deSEC DNS API

Name: deSEC DNS API API
Brand: deSEC DNS API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingbearer23 EndpointsREST

For Agents

Manage deSEC domains and DNSSEC-signed DNS record sets, plus issue and scope per-token RRset policies for automation.

Quickstart

Get started with deSEC DNS API in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"create a dns rrset on desec"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with deSEC DNS API API.

Create, list, retrieve, and delete domains via /domains/ endpoints

Bulk create, update, or patch RRsets across a zone with /domains/{name}/rrsets/

Edit a single RRset by name and type with full or partial updates

Export a domain's zonefile through /domains/{name}/zonefile/

Issue and revoke API tokens for account automation via /auth/tokens/

GET STARTED

Start building with deSEC DNS API API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for deSEC DNS API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for deSEC DNS API, keeping it validated and agent-ready. deSEC is a free, open-source, non-profit DNS hosting service that signs all zones with DNSSEC by default. The API exposes 23 endpoints covering domain management, DNS record sets, zonefile export, account tokens, and per-token RRset policies that scope what each token can change. Authentication uses Token-style Bearer auth, making it well suited for automation that needs least-privilege access to specific records.

Use Cases

Patterns agents use deSEC DNS API API for, with concrete tasks.

★ ACME DNS-01 Challenge Automation

Automate the DNS-01 challenge for Let's Encrypt by adding a TXT record to a deSEC zone, then removing it once issuance is complete. POST and DELETE on /domains/{name}/rrsets/{subname}/{type}/ are the two endpoints that drive this flow, and a token policy can restrict the automation to only the _acme-challenge subname.

POST a TXT RRset for _acme-challenge under the target domain, wait for issuance, then DELETE the same RRset.

DNSSEC-Signed Zone Management

Manage DNS records for a domain that needs DNSSEC by default by creating it via POST /domains/ and editing record sets via /domains/{name}/rrsets/. deSEC signs every zone automatically, so operators get DNSSEC without managing keys. Bulk PUT and PATCH operations are convenient for IaC-style updates.

PUT a list of RRsets to /domains/{name}/rrsets/ to bring a zone in line with the desired-state file.

Scoped Automation Tokens

Use deSEC's per-token RRset policies to grant CI pipelines or third-party tools the minimum DNS access they need. Issue a token via POST /auth/tokens/, attach a policy via /auth/tokens/{id}/policies/rrsets/, and the token can only modify the named subnames and types. Revoke at any time with DELETE.

POST a new token, then POST a policy to /auth/tokens/{id}/policies/rrsets/ that allows only TXT changes under the _acme-challenge subname.

Zonefile Export for Backups

Export the current zonefile for a domain via GET /domains/{name}/zonefile/ to back up DNS state outside deSEC or feed it into another DNS provider. The output is a standard zonefile suitable for diffing against version control.

Call GET /domains/{name}/zonefile/ for each managed domain and write the output to a versioned backup directory.

AI Agent Integration via Jentic

An infrastructure agent can use Jentic to handle DNS changes during deploys, such as cutting over a CNAME or rotating a TXT record. Jentic resolves the deSEC token from the vault and exposes typed schemas for /domains and /auth/tokens operations, so the agent can act without reading the deSEC documentation.

Use Jentic to search for 'create a desec dns rrset', load POST /domains/{name}/rrsets/, and execute it with the desired record.

Key Endpoints

23 endpoints — jentic publishes the only available openapi specification for desec dns api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/domains/

Create a new domain

GET

/domains/{name}/zonefile/

Export the zonefile for a domain

POST

/domains/{name}/rrsets/

Create an RRset in a zone

PUT

/domains/{name}/rrsets/

Bulk replace RRsets in a zone

PATCH

/domains/{name}/rrsets/{subname}/{type}/

Partially update a specific RRset

DELETE

/domains/{name}/rrsets/{subname}/{type}/

Delete a specific RRset

POST

/auth/tokens/

Create a new API token

POST

/auth/tokens/{id}/policies/rrsets/

Create an RRset policy for a token

POST

/domains/

Create a new domain

GET

/domains/{name}/zonefile/

Export the zonefile for a domain

POST

/domains/{name}/rrsets/

Create an RRset in a zone

PUT

/domains/{name}/rrsets/

Bulk replace RRsets in a zone

PATCH

/domains/{name}/rrsets/{subname}/{type}/

Partially update a specific RRset

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

deSEC API tokens are stored encrypted in the Jentic vault. Agents reference operations by name and Jentic injects the Authorization header at execution time, keeping tokens out of prompts and logs.

Intent-based discovery

Agents search by intent (e.g. 'create a dns txt record on desec') and Jentic returns the matching operation along with its full input schema, so the agent can act without reading the deSEC docs.

Time to first call

Direct deSEC integration: half a day to wire auth, RRset shapes, and per-token policies. Through Jentic: under 30 minutes to drive an end-to-end DNS-01 automation.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Cloudflare API

Commercial DNS plus full edge platform with DNSSEC support.

Choose Cloudflare when the workload also needs CDN, WAF, or workers in addition to DNSSEC-signed DNS.

Complementary

GoDaddy Domains API

Registrar API used to register domains that are then hosted on deSEC for DNS.

Use GoDaddy alongside deSEC when registration happens with GoDaddy and DNS hosting is delegated to deSEC name servers.

Complementary

DigitalOcean API

Cloud platform whose droplets and load balancers commonly need DNS records pointing at them.

Use DigitalOcean alongside deSEC when DNS records track DigitalOcean infrastructure addresses.

Complementary

Auth0 API

Identity provider that often requires DNS verification records to claim a custom domain.

Use Auth0 alongside deSEC when verifying or rotating Auth0 custom-domain records.

FAQs

Specific to using deSEC DNS API API through Jentic.

Why is there no official OpenAPI spec for deSEC DNS API?

deSEC does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call deSEC DNS API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the deSEC DNS API use?

The deSEC DNS API uses Token-style Bearer authentication: pass `Authorization: Token <token-value>` on every request. Through Jentic, tokens are stored encrypted in the vault and injected at execution time, so the secret never reaches the agent's context.

Can I add a TXT record with the deSEC DNS API?

Yes. POST /domains/{name}/rrsets/ creates an RRset of any type, including TXT. To delete it later, call DELETE /domains/{name}/rrsets/{subname}/{type}/ with the same subname and type.

How do I scope an API token to specific records?

Create the token with POST /auth/tokens/, then POST a policy to /auth/tokens/{id}/policies/rrsets/ that names the subnames and RRset types the token may modify. Tokens with policies fail any request that falls outside their allowed surface.

Does deSEC sign zones with DNSSEC automatically?

Yes. deSEC signs every hosted zone with DNSSEC by default, so any RRset created or modified through the API is delivered as part of a DNSSEC-signed response. There is no separate signing call to make.

How do I automate the ACME DNS-01 challenge through Jentic?

Run `pip install jentic`, search for 'create a desec dns rrset', execute POST /domains/{name}/rrsets/ to add the _acme-challenge TXT record, wait for issuance, then call DELETE /domains/{name}/rrsets/_acme-challenge/TXT/ to clean up. Jentic uses the stored token for both calls.