Set the DNSSEC keys for a domain hosted elsewhere
Sends the DNSSEC keys your own DNS provider generated, so the registry can add the matching DS record. An empty list removes every key and, with it, every DS record the registry holds - the only way one is ever removed. Refused when this domain's DNS is hosted with us: turn signing on or off with PUT /v1/domains/{id}/dns instead, since we manage those keys.
apiKeyAuthorizationBearer <token>An API key from the Developers page. rhq_test_ keys reach the sandbox, rhq_live_ keys the live side.
id*stringapplication/json- body
keys*array<>Every key to send, up to 4. Empty removes every key
items <= 4Success
application/json- response
Success
id*stringdomain*stringstatus*stringpending: not yet finished at the registrar. pending_validation: registered and billed, held behind contact validation. active: registered and working. expired: past its expiry date, still renewable. redemption: past the renewal window, only a restore can save it. needs_reconciliation: the last registrar call is unknown. transferred_out: moved away to another registrar; no longer ours to renew or change. deleted: the registration was given up at the registrar and is no longer yours
"pending""pending_validation""active""expired""redemption""needs_reconciliation""transferred_out""deleted"customerId*|The customer this was bought for, if any
unitPrice*integerPrice per year, in minor units
0 <= valuecustomerPrice*|A unit price fixed for the customer on this item alone, in their list's currency. It beats their contract and list. Null when there is none
paidTotal*integerEverything charged for this domain so far, in minor units
0 <= valueregisteredAt*stringdate-timeexpiresAt*stringWhen the registration ends. While status is pending or needs_reconciliation this is only our estimate from the period ordered: the registrar's own date replaces it once the order finishes
date-timenameservers*array<>Where the domain's DNS is served from
customNameservers*booleanFalse while the domain is on the registrar's own nameservers
contact*|The registrant, or null until you set one
contacts*The administrative, technical and billing contacts. null means the same as the registrant
locked*booleanWhether transfers away from us are refused
suspended*booleanWhether the domain is on hold at the registrar: it does not resolve, but it is still registered and still renews
privacy*booleanWhether WHOIS privacy is on for this domain
privacyPrice*|What you pay per year for privacy while it is on, in minor units. Null when privacy is off
autoRenew*booleanWhether this domain renews itself from your wallet shortly before it expires
dns*Hosted DNS and DNSSEC for this domain. Every field is always there
actor*|Who placed this order
curl -X PUT "https://example.com/v1/domains/dom_01K6XJ4Q8ZT3M9R5V2B7WDHNCA/dnssec" \ -H "Content-Type: application/json" \ -d '{ "keys": [ { "flags": 256, "algorithm": 0, "publicKey": "string" } ] }'{ "id": "dom_01K6XJ4Q8ZT3M9R5V2B7WDHNCA", "domain": "northwind-telecom.com", "status": "pending", "customerId": "cus_01K6XJ4Q8ZT3M9R5V2B7WDHNCA", "unitPrice": 1440, "customerPrice": null, "paidTotal": 1440, "registeredAt": "2026-10-07T11:04:31.000Z", "expiresAt": "2027-10-07T11:04:31.000Z", "nameservers": [ "ns1.example-dns.com" ], "customNameservers": true, "contact": { "name": "Jo Bloggs", "organization": "Northwind Telecom", "email": "[email protected]", "phone": "+1 415 555 0132", "address": "1 Market Street", "city": "San Francisco", "state": "CA", "postalCode": "94105", "country": "US", "validation": "pending" }, "contacts": { "admin": null, "tech": null, "billing": null }, "locked": true, "suspended": true, "privacy": true, "privacyPrice": null, "autoRenew": true, "dns": { "supported": true, "hosted": true, "dnssecSupported": true, "signed": true, "dsRecords": [ { "keyTag": 0, "algorithm": 0, "digestType": 0, "digest": "49FCE7" } ], "keys": [ { "flags": 256, "algorithm": 0, "publicKey": "string" } ] }, "actor": { "kind": "user", "label": "string" }}Turn hosted DNS, or DNSSEC on a hosted zone, on or off PUT
Hosts this domain's DNS with us, or hands it back. Turning it on creates the zone at the registrar and points the domain at the registrar's DNS nameservers, keeping the ones it had so turning it off can put them back. Turning it off puts the domain on the nameservers you send, or the ones it had before hosting, or the registrar's own - and gives the zone up: the records stored here go with it, and so does any DNSSEC signing. Hosted DNS is included with the domain and costs nothing. Asking for the state it is already in changes nothing. `dnssec` signs or unsigns a zone already hosted with us: we manage the keys and any rollover, and only on or off is ever asked for. Give `hosted`, `dnssec`, or both.
List a zone's records GET
Every record in the zone we host for this domain, each with an id you can change or delete it by. Hosted DNS has to be on first.