Integrations

Cloudflare

An API token from the "Edit zone DNS" template with the permissions Zone:DNS:Edit and Zone:Zone:Read, limited to the zones of the clients DomainWarn may write to. The token can be revoked in Cloudflare at any time.

• Zone import: all zones of the account, 200 per page.
• One-click records: DMARC, SPF, TLS-RPT and CAA when the name servers point to *.ns.cloudflare.com.
• Minimal permissions: the token covers DNS only and only the chosen zones.

Hetzner DNS

An API token of the project in the Hetzner Console with permission "Read & Write"; a read-only token is rejected. Hetzner tokens cannot be limited to DNS, the token may do anything in the project. Therefore create a dedicated project for DNS zones only and delete the token there whenever needed.

• Zone import and one-click records for zones of the Hetzner Console; name servers *.ns.hetzner.com and *.ns.hetzner.de.
• Zones from the old DNS Console (dns.hetzner.com) must have been migrated to the Hetzner Console.
• Verified on save: read zones, create and delete a probe record.

IONOS

An API key from the IONOS Developer Portal, consisting of public prefix and secret, which IONOS shows only once. The key covers every zone of the account and cannot be limited to single zones or to DNS: a dedicated key for DomainWarn only, deletable in the portal at any time.

• Zone import and one-click records for domains on IONOS name servers (*.ui-dns.com, .de, .org, .biz).
• On save DomainWarn creates a probe TXT record and deletes it right away.

netcup

Customer number, Legacy API key and Legacy API password from the Customer Control Panel under Master data → API (not the login password). netcup has no per-zone permissions: the API key may change every DNS zone of the account; DomainWarn only adds missing records.

• One-click records for domains on netcup name servers (*.netcup.net) using classic DNS; CloudDNS has its own API and is not supported yet.
• Zone import: netcup provides a zone list to domain resellers only. Other accounts import via list or zone file.

INWX

Username and password of an INWX sub-account that only has the "DNS management" (name server) role, no domain, contract or account permissions. Two-factor authentication must be off for the sub-account because the API cannot log in without a TAN; the sub-account can be locked or deleted in the customer centre at any time.

• Zone import and one-click records for domains on INWX name servers (ns.inwx.de, ns2.inwx.de, ns3.inwx.eu and the .com/.net variants).
• On save DomainWarn briefly creates a TXT record _domainwarn-verify-… in the first zone and deletes it again.

Amazon Route 53

Access key ID and secret access key of a dedicated IAM user without console access. The inline policy allows only route53:ListHostedZones, route53:ListHostedZonesByName, route53:ListResourceRecordSets and route53:ChangeResourceRecordSets, the latter two ideally restricted to the hosted zones DomainWarn may write to.

• Zone import and one-click records for domains on AWS name servers (ns-….awsdns-….com/.net/.org/.co.uk).
• Temporary keys with a session token are not supported; the key can be deactivated in IAM at any time.
• On save a short-lived probe record proves write access.

Slack and Microsoft Teams

A slash command in Slack or an outgoing webhook in Teams, secured with the signing secret or an HMAC token. /domainwarn client.com shows state, certificate days left, domain expiry and open incidents with a link to the dashboard; check client.com triggers a check; list shows all domains needing action, visible only to you. Replies come in the language of the organization.

• Up to ten commands per organization, set up under Settings → Notifications.
• Permissions apply per workspace: whoever may run the command sees all domains.
• Alerts to Slack and Teams keep going through webhook channels as before.

Commands and setup in the docs

20 channels

Recommended: email, Slack, Microsoft Teams, Discord, webhook with HMAC signature. On-call: PagerDuty and Opsgenie with automatic close on the all-clear, Pushover, ntfy, SMS, web push. More: Telegram, Google Chat, Mattermost, Rocket.Chat, Zulip, Matrix, Gotify, private Atom feed and your own SMTP server. Every channel has a minimum severity, every channel is confirmed by a test delivery.

Channels in the docs

Calendar subscription (ICS)

One ICS address per organization with an all-day event per domain expiry and per certificate expiry, with client, registrar or issuer, link to the dashboard and reminders 14 and 3 days ahead. Add it as a subscription by URL; calendar apps refresh every 12 hours. The address can be renewed or switched off at any time.

Calendar in the docs

REST API

Everything from the dashboard via API: create domains and clients, trigger checks, acknowledge incidents, query events and check results. Tokens with read or write scope, 300 requests per minute, errors as application/problem+json, specification at /openapi.json for Postman, Insomnia or generated clients.

API documentation

CSV export

The domain list with the current filters as CSV: domain, client, state, CMS, registrar, domain expiry, certificate valid until and days left, open incidents, last check. UTF-8 with BOM, semicolon or comma, protected against formula injection, also available via API token.

CSV in the docs