DNS that fits your pipelines
Terraform, OctoDNS, Certbot, REST API, and a proper CLI – DNS-as-Code on a managed backend with flat-rate pricing.
Why DNS is the last manual thing in your stack
Infrastructure-as-Code covers everything except DNS, because DNS often lives at a provider with a dated API.
Terraform providers that almost work
Half-maintained community providers, missing record types, auth that breaks quarterly. DNS becomes the terraform apply step that fails.
No proper CLI
You want to scripting a zone change. The provider offers a web UI, an outdated Python SDK, and nothing else.
Per-query billing surprises
Per-query billing makes cost hard to predict from a deployment plan – a traffic spike raises the bill with no warning.
ACME DNS-01 needs a plugin that doesn’t exist
Wildcard certificates via DNS-01 means writing a custom Certbot hook for whatever DNS provider you’re on.
What you get with NexDNS
Tooling that assumes your DNS lives in the same repo as your Terraform.
- Official Terraform provider
nexdns/nexdnson the Terraform Registry.nexdns_zoneandnexdns_recordresources, full lifecycle management, maintained in sync with the platform.- Go CLI with DNS-as-Code
nexdns apply -f nexdns.yaml– apply a declarative YAML representation of your zones. Idempotent, dry-run supported, CI-friendly exit codes.- OctoDNS provider
- Sync zones from any provider OctoDNS supports (BIND, Route 53, Cloudflare, Hetzner, and more) into NexDNS with a single
octodns-syncinvocation. - Certbot DNS plugin for Let's Encrypt
certbot-dns-nexdnsis an official DNS-01 plugin. Wildcard certificates issue and renew automatically – no custom hook scripts, no webhook proxies.- REST API with scoped keys
- Every panel action has a documented API endpoint. API keys scoped to specific actions (
zones.read,records.write,dnssec.manage). Rate limits surface before they impact you. - Flat pricing, no per-query billing
- Starter, Pro, Business, Enterprise – pick a plan by zone/record limits, not by how much traffic you route. Predictable cost from the deployment plan.
A typical DevOps setup
DNS changes go through git review like everything else.
-
1
Provision zones via Terraform
resource "nexdns_zone" "app" { name = "example.com" }– part of your main Terraform config, planned and applied alongside VPCs and Kubernetes clusters. -
2
Define records as code
Use Terraform
nexdns_recordresources, or YAML vianexdns apply, or OctoDNS YAML. Whichever fits the rest of your pipeline – all three work against the same backend. -
3
Review DNS changes in PRs
DNS changes are diffs. Reviewer sees exactly which records are being added, modified, or deleted. No more "someone changed the MX record and now email is broken".
-
4
Wire up Certbot for wildcard certs
certbot certonly --dns-nexdns --dns-nexdns-credentials /etc/letsencrypt/nexdns.ini -d '*.example.com'– DNS-01 challenge handled end-to-end, auto-renews via standard Certbot cron. -
5
Monitor and alert on API quotas
NexDNS rate-limit headers expose remaining quota. Scrape them with your usual monitoring (Prometheus, Datadog) and alert before requests start failing in deploys.
-
Yes – it’s the official first-party provider, published on the Terraform Registry. Resource shape is stable with semver versioning; breaking changes only at major version bumps. State management works the way you expect: Terraform computes a plan, applies idempotently, handles drift detection.
-
Terraform is the right fit if DNS is part of a larger infra state (mixed resources, plan-and-apply discipline). YAML via
nexdns applyis lighter – better when DNS is the primary concern (e.g., a team that manages 50 domains but no other infra). You can use both on the same account. -
The plugin handles the DNS-01 challenge; Certbot handles everything else. Use DNS-01 for wildcards (where it’s required) and HTTP-01 for single names (where it’s simpler). The plugin only engages when Certbot needs DNS-01.
-
The REST API allows 60 requests per minute, counted per account (or per IP for unauthenticated requests) – the same limit on every plan, with no per-plan tiers. Every response includes
X-RateLimit-Limit,X-RateLimit-Remaining, andX-RateLimit-Resetheaders, plusRetry-Afteron a 429, so you can back off before requests start failing. -
Yes. The CLI is a single Go binary (installable via
curl -sL https://get.nexdns.tech/cli | shin the runner), and Terraform’snexdnsprovider works with standard Terraform CI patterns. API keys go in your CI secrets, scoped to the minimum required permissions.
Use the DNS tooling you already have
Terraform, CLI, OctoDNS, Certbot – the tooling you already use, natively supported.