Programmable DNS and DIY

The step a program cannot take

A zone starts with a domain somebody bought and delegated. That is a purchase, a registrant, and a delegation that has to propagate, and none of it is a call your code can make on its own at three in the morning.

With DNSMint the domain is already ours and already delegated, so nothing has to exist before a hostname does.

Zone-shaped pricing against hostname-shaped work

Their unit is the zone, so a fleet spread over several domains is several zones to hold and pay for, and the cheapest arrangement is the one that puts every tenant together. Ours is the hostname, so spreading a fleet across domains costs what keeping it on one costs.

Nothing caps a zone as a whole here either. The ceilings are per hostname, and how many hostnames the plan holds.

What one registrable domain means

One domain is one certificate rate limit, one cookie scope and one blocklist fate for everything under it. With DNSMint every account has a domain to itself, and tenants can be spread across several.

The parts you would otherwise have to remember

Every domain is signed and its DS published at the registry before it serves anything, rather than being a step somebody adds later. With a managed certificate the certificate comes back from the same API as the hostname and we renew it, rather than being an ACME client, a plugin and a renewal to run yourself.

The same idea at fleet scale

A vendor shipping a box does this as a wildcard on a domain they bought, with the device address written into the label. plex.direct and myunraid.net are that, built in-house.

A wildcard a customer's box serves means the private key is on that box, on hardware the vendor does not control, and one extraction is every customer at once. A minted hostname is its own certificate, so one device is one device.