Register an IP and mint a hostname

An IPv4 or IPv6 address, public or private. Private and reserved ranges are accepted on every plan. Send either ip or target, not both. The address a hostname is minted with fixes its address class for life. A hostname keeps the address class it was minted with. Repointing within a class is free, including between A and AAAA; crossing from public to private or private to public returns 409. This blocks DNS rebinding, where one origin is public first, to deliver a payload under a trusted certificate, and private second, to read a response from inside the visitor's network. Release the hostname and mint a new one for the other class.

A platform endpoint to follow instead of an address, for a platform that gives you a URL and no IP. We resolve it and publish ordinary A or AAAA records, then re-resolve within the target's TTL and follow it as it moves. Send either ip or target, not both. What the target answers fixes the hostname's address class exactly as an ip would, and a target that later answers outside that class is refused and the last address stays served. A target answering both public and private addresses is refused as ambiguous.

Optional custom subdomain, on every plan. 3-63 lowercase letters, digits, and hyphens; no periods; no leading or trailing hyphen. Duplicate or retired subdomains return 409.

Optional dedicated domain. Must already be assigned to the team. Omitted, one of the team's dedicated domains is chosen.

Who holds the private key, and with it who runs the ACME client. "self" means you do all of it: run an ACME client against the DNS-01 API, pick your own CA, and we never see key material. "csr" means you keep the key and we run the protocol: register, then POST a certificate request to /v1/hostnames/{id}/certificate. Renewal is yours there, because we hold no key to build a replacement from. "managed" means we generate the key, run ACME, and renew before expiry on a fresh key each time; you pull the current pair from GET /v1/hostnames/{id}/certificate. See Certificate modes.

Which certificate authority issues, for certificate: "managed" and certificate: "csr" - the modes where we run the ACME client. Sending it with "self" returns 400: you run the client there, so the CA is a choice you make in it. Omitted, we pick - Let's Encrypt unless it has recently rate-limited orders for your domain and another CA is configured. Renewals always return to the CA that issued, because the ACME Renewal Information identifier is only resolvable by that CA. See https://dnsmint.com/ca

Opaque identifier used in the /v1/hostnames/{id} paths.

The fully qualified hostname: an opaque subdomain on a domain assigned to your account.

pending: registered, not yet confirmed on the nameservers. live: the record is served, and it stays so until you release it. released: you released it; writes return 409 and the subdomain can be minted again as a new hostname. suspended: held while an abuse report is reviewed; it stops resolving and writes return 403, but nothing is lost if the report is not upheld. terminated: an abuse report was upheld, not reversible. New registrations may briefly return pending; poll GET until live.

Who holds the private key. self: you, and you run the ACME client. csr: you hold the key and we run the protocol around your signed request. managed: we generate the key, obtain and renew the certificate, and keep a copy for you to fetch.

When the hostname was registered.