Supported provider
PowerDNS DNS, in the same place as everything else.
Does DNSMentor support PowerDNS?
Yes. DNSMentor manages PowerDNS DNS through its API, showing its zones alongside the other 25 supported providers in a single estate view. Every PowerDNS change goes through the same 56 pre-flight checks, approval policy, independent verification and tamper-evident audit trail as every other provider.
Connecting PowerDNS
- Create the credential in PowerDNS The full HTTPS URL of the PowerDNS API, including the port the webserver listens on — for example https://dns1.example.com:8081. This is the address of the authoritative server's built-in webserver, which is off by default: it is enabled with 'webserver=yes' and 'api=yes' in pdns.conf. It must be reachable from the internet and must present a valid certificate, because the API key travels on every request. Put it behind a reverse proxy that terminates TLS if PowerDNS itself is not serving HTTPS.
- Add the connection in DNSMentor Go to Admin → Providers & API keys, choose PowerDNS, and paste the credential. DNSMentor stores it encrypted and strips it from every log and export.
- Sync the estate DNSMentor discovers every zone the PowerDNS account holds and imports every record in them. This is a read operation — nothing is written to any zone.
- Group by client and start working Assign the imported domains to client portfolios, and the estate view, health scoring, checks and audit trail apply from that point on.
What PowerDNS asks you for
The exact fields DNSMentor needs, and where in PowerDNS to create them. Every secret is encrypted at rest and stripped by name from logs, exports and the audit trail.
API address not secret The full HTTPS URL of the PowerDNS API, including the port the webserver listens on — for example https://dns1.example.com:8081. This is the address of the authoritative server's built-in webserver, which is off by default: it is enabled with 'webserver=yes' and 'api=yes' in pdns.conf. It must be reachable from the internet and must present a valid certificate, because the API key travels on every request. Put it behind a reverse proxy that terminates TLS if PowerDNS itself is not serving HTTPS.
API key secret The value of 'api-key' in pdns.conf. It is a single server-wide key with no scopes and no read-only variant: anyone holding it can rewrite or delete every zone the server is authoritative for. Restrict who can reach the webserver port with 'webserver-allow-from' — DNSMentor's egress addresses are shown on the connection screen — and use a key used for nothing else, so it can be rotated without breaking your other tooling.
Server id not secret Leave blank unless you know otherwise. PowerDNS calls its own server 'localhost' in the API regardless of the machine's real hostname, and that is the default here.
What you get on top of the PowerDNS console
One estate, not one provider
PowerDNS zones sit beside every other provider your clients came with, grouped by the client who pays for them and searchable in one place.
56 checks before apply
The PowerDNS console will accept a second SPF record or an MX pointing at an address without comment. DNSMentor will not.
Approval and audit
A second pair of eyes where policy requires it, and a hash-chained record of who changed what — neither of which a provider console offers.
PowerDNS questions
Can I manage PowerDNS DNS alongside my other providers?
Yes. DNSMentor connects PowerDNS through its API and shows its zones in the same estate view as every other provider you connect — 26 are supported in total. Your engineers work in one interface instead of switching between provider portals, and the same checks, approval policy and audit trail apply regardless of which provider a domain happens to be with.
What credentials does DNSMentor need for PowerDNS?
DNSMentor needs API address, API key, Server id for PowerDNS. The full HTTPS URL of the PowerDNS API, including the port the webserver listens on — for example https://dns1.example.com:8081. This is the address of the authoritative server's built-in webserver, which is off by default: it is enabled with 'webserver=yes' and 'api=yes' in pdns.conf. It must be reachable from the internet and must present a valid certificate, because the API key travels on every request. Put it behind a reverse proxy that terminates TLS if PowerDNS itself is not serving HTTPS.
Does DNSMentor move my zones away from PowerDNS?
No. Your zones stay hosted at PowerDNS and remain authoritative there. DNSMentor reads and writes through the PowerDNS API, so nothing about your resolution path changes, and if you stop using DNSMentor the zones carry on exactly as they are.
Does DNSMentor validate PowerDNS changes before applying them?
Yes. All 56 checks run against the zone as it would exist after the change, whichever provider hosts it. The change is then simulated, routed for approval if policy requires it, written through the PowerDNS API after re-reading live state, and independently verified in public DNS afterwards.
Other providers DNSMentor manages
Connect PowerDNS in about five minutes.
Paste one credential, sync, and see every zone in that account. It is a read operation — nothing is written until somebody presses apply.
No card. No trial clock. UK-hosted, and we will tell you which providers we have actually proven before you ask.
Last updated