Questions
Getting started
What does a hostname actually look like?
A subdomain you choose, on a domain we register for you: api.a3f9c1-d4e7b8.dev, for example. Every domain we hand out has that shape, on a paid plan typically .com, .net or .dev, and on Starter .top, .lol or .site. The subdomain is yours to pick - 3 to 63 characters, lowercase letters, digits and hyphens - or omit it and we mint an opaque one.
Can I choose the domain, or use one I already own?
You choose the subdomain. The domain and its TLD are ours: we register them, sign them, publish the DS and defend their reputation, and that is only possible because we hold the registration. Bringing your own domain is not supported. Taking one of ours with you is: see "Do I own the dedicated domain?" below for when and how. What you get instead is a dedicated domain, so your certificate limits, cookie origin and reputation are yours alone.
How fast is a new hostname usable?
Seconds for DNS, about a minute for HTTPS. The API reports the record as live once the nameservers holding its zone answer for it, and the certificate authority usually finishes right after.
What happens when my server's IP changes?
Send one PUT with the new address. The hostname and its certificate carry over untouched, so everything pointing at the hostname keeps working.
Certificates
Which certificate authorities work?
Any ACME certificate authority, when you run the client. Our domains name Let's Encrypt and Google Trust Services in a CAA record, so those two work straight away; for ZeroSSL, Buypass or anything else, publish a CAA record on your hostname naming it and that applies instead of ours. Either way your private key never leaves your server. With managed certificates we run the client for you, against Let's Encrypt or Google Trust Services as you choose - you get the certificate and its key, and we keep a copy so you can fetch the current pair any time without us pushing anything at you. Every renewal generates a fresh keypair, so a managed key is never years old.
Do I need to run an ACME client?
Only if you want to. Point Caddy, certbot or anything else at the hostname and it gets a certificate itself - that is the default, and your key stays with you. Or register the hostname with certificate: "managed" and we run ACME instead: we get the certificate, renew it before it expires, and you fetch it with one GET. Nothing is pushed to you, and there is no renewal logic on your side.
Can machines inside a private network get certificates?
Yes, on every plan. Register the private IP and use the DNS-01 API; it publishes the validation record that public CAs check. The certificate is issued for the hostname, not the address, which is why a hostname pointing at a private IP can have a publicly trusted cert.
Scope and limits
What is my exit strategy?
Most of the domains we provide are meant to be thrown away, and that is the design rather than a shortcoming: an opaque name on a domain that rotates suits an agent's endpoint, a preview, or a device that will not outlive it. If you are on a branded domain with us, or you want to take one of ours with you, we will work with you on the transfer - we hold these at standard registrars and there is nothing proprietary to unpick. And while you are with us you are not routing through us. The nameservers that answer for your names are a separate system from the website and the API, on separate machines and a separate network: creating a hostname goes through our API, answering for one never does.
Who sees my traffic?
You and your users. DNSMint's role ends at the DNS answer; connections run directly to your server, on your bandwidth, and nothing routes through us to inspect. That does not change with managed certificates: we keep a copy of the key so you can fetch it, and there is still no traffic here to read.
Why does Starter need a card?
Because a domain is a real registration we pay for, and Starter gives you one of your own. Nobody shares a domain here, on any plan. What Starter costs, and the free period before it, are on the pricing page; the card is taken up front because it tells us who holds the domain, which is what keeps a registration from being free to anyone who wants one for an afternoon.
Can I mint hostnames for my own customers?
Yes. You hold several dedicated domains and mint hostnames beneath them through the same API, and you choose which customer sits on which domain. Each sits on a dedicated domain, so their reputation and their certificate budget are separate from every other account.
How long do hostnames last?
Until you release it. Releasing stops DNS and revokes any certificate we hold, and you can mint the same hostname again afterwards. The one thing with a clock on it is the Starter domain: it is registered for a year and not renewed. Before it lapses we ask whether to hand you a replacement, which is a different name, or move you to a plan that renews the one you have; hostnames do not move between two domains either way.
What can an API key do, and can I limit it?
A key carries an explicit list of what it may do, and each of those names what it may reach: the whole team, one domain, or a single hostname. So a key that only publishes certificate challenges cannot repoint or release anything, and a key given to one machine reaches only that machine's name. A key can also be given a lifetime, and can be allowed to create and revoke keys so a fleet rotates its own credentials without a person. The secret is shown once at creation, revocation takes effect on the next request, and your activity log names the key behind each action. The security page has the detail.
Do I own the dedicated domain? Can I transfer it out?
We stay the registrant on every domain we operate, and a dedicated domain is exclusively yours to use. That is the trade that removes the registrar account, the renewals, the ICANN verification step, and the human with a card from the path between an API call and a working hostname. Once a domain has been allocated to your account for 6 months, with the account open and on an active subscription, you can transfer it out to a registrar of your own. Send a note to hello@dnsmint.com from the same email as your account. We remove DNSSEC first and wait 48 hours before sending you the authorization code, because a domain whose DS record is still published at the registry stops validating the moment its nameservers move; DNS keeps resolving throughout, and the domain counts against your plan until the transfer completes. Transferring out ends every key we hold for it: the DNSSEC signing key, any managed certificates, DNS-01 grants scoped to that domain, and acme-dns credentials under it. Certificate renewal stops when those grants go, which is before your new operator is answering, so plan the cutover rather than meet it. You cover any transfer fee our registrar charges us, which is usually nothing.
What happens to my hostnames if I cancel?
Your plan runs to the end of the period you paid for. When it ends we release the hostnames and revoke any certificates we hold, so they stop resolving then, and the domain is not renewed. The hostnames live on a domain we hold, so cancelling does not carry them anywhere by itself. If you want to keep the domain, ask us before you cancel and we will work with you on transferring it. If continuity past cancellation matters, run the names that must outlive the account on a domain you own yourself, and use DNSMint for the ones that are meant to be disposable.
Something else on your mind? Write to hello@dnsmint.com.