Domains and nameservers
Register or transfer domains and manage contacts, nameservers, and DNS zones.
Domains affect more than branding
Your domain choices influence billing, renewal timing, DNS changes, certificates, and how quickly a public service can go live.
What the customer flow covers
The portal covers discovery, ordering, nameserver changes, contact management, transfer-sensitive actions, and DNS settings where the registry and TLD allow it.
Open Manage → Domains for registration, renewal, contacts, nameservers, lock, privacy and DNSSEC. Open Manage → DNS for DNS records. They are different resources even when the domain is registered with us.
Register, transfer or renew
Search availability and review the TLD's allowed periods, price and required contact information. Select the offered DNS starting point and check the order before paying. An available name is not reserved by a search.
For an existing domain, use Renew when offered. It creates a renewal invoice; payment dispatches the eligible renewal. Confirm the resulting expiry rather than assuming a paid invoice already proves registrar completion. After a timeout, check the existing order and domain before requesting another renewal.
Nameservers and DNS changes
The registrar's nameservers determine which DNS provider is authoritative. Creating a zone here does not switch delegation automatically. Changing Website Protection settings is not the same as changing live DNS records.
If the DNS page detects our legacy ns1/ns2 nameservers, review the panel's records and use Fix nameservers to switch to dns1/dns2 when eligible. Other legacy records are not copied. A successful registrar update may need time to propagate; do not repeatedly submit it while waiting.
DNSSEC
Use the DNSSEC tab on the registered domain, not the DNS-service page. When the TLD and domain state permit activation, review the enabled/disabled status and use the offered action.
For our hosted DNS, activation prepares zone signing and submits its public key for parent delegation. For external DNS, enable signing with that provider first and supply its public KSK/CSK DNSKEY when requested: flags 257, protocol 3, supported algorithm and public key. Never submit a private key or add an apex DS record to your own zone.
Enabling/disabling may run in the background; follow its saved status and any offered status check instead of repeating the request. Registrar status does not independently prove parent propagation. When disabling, keep external signing enabled until the parent DS and cached copies expire.
Public API and automation
Registered-domain DNSSEC is available through the public HTTP API. Domain registration and DNS hosting are separate resources: use your registered-domain service UUID or domain name, not a DNS-zone ID. Read GET /v1/domains/{serviceId}/dnssec with domains.read. A saved status is not a new registrar check.
| POST action | Scope | JSON body | Retry key | Success |
|---|---|---|---|---|
| refresh | domains.read | {"action":"refresh"} | Not required | HTTP 200 current or ongoing state |
| enable, managed DNS | domains.write | {"action":"enable","mode":"managed","acknowledge":true} | Required | HTTP 202 accepted |
| enable, external DNS | domains.write | action=enable, mode=external, acknowledge=true, keys | Required | HTTP 202 accepted |
| disable | domains.write | {"action":"disable","acknowledge":true} | Required | HTTP 202 accepted |
External keys are 1–4 public DNSKEY records with flags=257, protocol=3, alg in 8/10/13/14/15/16 and Base64 pub_key. Never submit private DNSSEC keys. Algorithm and TLD support must be discovered; unsupported or unknown support is an error. Managed enable also requires your ready, unlocked DNS zone. Check support, dnsProvider, canEnable and canDisable before requesting changes. Changes require an active registration.
For enable/disable, Idempotency-Key is 8–128 letters/digits/._:-. Reuse the original key with the exact payload after interruption. HTTP 202 means accepted, not completed. Poll GET on the same DNSSEC endpoint with domains.read and inspect operation, status and errorCode. operationId is a DNSSEC UUID, not a /v1/operations handle. pending/queued/running are ongoing; unconfirmed requires reconciliation and failed is not success. Use refresh to reconcile when appropriate rather than submitting a new write key. idle with the intended registrar_configured/not_configured status confirms registrar configuration; delegationStatus=not_verified means parent propagation has not been verified. Disable removes registrar delegation without deleting signing keys: retire delegation safely before deleting a signed zone.
SDK/CLI 0.1.17 includes domain_dnssec/domain_dnssec_update in Python, Node.js and PHP, and DomainDNSSEC/DomainDNSSECUpdate in Go. Python read: client.domain_dnssec("example.com"); refresh: client.domain_dnssec_update("example.com", {"action":"refresh"}). Enable/disable use the stable idempotency key argument.
CLI (replace DOMAIN_SERVICE_UUID with your registered domain):
bf domain dnssec show DOMAIN_SERVICE_UUID
bf domain dnssec check DOMAIN_SERVICE_UUID
bf domain dnssec enable DOMAIN_SERVICE_UUID --mode managed --confirm --request-key dnssec-enable-001
bf domain dnssec enable DOMAIN_SERVICE_UUID --mode external --keys-file dnskeys.json --confirm --request-key dnssec-external-001
bf domain dnssec disable DOMAIN_SERVICE_UUID --confirm --request-key dnssec-disable-001External dnskeys.json contains only the public DNSKEY array. These writes require an explicit request key, unlike commands that generate an omitted key.
Local MCP: bf_domain_dnssec and bf_domain_dnssec_check; bf_domain_dnssec_update requires BF_API_MCP_ENABLE_MUTATIONS=1, acknowledge=true and request_key. Hosted MCP has no DNSSEC tool; do not invent one.
Contacts and transfers
Keep registration contacts current and complete required email verification. Lock/privacy availability depends on the TLD. Transfer authorization codes are secrets; retrieve them privately and do not paste them into an AI conversation.
See automation coverage for the available domain tools.