DNS & nameservers

Hosted vs. external DNS

A domain's DNS lives wherever its nameservers point:

• Our nameservers (ns1.ingram.tech / ns2.ingram.tech — the default at registration): the domain gets a hosted zone you manage here, via the API, the dashboard's DNS tab, or the assistant.
• External nameservers (e.g. Cloudflare): DNS is managed at that provider. Zone endpoints answer 409 no_hosted_zone, and the dashboard's DNS tab shows where the delegation points instead. Domains transferred in keep their existing delegation, so nothing breaks on arrival.

Switch delegation any time from the domain's Nameservers tab in the dashboard, or by asking the assistant ("switch example.com to your nameservers"). Nameserver changes are free. A REST endpoint for delegation changes is on the roadmap; today the API manages records, not delegation.

Managing records

Record types: A, AAAA, CNAME, MX, TXT, NS, CAA, SRV. Changes propagate from our nameservers in ~30 seconds (subject to record TTLs downstream).

# List
curl -s https://domains.ingram.tech/api/v1/domains/example.com/zone \
  -H "authorization: Bearer $INGRAM_TOKEN"

# Create
curl -s -X POST https://domains.ingram.tech/api/v1/domains/example.com/zone \
  -H "authorization: Bearer $INGRAM_TOKEN" -H 'content-type: application/json' \
  -H 'idempotency-key: 7e2f1c9a-dns-1' \
  -d '{"subdomain": "app", "type": "A", "value": "203.0.113.10", "ttl": 3600}'

# Delete — a record is identified by its subdomain + type + value triple
curl -s -X DELETE 'https://domains.ingram.tech/api/v1/domains/example.com/zone?subdomain=app&type=A&value=203.0.113.10' \
  -H "authorization: Bearer $INGRAM_TOKEN" -H 'idempotency-key: 7e2f1c9a-dns-2'

There is no record id: updates are delete + create of the identifying triple (the dashboard's edit form does exactly this).

MX and SRV records take a priority; SRV additionally understands service/protocol/weight/port fields.

DNSSEC

Toggle per domain — PATCH /api/v1/domains/{name}/settings with {"dnssec": true}, or the domain's Security tab. Signing is handled on our nameservers; DNSSEC on an externally-delegated domain is managed at the external provider instead.