Hetzner DNS
Hetzner DNS Console (dns.hetzner.com) uses a single API token. Fast propagation and unlimited DNS-01 volumes make this a great option for labs and small-scale prod.
Prerequisites
- A Hetzner DNS Console account (separate from Cloud Console billing, but accessible via the same login).
- The zone listed at dns.hetzner.com. If you have a domain registered with Hetzner but still using the legacy Konsoleh DNS, migrate it to DNS Console first — the API only reaches the new product.
Create the API token
- Sign in at dns.hetzner.com.
- Top-right account menu → API tokens → Create access token.
- Name:
certautopilot-dns. Copy the token — shown once.
There is no per-zone scoping — a DNS Console token has write access to every zone on the account. Rotate on a schedule.
Add the credential
- Settings → DNS Credentials → New → Hetzner.
- Name:
hetzner-example-prod. - API token: paste.
- Test connectivity → Save.
Config fields
| Field | Required | Purpose |
|---|---|---|
api_token | yes | Hetzner DNS Console API token. |
Propagation
Hetzner propagates in under 30 seconds typically. Default settings work.
Troubleshooting
"Unauthorized"
Token is wrong, revoked, or from Hetzner Cloud Console (not DNS Console — they are separate products despite sharing SSO).
"Zone not found"
Zone is still managed by Konsoleh legacy DNS. Migrate the zone into DNS Console (nameserver change + zone import) before expecting the API to see it.