocked_reason is then set). A domain in grace, redemption or transferring away is still read.
    
    7 properties
    
    key_tag integer
    
    ds only: the key tag, 0-65535.
    
    flags integer
    
    dnskey only: 257 (KSK, the usual one) or 256 (ZSK).
    
    protocol integer
    
    dnskey only: always 3.
    
    algorithm integer
    
    Both forms: the DNSSEC algorithm number (IANA), one of the domain’s algorithms.
    
    digest_type integer
    
    ds only: the digest type, one of the domain’s digest_types.
    
    digest string
    
    ds only: the digest, hexadecimal, upper case.
    
    public_key string
    
    dnskey only: the public key, Base64, without whitespace.
  - active boolean | null
    
    Whether DNSSEC is on for the domain. Usually the same as records not being empty; it also covers a zone signed for you (which lists no record) and DS records set outside this API. null when not supported, or when records is null.
  - pending boolean
    
    true when a change was accepted but is not applied yet: records and active still show the situation before it. Poll GET …/dnssec until it is false; no need to send the change again.
  - pending_message string | null
    
    A short customer-readable note about the pending change, when there is one; otherwise null.
  - blocked_reason object | null
    
    Why no change can be made right now, or null when changes are possible. Set when the domain’s status is not active: DNSSEC is changed only on an active domain, like the nameservers and the contacts. operations is then empty and every change answers 403 domain_not_active.
    
    2 properties
    
    code string
    
    The code a change would be refused with.
    
    Allowed values domain_not_active
    
    message string
    
    The reason, readable by a customer.

401 unauthenticated ApiError
403 client_token_required token_not_api_enabled token_not_client_scoped client_access_revoked client_cancelled ip_not_allowed ip_whitelist_misconfigured forbidden domain_not_active ApiError
404 client_not_found not_found ApiError
409 dnssec_conflict ApiError
422 dnssec_not_supported dnssec_operation_not_supported dnssec_record_not_found dnssec_refused invalid_request unprocessable ApiError
429 rate_limited ApiError
502 upstream_error ApiError

cURL

curl -X DELETE 'https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/records' \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json'

PHP

<?php

$ch = curl_init('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/records');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('API_TOKEN'),
        'Accept: application/json',
    ],
]);

$body   = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

if ($status >= 400) {
    // Error envelope: {"error": {"code": "...", "message": "...", "fields": {...}}}
    echo $status . ' ' . ($body['error']['code'] ?? '') . ': ' . ($body['error']['message'] ?? '') . "\n";
} else {
    print_r($body);
}

Node.js

const response = await fetch('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/records', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.API_TOKEN}`,
    Accept: 'application/json',
  },
});

console.log(await response.json());

Response

200

{
  "data": {
    "supported": true,
    "record_type": "ds",
    "operations": [
      "add",
      "remove",
      "disable"
    ],
    "algorithms": [
      8,
      13,
      15
    ],
    "digest_types": [
      2,
      4
    ],
    "records": [
      {
        "key_tag": 12345,
        "flags": 257,
        "protocol": 3,
        "algorithm": 13,
        "digest_type": 2,
        "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766",
        "public_key": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="
      }
    ],
    "active": true,
    "pending": false,
    "pending_message": null,
    "blocked_reason": null
  }
}

Error responses share one format: see Errors.

Switch DNSSEC on #

POST /client/domains/{domain}/dnssec/enable

For a domain whose zone is signed for you (typically one using our DNS service): enable is then in operations, and no record is needed. On any other domain DNSSEC is turned on by adding records, and this call answers dnssec_operation_not_supported. Answers with the refreshed state.

Authentication: bearer Token
Requires permission managedomains
Rate limit: 20 req/min per user

Parameters

Path

domain integer required

The domain ID

Responses

200

The domain’s DNSSEC state after the change.
Response body application/json
- data object
  10 properties
  - supported boolean
    
    true when DNSSEC can be managed for this domain through this API. false is not an error: DNSSEC is not offered for this domain here, the other fields are then empty and every other DNSSEC call answers dnssec_not_supported.
  - record_type string | null
    
    The record form this domain takes; null when not supported. ds: the hash of your key, as your DNS provider shows it (key_tag, algorithm, digest_type, digest). dnskey: the key itself (flags, protocol, algorithm, public_key). Send records in this form only: the other one is refused with invalid_request.
    
    Allowed values ds dnskey
  - operations array of string
    
    The calls available on this domain right now. add: POST …/dnssec/records. remove: DELETE …/dnssec/records. disable: DELETE …/dnssec (removes every record: DNSSEC off). enable: POST …/dnssec/enable, listed only where the zone is signed for you (typically a domain using our DNS service), which then takes no record. Empty when not supported, when the domain is not active (see blocked_reason), and it can be empty while a change is still being applied (pending: true).
    
    Allowed values add remove disable enable
  - algorithms array of integer
    
    The algorithm numbers (IANA) this domain accepts in algorithm, as plain integers: 5 RSA/SHA-1, 7 RSASHA1-NSEC3-SHA1, 8 RSA/SHA-256, 10 RSA/SHA-512, 13 ECDSA P-256/SHA-256, 14 ECDSA P-384/SHA-384, 15 Ed25519, 16 Ed448. Often a subset of these. Empty when not supported.
    
    Allowed values 5 7 8 10 13 14 15 16
  - digest_types array of integer
    
    ds domains only (absent for dnskey): the digest type numbers accepted in digest_type, as plain integers: 1 SHA-1, 2 SHA-256, 4 SHA-384.
    
    Allowed values 1 2 4
  - records array of object | null
    
    The DNSSEC records on file for the domain, each with the fields of the domain’s record_type only. Empty when there is none, and on a zone signed for you, which lists no record (see active). null when a change was accepted but the records could not be read back right after it (read the state again), and when the domain is not held at the registry: a domain that is not registered yet, or no longer ours (blocked_reason is then set). A domain in grace, redemption or transferring away is still read.
    
    7 properties
    
    key_tag integer
    
    ds only: the key tag, 0-65535.
    
    flags integer
    
    dnskey only: 257 (KSK, the usual one) or 256 (ZSK).
    
    protocol integer
    
    dnskey only: always 3.
    
    algorithm integer
    
    Both forms: the DNSSEC algorithm number (IANA), one of the domain’s algorithms.
    
    digest_type integer
    
    ds only: the digest type, one of the domain’s digest_types.
    
    digest string
    
    ds only: the digest, hexadecimal, upper case.
    
    public_key string
    
    dnskey only: the public key, Base64, without whitespace.
  - active boolean | null
    
    Whether DNSSEC is on for the domain. Usually the same as records not being empty; it also covers a zone signed for you (which lists no record) and DS records set outside this API. null when not supported, or when records is null.
  - pending boolean
    
    true when a change was accepted but is not applied yet: records and active still show the situation before it. Poll GET …/dnssec until it is false; no need to send the change again.
  - pending_message string | null
    
    A short customer-readable note about the pending change, when there is one; otherwise null.
  - blocked_reason object | null
    
    Why no change can be made right now, or null when changes are possible. Set when the domain’s status is not active: DNSSEC is changed only on an active domain, like the nameservers and the contacts. operations is then empty and every change answers 403 domain_not_active.
    
    2 properties
    
    code string
    
    The code a change would be refused with.
    
    Allowed values domain_not_active
    
    message string
    
    The reason, readable by a customer.

401 unauthenticated ApiError
403 client_token_required token_not_api_enabled token_not_client_scoped client_access_revoked client_cancelled ip_not_allowed ip_whitelist_misconfigured forbidden domain_not_active ApiError
404 client_not_found not_found ApiError
409 dnssec_conflict ApiError
422 dnssec_not_supported dnssec_operation_not_supported dnssec_refused ApiError
429 rate_limited ApiError
502 upstream_error ApiError

cURL

curl -X POST 'https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/enable' \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json'

PHP

<?php

$ch = curl_init('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/enable');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('API_TOKEN'),
        'Accept: application/json',
    ],
]);

$body   = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

if ($status >= 400) {
    // Error envelope: {"error": {"code": "...", "message": "...", "fields": {...}}}
    echo $status . ' ' . ($body['error']['code'] ?? '') . ': ' . ($body['error']['message'] ?? '') . "\n";
} else {
    print_r($body);
}

Node.js

const response = await fetch('https://portal.supporthost.com/api/v1/client/domains/{domain}/dnssec/enable', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.API_TOKEN}`,
    Accept: 'application/json',
  },
});

console.log(await response.json());

Response

200

{
  "data": {
    "supported": true,
    "record_type": "ds",
    "operations": [
      "add",
      "remove",
      "disable"
    ],
    "algorithms": [
      8,
      13,
      15
    ],
    "digest_types": [
      2,
      4
    ],
    "records": [
      {
        "key_tag": 12345,
        "flags": 257,
        "protocol": 3,
        "algorithm": 13,
        "digest_type": 2,
        "digest": "E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766",
        "public_key": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="
      }
    ],
    "active": true,
    "pending": false,
    "pending_message": null,
    "blocked_reason": null
  }
}

Error responses share one format: see Errors.

Get the DNSSEC state of a domain #

Parameters

Path

Responses

Disable DNSSEC #

Parameters

Path

Responses

Add a DNSSEC record #

Parameters

Path

Body `application/json` required

Responses

Remove a DNSSEC record #

Parameters

Path

Query

Responses

Switch DNSSEC on #

Parameters

Path

Responses

Hosting

Resources

Company

Clients

Get the DNSSEC state of a domain #

Parameters

Path

Responses

Disable DNSSEC #

Parameters

Path

Responses

Add a DNSSEC record #

Parameters

Path

Body application/json required

Responses

Remove a DNSSEC record #

Parameters

Path

Query

Responses

Switch DNSSEC on #

Parameters

Path

Responses

Hosting

Resources

Company

Clients

Body `application/json` required