Domain APIs: Automating Registration and DNS

With a handful of domains, the control panel is fine. Once you have hundreds of clients, or your service must create a domain or subdomain for every new customer, manual work becomes slow and error-prone. A domain API lets software talk directly to the registrar or DNS server and repeat the same operations without human involvement.

What an API can do

Typical operations include checking availability and price, registering and renewing, changing name servers and contacts, retrieving transfer codes and managing DNS records. Registrars expose these in two ways: EPP, the XML protocol between registries and accredited registrars that needs a dedicated connection and contract, and the registrar's own REST/JSON API for resellers and developers, authenticated with a token. Small and mid-sized businesses almost always want the second.

Checking availability and registering

The example uses a placeholder endpoint, api.misol.uz; real endpoints and formats come from your registrar's documentation:

# Check several domains (placeholder endpoint)
curl -s -X POST https://api.misol.uz/v1/domains/check \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.uz", "example.com"]}'

RDAP offers an independent hint: a 404 usually means no registry record, but reserved or pending-delete names can still be unavailable, so rely on the registrar's answer for the final decision:

# 404 - no registry record (may be free), 200 - taken
curl -sL -o /dev/null -w "%{http_code}\n" https://rdap.org/domain/example.com

Never charge a customer before confirming the domain is free and the registration actually succeeded. Registration is often asynchronous, so poll the status or use webhooks, and refund or flag the order automatically if it fails.

Retries without double charges

If the connection drops after a registration request, a naive retry can pay for the domain twice. Many APIs support idempotency keys, where a repeated request returns the first result instead of acting again:

import os, time, uuid, requests

API = "https://api.misol.uz/v1"
HEAD = {"Authorization": f"Bearer {os.environ['API_TOKEN']}"}

def register(domain, contact_id, years=1):
    key = str(uuid.uuid4())  # the same request will not run twice
    for attempt in range(3):
        r = requests.post(f"{API}/domains", headers={**HEAD, "Idempotency-Key": key},
                          json={"domain": domain, "years": years, "contact": contact_id},
                          timeout=30)
        if r.status_code < 500:
            r.raise_for_status()
            return r.json()
        time.sleep(2 ** attempt)
    raise RuntimeError("API did not respond")

Retry only on server errors (5xx); log validation or balance errors and show them to a person. If your registrar does not support Idempotency-Key, enforce the same rule through order status in your own database.

Automating DNS records

Suppose a platform for a Tashkent training centre creates a subdomain such as chilonzor.misol.uz for each branch. No new domain is needed, only a DNS record. With your own BIND server, use dynamic updates secured by TSIG:

# Create a TSIG key (BIND 9)
tsig-keygen -a hmac-sha256 deploy-key > /etc/bind/keys/deploy.key

# Replace the A record
nsupdate -k /etc/bind/keys/deploy.key <<'EOF'
server ns1.misol.uz
zone misol.uz
update delete shop.misol.uz. A
update add shop.misol.uz. 300 A 203.0.113.10
send
EOF

# Verify
dig +short shop.misol.uz @ns1.misol.uz

The zone must allow this key to update it via update-policy or allow-update; restrict it to the zone or specific names. Use short TTLs such as 300 seconds for frequently changing records.

Security and rollout

An API token is the key to all your domains and your balance. Keep it in environment variables or a secrets store, never in code or Git, restrict API access by IP where possible and grant only the permissions each script needs. Log every call with time, parameters and response, but never the token, and respect rate limits. Roll out gradually: read-only operations first, then DNS updates, and paid actions last, using a sandbox if available. sayt.uz customers manage domains, DNS and auto-renewal in the cabinet and can ask support about API integration. Whatever provider you use, keep manual control available for when the API is down.