Documentation

Integrations

An integration connects your organization with the account of a DNS provider. Through it you import zones and create missing records in one click, additive only. Added to that are the calendar subscription with expiry dates and the CSV export.

On this page

Connecting DNS providers

Under Settings → Integrations (owners and admins) you choose the provider, enter the credentials and save. DomainWarn does not only check whether the credentials are valid but whether they may write: depending on the provider via the permissions of the token or via a short-lived probe record _domainwarn-verify-… that is deleted right away; at netcup only the login, because the credentials cover the whole account anyway. Credentials are stored encrypted and never shown again; creating, verifying and deleting are recorded in the audit log.

Six providers are connected. For all of them: zone import and records in one click; DomainWarn only creates, never changes existing records and only writes if all name servers of the domain point to the provider at the moment of the click.

  • Cloudflare: API token with Zone:DNS:Edit and Zone:Zone:Read, ideally from the "Edit zone DNS" template and limited to the client zones. The token can be revoked in Cloudflare at any time.
  • Hetzner DNS: API token of a project in the Hetzner Console with "Read & Write"; a read-only token is rejected. Hetzner tokens cannot be limited to DNS, the token may do anything in the project: therefore create a dedicated project for DNS zones only. Zones from the old DNS Console must have been migrated to the Hetzner Console.
  • IONOS: API key from the Developer Portal, consisting of public prefix and secret (visible only once). The key covers every zone of the account and cannot be limited to zones or to DNS; DomainWarn proves write access with a probe record.
  • netcup: customer number, Legacy API key and Legacy API password from the CCP under Master data → API (not the login password). There are no per-zone permissions. netcup provides a zone list to domain resellers only; other accounts import via list or zone file. Applies to classic DNS, not to CloudDNS.
  • INWX: username and password of a sub-account with the "DNS management" role and without two-factor authentication, because the API cannot log in without a TAN. The sub-account can be locked in the customer centre at any time.
  • Amazon Route 53: access key ID and secret access key of an IAM user without console access with an inline policy that allows only route53:ListHostedZones, route53:ListHostedZonesByName, route53:ListResourceRecordSets and route53:ChangeResourceRecordSets, restricted to individual hosted zones where possible. Temporary keys with a session token are not supported.

See also: Overview of the integrations

Creating missing records in one click

On the domain overview the card "Create missing records" appears as soon as a current finding (at most 30 days old, monitor active, last run without error) misses one of the four records. Every proposal shows type, name and content with a copy button; with a matching integration and name servers at the provider there is the button "Create at {provider}" with a confirmation dialog. Afterwards the record is in the audit log and the timeline, and the check runs again after about two minutes.

  • DMARC: TXT _dmarc.<domain> with v=DMARC1; p=none; rua=mailto:<address>. You enter the reporting address (suggestion dmarc@<domain>); if it is on a foreign domain, DomainWarn checks its authorization record.
  • SPF: TXT on the domain with v=spf1 <include of the detected mail provider> <further senders> ~all. Detected are Microsoft 365, Google Workspace, IONOS, STRATO, ALL-INKL, Hetzner, mailbox.org, Posteo, Proton, Zoho, Fastmail and iCloud; an unknown provider yields mx. Further senders you enter as include:, ip4:, ip6:, a or mx, up to eight; the finished record is resolved beforehand and rejected above ten lookups.
  • TLS-RPT: TXT _smtp._tls.<domain> with v=TLSRPTv1; rua=mailto:<address> (suggestion tls-reports@<domain>).
  • CAA: 0 issue "<ca>" for the certificate authority that actually issues according to certificates and CT logs, only if exactly one CA is involved (Let's Encrypt, Sectigo/ZeroSSL, DigiCert, GlobalSign, Google Trust Services, Amazon, GoDaddy, Buypass, SSL.com).
  • Safety: before writing, the name servers are freshly resolved and the zone is looked up in the account; if a matching record already exists, DomainWarn aborts. Per zone, type and name only one write runs at a time. Owners, admins and members may create, 20 times per minute.

See also: Email monitoring

Calendar subscription with expiry dates

Under Settings → Organization → "Calendar subscription" you generate an ICS address (owners and admins). It contains, per domain with a known expiry date, an all-day event "Domain expires" and per certificate an event "Certificate expires", each with client, registrar or issuer and a link to the dashboard, with reminders 14 and 3 days ahead, in the time zone and language of the organization. Calendar apps refetch the file every 12 hours.

  • Add it in Outlook, Google Calendar or Apple Calendar as a subscription by URL, do not import it, otherwise the calendar goes stale.
  • The address contains a token: "New address" invalidates the old one, "End subscription" switches the calendar off. Anyone who knows the address sees the expiry dates.
  • One calendar per organization; incidents and maintenance windows are not included.

CSV export of the domain list

The "CSV" button above the domain list downloads the list with the current filters (client, state, system, search, sort): domain, client, state, CMS and version, registrar, domain expiry, certificate target, valid until, days left, open incidents, last check, paused and dashboard link. UTF-8 with BOM, semicolon for a German organization language, otherwise comma (selectable by parameter), dates as YYYY-MM-DD. Every role may export, client access only their own domains; 30 exports per hour and organization, also via API token.

See also: API documentation

Zone file

The import from a BIND zone file needs no integration: export the zone file from Plesk, Cloudflare, IONOS or Hetzner, paste it, select host names. How DomainWarn reads the file and which names it leaves out is described in Getting started.

See also: Import from a zone file

Frequently asked questions

Does DomainWarn change existing records?
No, never. It only creates records that are missing and aborts as soon as a record of the same type and name exists. There is no deleting or editing, not even via the API.
Why is the button "Create at Cloudflare" missing?
Because not all name servers of the domain point to Cloudflare, the integration is not yet confirmed or you have no write permission. The values are still ready to copy.
My provider is missing. What now?
Copy the values and enter them in the DNS editor of the hosting provider; the provider guides on the tool pages describe the way for IONOS, STRATO, ALL-INKL, Hetzner, netcup and more. Import domains via list or zone file.
Can I connect several accounts of the same provider?
Yes, every integration has a name; when creating a record you choose the integration whose account holds the zone.