DNS providers
Connect a DNS provider once — Cloudflare, Bunny, Hetzner, deSEC, or Gcore — and let SpipCP create your DNS records. Or run your own nameservers. The provider token never reaches a node.
DNS provider accounts now live under Networking → Providers
This page describes the DNS-provider accounts; they live in the Networking section — Networking → Providers. The old Settings → DNS providers link redirects there, so everything below still applies; it's just a new home.
A DNS provider account is a named credential you connect once and reuse across many domains. With it, SpipCP creates the DNS records for you when you attach a domain, so you don't add them by hand. Like git accounts, it cascades: a default set on a node flows to its instances, a default on an instance flows to its domains, and any domain can override the one above it.
SpipCP supports several managed DNS providers. If you'd rather not hand your records to any of them, you can run your own nameservers instead — see the DNS section.
A provider token NEVER reaches a node
The API token stays only in the panel, encrypted, and is used only for panel-side API calls — the per-row Test and the record write at attach time. You send it once when you connect the account; it's never shown again. The account list shows only the non-sensitive fields — name, provider, zone, and state.
Choosing a provider
Every provider writes the same records — A/AAAA/CNAME/MX/TXT (and the wildcard) — through its own API. They differ in where they're hosted and what they cost. That's the choice that matters if you're moving off US-hosted DNS for GDPR or data-ownership reasons.
| Provider | Hosted | Cost | Notes |
|---|---|---|---|
| Cloudflare | US | Free | The original. The only provider with the orange-cloud proxy (below). |
| Bunny | EU (Slovenia) | Free | Simple EU DNS, no proxy. |
| Hetzner | Germany | Free | German DNS console; pairs naturally with Hetzner servers. |
| deSEC | EU (non-profit) | Free | Run by a German non-profit; DNSSEC on by default. |
| Gcore | EU (Luxembourg) | Free tier | Anycast DNS with a usable free tier. |
If your goal is to leave US-hosted DNS without running infrastructure, Bunny, Hetzner, deSEC, or Gcore are the managed EU options. If you want full ownership of the records and the nameservers themselves, see self-hosted nameservers.
Connecting an account
Settings → DNS providers → Add DNS account. Pick the provider, then enter its credentials:
| Field | Meaning |
|---|---|
| Name | A friendly label to tell accounts apart (acme-zone, client-eu). |
| Provider | Cloudflare, Bunny, Hetzner, deSEC, or Gcore. Sets which API the token talks to. |
| Zone | The zone the records live under. Cloudflare uses a Zone ID; the others key off the domain name. Some providers manage all your zones under one key — leave it blank to let SpipCP target the domain's zone. |
| API token | A token scoped to edit DNS records for that zone (see per-provider notes below). Encrypted on arrival; never shown again. |
Where to get the token (per provider)
My Profile → API Tokens → Create Token, use the "Edit zone DNS" template, scope it to Zone · DNS · Edit limited to your zone. Grab the Zone ID from the domain's Overview page (right sidebar, under "API").
Account → API → API Key (or a DNS-scoped key). Bunny keys cover your whole account, so the Zone field can stay blank — SpipCP targets the domain's zone.
Hetzner DNS Console → API tokens → Create access token. The token covers your DNS zones; SpipCP finds the zone for the domain you attach.
deSEC → Token management → Create token (a DNS-write token). deSEC enables DNSSEC by default on every zone it hosts — keep that in mind if your registrar already has a DS record set.
Gcore profile → API tokens → Create permanent API token with DNS permissions. The free tier is enough for typical record management.
Generate the token at your provider (see the tab above), scoped to edit DNS records for the zone your domain lives in.
In SpipCP, Settings → DNS providers → Add DNS account, pick the provider, enter the Name, Zone (if the provider needs one), and token, then Add account. The account is tested automatically on connect — a green line confirms the token reaches the provider. You can re-run Test on the row any time.
Test checks the token against the provider's API before you rely on it.
Setting a default that cascades
Set a DNS account as a default so domains inherit it instead of you picking one every time. The default cascades down the fleet:
| Level | Where you set it | Who inherits it |
|---|---|---|
| Node | A node's DNS tab | every instance + domain under that node |
| Instance | An instance's DNS tab | every domain on that instance |
| Domain | The attach wizard / domain row | just that domain (the override) |
A level left blank inherits from the level above. The most-specific value wins: a domain override beats the instance default, which beats the node default. Change a node's default and every domain that never overrode follows automatically — no re-attach needed.
Deleting an account degrades to inherit, never breaks
If you delete an account a node, instance, or domain pointed at, that reference falls back to the level above it rather than breaking. A domain whose override you delete reverts to the instance/node default; a node default you delete leaves its domains on the manual driver until you set a new one.
Using it when you attach a domain
When you attach a domain and pick a provider driver, SpipCP finds the right account for that domain (domain → instance → node) and creates the record for you. If no account is found, that provider is greyed out in the wizard with a link here — you're never led down a path that fails at attach.
The orange-cloud proxy is Cloudflare-only
The proxy toggle (Cloudflare's orange cloud) appears only for Cloudflare domains. It's a Cloudflare product — its edge in front of your IP — not a DNS feature, so it's hidden for Bunny, Hetzner, deSEC, and Gcore. With Cloudflare, SpipCP reads the record back through the Cloudflare API, so the proxy can stay on without breaking the attach check. See Domains & SSL for the full attach flow.
Wildcard certificates need a Caddy DNS module
A wildcard (*.example.com) certificate uses a DNS-01 challenge, which means the node's Caddy
has to write a TXT record through your provider's API. That needs the matching caddy-dns/<provider>
module built into the Caddy on that node. If it's missing, the attach wizard tells you exactly what's
wrong rather than letting the wildcard fail silently. A single hostname (no wildcard) uses HTTP-01
and needs no DNS module. See Domains & SSL → wildcards.
Permissions
Adding, testing, editing, and removing accounts — and setting node/instance defaults — is admin-only. The server enforces this on every action, so hiding the page is just a convenience on top.
Next steps
- DNS in SpipCP: the two layers — delegation vs. records, and where each provider fits.
- Managed providers in depth — the EU/GDPR framing and the end-to-end attach.
- Run your own nameservers — the self-hosted alternative.
- Domains & SSL — the attach flow these accounts feed, and the issuer cascade.
- SSL issuer accounts — the sibling cascade for alternative certificate authorities.
- Git accounts — the same cascade shape, for repos.
Accounts & sign-in
Invites, two-factor authentication, recovery codes, password reset, and sessions.
SSL issuer accounts
Connect alternative certificate authorities — ZeroSSL or Actalis (ACME with EAB) and bring-your-own custom certificates — and cascade an issuer default down node → instance → domain. EAB keys and private keys never reach a node.