Knowledge base
Create a deSEC API token in Token Management and connect it, so your domains' DNS is served from your own deSEC account.
Connecting your own deSEC account lets a domain's DNS be served from your account instead of ours. You keep the zone, the bill and the vendor dashboard; we create and update the records your sites and mailboxes need, so you do not copy them by hand.
A deSEC account. deSEC is a free, non-profit DNS host; its own limits on how many domains and changes an account may have apply.
Sign in at deSEC and open Token Management. Press +, give the token a name, and create it. Under Advanced settings you can limit where the token may be used from and how long it stays valid — leave the address restriction empty, because a token limited to other addresses is refused when we use it.
The token needs full access to your domains, so do not restrict it to particular records. deSEC shows the token's value once, when it is created; copy it then.
Open Integrations in your dashboard and choose Connect an account. Pick Your own DNS as the group and deSEC as the account, fill in API token, and press Connect account.
We test what you paste before anything is saved. A key that does not work is never stored, and the answer says what was wrong with it. A key that works is kept encrypted in our secrets vault — never in our database — and is never shown again, not even to you.
DNS is served from. We create the zone there if it does not exist and write the records the domain's sites and mail need.
add a mailbox — we update the record on your account.
registered with us, or at a registrar you have connected, we set them for you; otherwise the domain's page shows the nameservers to set.
The checklist beside the connection shows which of those we could confirm.
It connected and a change was refused. deSEC applies rate limits to changes on an account. Wait a minute and try again; nothing half-applied is left behind.
It stopped working after a while. A validity or maximum-unused period set under Advanced settings has run out. Create a new token.
It says the key was rejected. Almost always one of three things: a space or a line break copied with it, a key that has expired, or a key that was revoked or regenerated after you copied it. Create a fresh one and paste it again.
It connects, but something later fails. The key authenticates but lacks a permission the action needs. Create a new key with the permissions listed above, then disconnect the old connection and connect the new key.
Open Integrations, find the account and press Disconnect. That deletes the stored key at once. Anything that was using it stops at its next action, and the screens that depended on it say so rather than failing quietly.
Disconnecting does not undo what was already done — records, deployments or settings we changed on your account stay as they are. If you think the key itself may have leaked, also revoke it at the vendor; disconnecting removes our copy, not theirs.
What we have been writing about hosting, SEO and running sites at scale.
How hosting shapes indexing and link equity in 2026: keeping pages indexed, vetting aged domains before you build on them, link building without a footprint, and an honest line on what infrastructure can and cannot do for SEO.
Read the post →A practical checklist for fast, secure WordPress: server-level caching, a per-site object cache, the handful of plugins worth running, keeping the stack current, and the WooCommerce pages you must never cache.
Read the post →What actually separates good managed hosting from a cheap box with a control panel — migrations, backups, isolation, real caching and honest scaling — and how to judge it before you commit.
Read the post →Support is included on every plan, the desk is open 24 hours a day, and you can write to us in any of our 58 languages — we answer you in yours.
Contact support → All articles →