Add a record under a hostname

Adds one TXT, TLSA, CAA, MX, SRV, SSHFP, HTTPS or SVCB record. Up to 10 records per hostname, on every plan - a ceiling against a hostname becoming a zone, since DNS egress follows hostnames. To change a value, PUT the record's id - one call, and the id survives. Deleting and re-adding costs two writes and leaves a window where the name resolves wrong. TTL is fixed at 300s. A TXT value longer than 255 bytes is split into several character-strings, which is what the wire format requires and what every client concatenates back.

TLSA returns 409 until the domain is signed and its DS is live. A TLSA record says which certificate to trust, and in an unsigned zone anything that can spoof the answer can substitute its own binding - so publishing one would point clients at a certificate nobody vouched for.

CAA replaces the domain's policy for that hostname rather than adding to it. A CA reads the nearest ancestor with a CAA record set and ignores the rest, so publishing one here takes over which CAs may issue for your name - including excluding ours. Delete it and the domain's policy applies again. That is how CAA works and we serve what you write; we do not merge it with ours.

A SRV record's name must be _<service>._<proto>, the way a TLSA record's must be _<port>._<proto> - RFC 2782 puts them in the owner name and a client only looks there.

post/v1/hostnames/{id}/records

Request

  • Base URL: https://dnsmint.com/api
  • URL: https://dnsmint.com/api/v1/hostnames/{id}/records
  • Auth: HTTP bearer

Path parameters

idstring required

Request body

type'TXT' | 'TLSA' | 'CAA' | 'MX' | 'SRV' | 'SSHFP' | 'HTTPS' | 'SVCB' required

A hostname's address is set by PUT on the hostname itself, and CAA is operator policy, so neither is accepted here.

namestring

Label under the hostname. Omit for a record on the hostname itself. _acme-challenge is reserved: certificate issuance publishes there. TLSA requires _<port>._<proto>, e.g. _443._tcp - RFC 6698 puts the port and protocol in the owner name and a client looks nowhere else.

usage0 | 1 | 2 | 3

TLSA certificate usage. 3 is DANE-EE.

selector0 | 1

TLSA selector. 0 full certificate, 1 SubjectPublicKeyInfo.

matching_type0 | 1 | 2

TLSA matching type. 0 full, 1 SHA-256, 2 SHA-512. The association length must match: 64 hex digits for SHA-256, 128 for SHA-512.

associationstring

TLSA certificate-association data, lowercase hex, no separators.

preferenceinteger

MX only. Lower is preferred. 0 with an exchange of . is the RFC 7505 null MX, which says this name accepts no mail.

exchangestring

MX only. The mail host. . is the root, for the null MX.

priorityinteger

SRV: lower is tried first. HTTPS and SVCB: 1 or above. 0 is AliasMode, which we do not serve, because it aliases a zone apex and a hostname is never an apex.

weightinteger

SRV only. Relative share among targets of equal priority.

portinteger

SRV only. The port the service listens on.

targetstring

SRV: the host offering the service, or . to say it is decidedly not offered here. HTTPS and SVCB: the endpoint, or . for this name, which is the ordinary case.

algorithminteger

SSHFP only. 1 RSA, 2 DSA, 3 ECDSA, 4 Ed25519, 6 Ed448.

fptypeinteger

SSHFP only. 1 for SHA-1, 2 for SHA-256. The fingerprint length follows from it.

fingerprintstring

SSHFP only. Lowercase hex, no separators. 40 digits for SHA-1, 64 for SHA-256.

paramsobject

HTTPS and SVCB only. RFC 9460 service parameters: alpn (list, e.g. h2 or h3), noDefaultAlpn (boolean, only meaningful with alpn), port, ipv4hint and ipv6hint (lists of literal addresses), ech (base64), and mandatory (the parameter names a client must understand, which may not name itself or a parameter this record does not set). Send them as fields; we emit them in the ascending key order the wire format requires.

Example request

{
  "name": "_443._tcp"
}

Response

Created

idstring

Pass this to DELETE.

namestring
type'TXT' | 'TLSA' | 'CAA' | 'MX' | 'SRV' | 'SSHFP' | 'HTTPS' | 'SVCB'
ttlinteger
dataobject

The record's fields: text for TXT; usage, selector, matching_type and association for TLSA.

Example response

{
  "name": "_443._tcp.q7k4m2ab.pool-1.dnsmint.com",
  "ttl": 300
}

Changes

No recorded changes to this operation across all 1 revision of this API.