DigiCert DNS API

DigiCert® DNS API lets you automate domain and DNS infrastructure management. Use it to manage primary and secondary domains, primary-domain records, reusable DNS settings, access controls, and reporting workflows from CI/CD pipelines and infrastructure automation systems.

What you can do

• Manage domains: Create, retrieve, update, and delete primary and secondary domains, and provision or delete them in bulk.
• Manage DNS records: Perform full CRUD operations on supported primary-domain records and retrieve records transferred to secondary domains.
• Configure advanced DNS: Configure Global Traffic Director (GTD)-based routing, SOA records, TSIG keys, IP sets, and nameserver sets.
• Control access: Manage API keys, user and group assignments, roles, permissions, and resource groups.
• Monitor and report: Check domain health, query activity logs, and track usage, quotas, and accounting statistics.

Authentication

The DigiCert DNS API uses a two-step authentication flow. Exchange an API key for a JSON Web Token (JWT), then send that token as a bearer token with each request to the manager API.

1. Generate an API key from the DigiCert DNS manager. API keys use the format <prefix_identifier>.<secretkey>.
2. Send the API key to the authentication service’s /auth/login endpoint to receive a JWT access token.

curl -X POST https://authentication.digicertdns.com/v1/auth/login \
  -H "Authorization: Bearer <prefix_identifier>.<secretkey>"

Include the returned access_token in the Authorization header of all other requests:

curl -X GET https://manager.digicertdns.com/v1/domains/primary \
  -H "Authorization: Bearer <access_token>"

Base URLs

The API uses separate production hosts for authentication and resource operations.

Append the endpoint path to the appropriate base URL. For example, use https://manager.digicertdns.com/v1/domains/primary to list primary domains.

Primary and secondary domains

DigiCert DNS manages two types of domains. The type determines the source of the zone data and how records are updated.

IP sets define zone-transfer and notification addresses. Primary IP sets use transferTo and notifyTo addresses for external secondary servers. Secondary IP sets use transferFrom and notifyFrom addresses for external primary servers. You can optionally associate a TSIG key with an IP set to authenticate zone transfers.

DNS record types

Primary domains support full create, read, update, and delete operations for the following record types.

Use POST /domains/primary/{domainId}/records/bulk/delete to delete selected records from a primary domain in a single request. To delete all records, use DELETE /domains/primary/{domainId}/records with the required confirmDeleteAll query parameter.

Advanced DNS features

• GTD locations: Enable GTD on primary domains, associate records with geographic locations, and retrieve available GTD locations.
• SOA records: Manage authoritative-zone settings, including the primary nameserver, serial, refresh, retry, expire, TTL, and negative-cache values.
• TSIG keys: Create, retrieve, update, and delete shared keys used to authenticate zone transfers.
• IP sets: Manage reusable transfer and notification address lists for primary and secondary domains.
• Nameservers: List available nameservers and retrieve their details.
• Nameserver sets: Create and reuse nameserver sets to apply consistent delegation to primary domains.

Access management

DigiCert DNS provides role-based access controls for users, service API keys, and DNS resources.

• API keys: Generate, retrieve, update, rotate, disable, and delete user or service API keys.
• Users: Retrieve user details and effective resource groups, and bulk-update role and user-group assignments.
• User groups: Organize users and service API keys and manage group membership.
• User roles: Define permissions and assign roles directly to users or when associating user groups with resource groups.
• Resource groups: Group resources and associate user groups with roles to scope access.

Monitoring and reporting

• Health: Check the health of primary and secondary domains, including nameserver, AXFR, and zone-transfer status.
• Activity log: Retrieve a log of account activity for auditing and troubleshooting.
• Usage statistics: Track daily and monthly usage for individual domains or across all domains.
• Accounting: Return current quotas, limits, and overall usage for the account.
• Reporting: Retrieve reports for top domains and API key counts.

Important considerations

• Reuse access tokens. Cache each token for reuse during its one-hour lifetime rather than calling /auth/login before every request.
• Secondary domains depend on the external primary. Records for secondary domains are not editable through the API. They reflect whatever transfers in from the external primary nameserver.
• Use IP sets for zone transfers. Configure transfer and notification addresses for the appropriate direction. Associate a TSIG key when you want to authenticate transfers.
• Use bulk endpoints for scale. Provision or delete multiple domains and delete selected records in a single request instead of iterating one at a time.

Common operations