# DNSMint

> Your agent mints its own HTTPS endpoint, on its own dedicated domain. One API call: no registrar, no zone to configure, no person in the loop.

DNSMint registers a hostname on a domain we operate and serves it authoritatively - from our own nameservers on Starter, from Google Cloud DNS or Amazon Route 53 on Standard. The hostname does not encode the IP, so it survives the address changing. We answer DNS and nothing else: no traffic is proxied, terminated, or inspected. Certificates come from Let's Encrypt or Google Trust Services through any ACME client (or any other CA, by publishing a CAA record on the hostname), and a per-hostname DNS-01 API covers wildcards and machines on private networks. Or DNSMint runs ACME for you, holds the certificate, renews it, and hands it back over the API.

## Docs

- [Quickstart](https://dnsmint.com/quickstart): Create an API key, register an IP, point Caddy at the hostname, and PUT a new address when the server moves
- [API reference](https://dnsmint.com/api-reference): Hostname and record endpoints with curl examples, response shapes, and error codes
- [Nameservers](https://dnsmint.com/nameservers): What answers for a hostname, where a zone is served from, and what happens to your names when our API is down
- [Standards](https://dnsmint.com/standards): Every RFC we implement, what we are evaluating, what we deliberately do not do, and what is built on top of us
- [Certificate authorities](https://dnsmint.com/ca): Which CAs work with DNSMint, which CAs our CAA record names and how to override it per hostname, External Account Binding, and selecting a CA for managed certificates
- [OpenAPI spec](https://dnsmint.com/openapi.json): Machine-readable OpenAPI 3.1 description of the hostname and record API
- [Features](https://dnsmint.com/features): Every capability in detail. Nothing is feature-gated; plans differ in how many domains and hostnames you hold
- [Pricing](https://dnsmint.com/pricing): Starter with 5 hostnames, or build a paid plan from the number of domains and hostnames you need
- [Use cases](https://dnsmint.com/use-cases): DNS-01 for wildcards and private networks, agent-spawned compute, MCP servers, A2A agents serving an Agent Card, platforms minting across several domains they hold, and edge fleets
- [Agent-spawned compute](https://dnsmint.com/use-cases/agent-compute): The order the calls go in when an agent provisions a machine mid-task, and what happens when the machine is replaced or the task ends
- [MCP servers](https://dnsmint.com/use-cases/mcp-servers): A remote MCP server is an HTTPS endpoint a client keeps, so the hostname is configuration in a file you do not control
- [A2A agents](https://dnsmint.com/use-cases/a2a-agents): Serving an Agent Card over HTTPS on a name that can be repointed without invalidating a card a caller has already cached
- [For agent platforms](https://dnsmint.com/agent-builders): Domain and DNS infrastructure behind a platform's own custom-domain feature
- [Questions](https://dnsmint.com/questions): Common questions about certificates, IP changes, traffic, and name lifetime
- [Security](https://dnsmint.com/security): What an API key can be scoped to, who holds certificate key material, what we never see, and what we deliberately do not do
- [Status](https://dnsmint.com/status): Live nameserver status, with resolution history over the last 30 and 90 days
- [Fair use](https://dnsmint.com/fair-use): What unlimited means, the hard limits, and the enforcement ladder
- [Changelog](https://dnsmint.com/changelog): What has shipped, by date
- [Full reference for LLMs](https://dnsmint.com/llms-full.txt): The complete product and API reference in one plain-text file

## Integrations

- [All integrations](https://dnsmint.com/integrations): Every client, proxy, platform and protocol with a verified recipe, grouped by what the thing is
- [Caddy](https://dnsmint.com/integrations/caddy): Our module takes an API key and nothing else. No credential to mint, and no file for Caddy to read.
- [acme.sh](https://dnsmint.com/integrations/acme-sh): The dns_dnsmint plugin takes the key, and saves it after the first run so renewals need no environment.
- [lego](https://dnsmint.com/integrations/lego): lego's built-in httpreq provider, with the key as the basic-auth password. Nothing to pre-seed.
- [Traefik](https://dnsmint.com/integrations/traefik): Traefik embeds lego, so it is the same three environment variables and a resolver name.
- [Coolify, Dokploy and Dokku](https://dnsmint.com/integrations/coolify-dokploy-dokku): None of the three has a DNS provider of its own, and all three arrive at lego's list. The only way to answer DNS-01 behind NAT.
- [certbot](https://dnsmint.com/integrations/certbot): No plugin. certbot hands the challenge to two hook scripts of yours, which is all our endpoints want.
- [Posh-ACME](https://dnsmint.com/integrations/posh-acme): The PowerShell client, and the way to do this on Windows Server.
- [cert-manager](https://dnsmint.com/integrations/cert-manager): A webhook solver that runs in your cluster and reads one API key from a Secret.
- [The acme-dns route](https://dnsmint.com/integrations/acme-dns): No recipe needs it any more, but the DNS-01 API speaks acme-dns for a client that expects it.
- [Kubernetes](https://dnsmint.com/integrations/kubernetes): An external-dns provider, for the half of a cluster's DNS that is not certificates.
- [Terraform and OpenTofu](https://dnsmint.com/integrations/terraform): A hostname is worth most at the moment the machine is created, and machines are created in Terraform.
- [MCP](https://dnsmint.com/integrations/mcp): An endpoint rather than a package, for an agent that asks for the hostname itself, mid-task.

## Comparisons

- [All comparisons](https://dnsmint.com/vs): Every class of alternative on one page, with how DNSMint differs from each
- [Magic DNS](https://dnsmint.com/vs/sslip-io): nip.io and sslip.io derive the hostname from the address, so the name changes when the machine does, and an IP certificate lasts six days and cannot be issued over DNS-01
- [Dynamic DNS](https://dnsmint.com/vs/duckdns): DuckDNS and No-IP give a person a few subdomains claimed by hand out of a fixed allowance, on one registrable domain everybody shares
- [Programmable DNS and DIY](https://dnsmint.com/vs/dns-api): DNSimple, deSEC, Route53 and Cloudflare price and rate-limit per zone, and a zone is a domain somebody had to buy and delegate first
- [A private CA you ship](https://dnsmint.com/vs/private-ca): Generating a root and asking the customer to install it on every device they browse from, what that costs per operating system, and what it cannot reach
- [Tunnels](https://dnsmint.com/vs/tunnels): ngrok and Cloudflare Tunnel carry traffic to a machine the internet cannot reach; DNSMint answers DNS and never touches it

## Legal

- [Terms](https://dnsmint.com/terms): Acceptable use, plan changes, domain and subdomain lifecycle
- [Privacy](https://dnsmint.com/privacy): What we log, what we never hold, and how long we keep it
- [Data processing agreement](https://dnsmint.com/dpa): The Article 28 terms under which DNSMint processes personal data for a customer
- [About](https://dnsmint.com/about): Why DNSMint exists, who runs it, and what we hold on your behalf