Give every customer a dedicated domain.

Put your customers' agents on a dedicated domain without building domain registration, DNS, hostname allocation or lifecycle infrastructure yourself.

Talk to us API reference

$ curl -X POST https://dnsmint.com/api/v1/hostnames \
    -H "Authorization: Bearer $DNSMINT_KEY" \
    -d '{
      "domain": "dnsmint-a3f9c1.dev",
      "ip": "203.0.113.42"
    }'

{
  "hostname": "agent-001.dnsmint-a3f9c1.dev",
  "status": "pending"
}

Why a domain per customer

The registrable domain is the unit most things are counted against, so a shared domain shares its limits.

Certificate authorities rate-limit per registered domain, and on a shared domain one busy tenant spends the whole allowance.
Browsers scope cookies per registrable domain, so a cookie set on one tenant's hostname is sent to the others.
Blocklists apply per domain. One bad tenant takes every hostname beside it down.
Agents on private or internal addresses need DNS-01 to get a publicly trusted certificate; HTTP-01 cannot reach them.
Hostnames appear and disappear as agents are created and destroyed.

One call per hostname

Register the address the agent is reachable at. The hostname comes back in the same response; it reads pending until the nameservers confirm it, then live. Pass domain to place it on one of your domains, or leave it out and we pick.

POST /v1/hostnames

{
  "domain": "dnsmint-a3f9c1.dev",
  "ip": "203.0.113.42"
}

→ 201

{
  "id": "68ad3a1e9c4b2f0d5e6a7b8c",
  "hostname": "agent-7f39.dnsmint-a3f9c1.dev",
  "status": "pending"
}

Three ways to place customers

One domain for your platform

agent-7f39.dnsmint-a3f9c1.dev

Every agent gets a hostname under one domain your account holds. The simplest integration.

A domain per customer

agent-7f39.dnsmint-c40b82.dev

Each customer sits on a dedicated domain, including against your other tenants. Same call; you pass that customer's domain. How many domains you hold is a plan limit.

Your customer mints their own

their-agent.dnsmint-c40b82.dev

Give the customer an API key scoped to their domain. They create and retire their own hostnames without going through you, and we stay authoritative for the whole domain, so you keep visibility over what is published.

We are the registrant of every domain, and the name is one we choose rather than one anybody picks. Moving a customer from one of these three to another changes which domain their hostnames sit on; the API call is the same in all three.

What the API covers

Minting

Create and release hostnames through the API as agents come and go.

Dedicated domains

Put a customer on a dedicated domain, without touching a registrar. We register, renew, delegate and defend it.

TLS-ready

The ACME challenge is published on our side, from an API key you can narrow to one hostname. Caddy, certbot, lego, Traefik and cert-manager each need nothing else, and the API also speaks acme-dns for anything that expects it.

IPv4 and IPv6

Private targets

Agents on private or internal addresses still get publicly trusted certificates, because DNS-01 never requires the certificate authority to reach the machine.

An email address for every agent

Publish MX under an agent's hostname and mail to it reaches a mail server you run or rent, with SPF and DKIM as TXT beside it. Every agent can send and receive as itself, at a name on the domain its customer already has, rather than sharing one mailbox behind a plus sign.

Service records

SRV for anything not on 443, CAA to pin which authority may issue for the name, SSHFP for a host key a client can check before it connects, and HTTPS or SVCB to advertise HTTP/3.

API-first

A four-endpoint hostname lifecycle, an OpenAPI 3.1 description, and a plain-text reference written to be read by a machine.

Scoped keys

A key names what it may touch: the whole account, one domain, or one hostname. Give an agent a key for its customer's domain and that is the edge of its reach.

MCP endpoint

An MCP server at dnsmint.com/mcp, so an agent can mint and repoint its own hostname mid-task. It takes an API key, or an OAuth authorization for a connector that can only be given a URL.

White-label

We answer DNS and nothing else. No branding in a DNS response, no redirect, no page your customer lands on. Domains are registered as dnsmint-{hex:6}.{tld}, and we can set a different label shape on your account: write to us. The TLD comes from the pool your plan buys from.

Integrations →

Pricing

A customer's agent getting busy does not move your bill. You pay for what you hold, so a tenant serving a million requests costs what a tenant serving none does, and neither is metered. See the plans, or write to us if your fleet needs more than the published limits allow.

What you run and what we run

Who carries it	Build it yourself	A DNS provider	DNSMint
Buying and renewing the domains	You	You	Us
Running authoritative DNS	You	Them	Us
Certificates, and renewing them	You	You	Us or you
Provisioning and hostname lifecycle	You	You	Us
The product your customers use	You	You	You

A managed DNS provider hosts a zone well, but the zone has to be a domain you already own and the product layer is yours to build. See the comparison.

Get started

Try the API on Starter, or talk to us about a fleet.

Talk to us API reference