Changelog

2026-09-12

An MCP client can read what the endpoint offers without a credential. Every call that does anything still needs one.
An API key's name can be changed after it is created. Its permissions, limit and expiry are shown alongside, set as they were at creation.
Billing offers Starter and Standard side by side, the same two plans the pricing page offers and the same card.
Coolify, Dokploy and Dokku already issue certificates against us. There is a recipe for each.

Our ACME client asks for dns-persist-01 where the CA offers it and falls back to dns-01 where it does not. A grant is a standing record naming the account, so a second order for the same name needs no DNS write. Let's Encrypt offers it in staging today and Google Trust Services offers it nowhere, which is why the fallback matters more than the feature for now.
Every form on the site validates the same way, and the API validates the same rules again regardless of what the browser did.

POST /v1/hostnames takes a target as well as an ip, for a platform that hands you a URL and no address. We resolve it, publish ordinary A and AAAA records, and follow it within the target's own TTL as it moves.
A domain's label is two runs of six hex digits. It names no vendor, so a domain does not say whose inventory it came from.
An account staging an attack is stopped when we see it. The notice period covers an ordinary breach, not that.

A standard-plan domain is served from Google Cloud DNS, on its anycast network. Starter domains stay on our own two nameservers. The plane is fixed when the domain is acquired, because changing it is a DS rollover at the registry.
The data export carries the private key of every certificate we manage for you. Closing an account destroys the key those are encrypted under, so what is left cannot be read.
A refund on a subscription stops the hostnames on it, by webhook and by a sweep behind it.
The second status page is at status.dnsmint.dev, on a domain our own nameservers do not answer for, so it survives the outage it exists to report.

A Posh-ACME plugin, DNSMint. The API key is the whole configuration, and Windows PowerShell 5.1 is enough.
An MCP endpoint at dnsmint.com/mcp. Add the URL as a connector in Claude or ChatGPT and sign in, or send an API key as a bearer token from Claude Code, Cursor or VS Code. An agent can mint a hostname, repoint it, and diagnose it.
Connected applications are listed on the API keys page, and disconnecting one stops it on its next call.
A device flow for servers with no browser: the machine prints a code, you approve it at dnsmint.com/device from a phone or laptop.
A Terraform and OpenTofu provider, dnsmint/dnsmint, on the registry. Hostnames, records and API keys as resources. Changing an address repoints in place; destroy releases the name, which is permanent.

A Caddy module: build it in with xcaddy and put an API key in the Caddyfile.
A cert-manager webhook solver: an API key in a Secret, and no credential per hostname.
A Kubernetes external-dns provider: annotate a Service or Ingress and the hostname is minted and kept pointed at the right address.
An acme.sh plugin, dns_dnsmint.
certbot needs no plugin. It takes a hook script and an API key.
The DNS-01 challenge can be published with an API key directly. The acme-dns credential still works for clients that expect one.

Every domain we award is signed at admission: keys, signatures, published DS record, NSEC3 proofs on negative answers, and signatures re-signed on a schedule.
CAA is now a record you can publish on your own hostname, to name the CAs you want issuing for that name.
DNS Diagnostics says why a hostname is not working, from the dashboard or from the API at GET /v1/hostnames/{id}/diagnose.
Teams: invite members, hand over ownership, and switch between companies without signing out.
A released subdomain returns to your account and can be minted again at once. Domains are never reused, so there is nobody else it could go to. Hostnames terminated for abuse stay terminated.

Managed certificates: we hold the key, get the certificate, and renew it for you. The key rotates every renewal, and a released hostname revokes its certificate.
Google Trust Services joins Let's Encrypt as an issuer, selectable per request with external account binding.
Renewal runs under the ACME Renewal Information protocol, with Let's Encrypt and Google both supporting it.

The ACME protocol layer landed against Let's Encrypt staging, then production: account, JWS, DNS-01 key authorization, orders, issuance.
Three certificate modes: self, csr, and managed. In csr mode you keep the private key and send a signed request; we run ACME around it and never see the key.

TLSA records are representable and publishable under a hostname, refused on zones that are not signed.
Hostnames do not expire. What rotates is the domain, on Starter.
Private addresses work on every plan. A hostname keeps the address class it was minted with: public stays public, private stays private.
API keys can be narrowed to one hostname or one domain.

Every account holds its own dedicated, registered domain.
Subdomains are opaque or chosen. A released hostname is never issued again.
Domains are sourced across four registrars, bought on claim, and delegated before they are handed over.

One authenticated API call registers a hostname and points it at an IP address.
The nameserver answers from a record store with a Mongo-backed control plane. A hostname survives IP changes, and TTLs ramp with how long an address has held still.
The DNS-01 certificate API is live, with wildcard certificates.