Questions
Getting started
What do I need to bring?
A server with an IP address, public or private, and a card on file. The domain, the DNS, and the certificate plumbing are included, and the domain is yours alone on every plan, so the Let's Encrypt rate limits are yours alone too.
What does a hostname actually look like?
A subdomain you choose, on a domain we register for you: api.a3f9c1-d4e7b8.dev, for example. Every domain we hand out has that shape, on a paid plan typically .com, .net or .dev, and on Starter .top, .lol or .site. The subdomain is yours to pick - 3 to 63 characters, lowercase letters, digits and hyphens - or omit it and we mint an opaque one.
Can I choose the domain, or use one I already own?
You choose the subdomain. The domain and its TLD are ours: we register them, sign them, publish the DS and defend their reputation, and that is only possible because we hold the registration. Bringing your own domain is not supported, and neither is transferring one of ours out. What you get instead is a dedicated domain, so your certificate limits, cookie origin and reputation are yours alone.
How fast is a new hostname usable?
Seconds for DNS, about a minute for HTTPS. The API reports the record as live once the nameservers holding its zone answer for it, and the certificate authority usually finishes right after.
What happens when my server's IP changes?
Send one PUT with the new address. The hostname and its certificate carry over untouched, so everything pointing at the hostname keeps working.
Certificates
Which certificate authorities work?
Any ACME certificate authority, when you run the client. Our domains name Let's Encrypt and Google Trust Services in a CAA record, so those two work straight away; for ZeroSSL, Buypass or anything else, publish a CAA record on your hostname naming it and that applies instead of ours. Either way your private key never leaves your server. With managed certificates we run the client for you, against Let's Encrypt or Google Trust Services as you choose - you get the certificate and its key, and we keep a copy so you can fetch the current pair any time without us pushing anything at you. Every renewal generates a fresh keypair, so a managed key is never years old.
Do I need to run an ACME client?
Only if you want to. Point Caddy, certbot or anything else at the hostname and it gets a certificate itself - that is the default, and your key stays with you. Or register the hostname with certificate: "managed" and we run ACME instead: we get the certificate, renew it before it expires, and you fetch it with one GET. Nothing is pushed to you, and there is no renewal logic on your side.
Can machines inside a private network get certificates?
Yes, on every plan. Register the private IP and use the DNS-01 API; it publishes the validation record that public CAs check. The certificate is issued for the hostname, not the address, which is why a hostname pointing at a private IP can have a publicly trusted cert.
Scope and limits
Who sees my traffic?
You and your users. DNSMint's role ends at the DNS answer; connections run directly to your server, on your bandwidth, and nothing routes through us to inspect. That does not change with managed certificates: we keep a copy of the key so you can fetch it, and there is still no traffic here to read.
Why does Starter need a card?
Because a domain is a real registration we pay for, and Starter gives you one of your own. Nobody shares a domain here, on any plan. Starter is free for 3 months and then $2.99/month; the card is taken up front because it tells us who holds the domain, which is what keeps a registration from being free to anyone who wants one for an afternoon.
Can I mint hostnames for my own customers?
Yes. You hold several dedicated domains and mint hostnames beneath them through the same API, and you choose which customer sits on which domain. Each sits on a dedicated domain, so their reputation and their certificate budget are separate from every other account.
How long do hostnames last?
Until you release it. Releasing stops DNS and revokes the certificate, and you can mint the same hostname again afterwards. The one thing with a clock on it is the Starter domain: it is registered for a year and not renewed. We tell you before it lapses, and you claim a replacement, which is a different name; hostnames do not move between the two.
What can an API key do, and can I limit it?
A key carries an explicit list of what it may do, and each of those names what it may reach: the whole team, one domain, or a single hostname. So a key that only publishes certificate challenges cannot repoint or release anything, and a key given to one machine reaches only that machine's name. A key can also be given a lifetime, and can be allowed to create and revoke keys so a fleet rotates its own credentials without a person. The secret is shown once at creation, revocation takes effect on the next request, and your activity log names the key behind each action. The security page has the detail.
Do I own the dedicated domain? Can I transfer it out?
No, and this is worth knowing before you build on us. We stay the registrant on every domain we operate, and a dedicated domain is exclusively yours to use rather than an asset you can transfer to your own registrar account. That is the trade that removes the registrar account, the renewals, the ICANN verification step, and the human with a card from the path between an API call and a working hostname. If you need to be the accountable registrant of the name, you need a registrar rather than us, and we would rather say so here than at renewal.
What happens to my hostnames if I cancel?
Your plan runs to the end of the period you paid for. When it ends we release the hostnames and revoke their certificates, so they stop resolving then, and the domain is not renewed. Because the hostnames live on a domain we hold, there is no way to take them with you. If continuity past cancellation matters, run the names that must outlive the account on a domain you own yourself, and use DNSMint for the ones that are meant to be disposable.
Something else on your mind? Write to hello@dnsmint.com.