Connect a Porkbun domain in one click, without API keys

Porkbun offers two ways for software to change a domain's DNS. Its API authenticates with an API key and a secret API key that the domain owner creates in their Porkbun account; keys can be limited to source IPs, domains and permissions, and they unlock full create, read, update and delete over DNS records. DNS Connect is the other way: a service sends a signed request for one domain and one set of records, the customer approves it on Porkbun, and in Porkbun's words the service gets "no standing access".

For a product that connects customer domains, the second column is the one you want to explain to a security reviewer. It is also less to build: DoDomain holds the approved DNS Connect client, so your product does not apply to Porkbun or sign anything itself.

Nothing about the session is Porkbun-specific. Send the records your product needs; DoDomain detects Porkbun from the domain's nameservers when the customer opens the link:

curl -X POST https://app.dodomain.io/api/v1/sessions \
  -H "Authorization: Bearer dd_sk_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "customer.com",
    "records": [
      { "type": "CNAME", "host": "app", "value": "edge.yourproduct.com" },
      { "type": "TXT", "host": "_dodomain-challenge.app", "value": "dodomain-verify=7f3a9c" }
    ],
    "returnUrl": "https://yourproduct.com/settings/domains"
  }'

This shape (a CNAME on a subdomain plus the _dodomain-challenge ownership TXT under the same host, value starting dodomain-verify=) is worth keeping even though Porkbun would accept other names: it is also the shape that gets one click at Domain Connect providers such as GoDaddy, so one session works for both (see connecting a GoDaddy domain). The getting started guide covers the keys, the SDKs and the webhook, and Multi-record and email records how SPF, DKIM and DMARC are verified.

1. DoDomain builds a request naming the domain, your records, a return address and a random single-use state, and signs it (HS256) with its Porkbun client secret. It is valid for 30 minutes at most, and never past the session's own expiry. Record names are made relative to the registrable domain, so a session on app.customer.co.uk cannot touch the bare customer.co.uk by accident.
2. The customer lands on Porkbun, signs in with their own Porkbun account (two-factor step included), and sees the records to be added or removed, with warnings for risky changes. Approve stays disabled until they tick the confirmation box. Conflicts are settled on that screen; an existing SPF record gets your include merged in rather than a second SPF record, and the customer's own all policy is kept.
3. Porkbun writes the records and sends the customer back with a status. DoDomain accepts the return only once, for the state it issued, before it expires.
4. The status is not taken as proof. DoDomain reads every record from the domain's authoritative nameservers and runs its normal verification; only then is the session verified and your connection.verified webhook sent. If Porkbun's change is not visible yet, the page says DNS is still updating and keeps checking.

• At most 25 records per request, Porkbun's limit. DoDomain sends A, AAAA, CNAME, TXT, MX; an MX record must carry its priority.
• The button appears on the Pro and Scale plans. Sessions created on the Free plan show the guided manual steps (pricing).
• What counts is the domain's nameservers. A domain registered at Porkbun whose DNS is hosted elsewhere follows that host's path.
• Porkbun can answer partial (some records failed), denied, or an error: the domain is not in the Porkbun account the customer signed in to, it is not active, or Porkbun refused the records. Each gets its own message on the connect page, the records stay listed for manual setup, and the customer can try again.

The manual path shows Porkbun's own panel steps beside each record (subdomain only in Host, Host left blank for the bare domain, and delete Porkbun's default ALIAS or CNAME at a host before adding yours). They are published as the Porkbun CNAME and A record setup guide for your own support pages.

No card, no sales call: create an app, mint a session, and watch the first domain verify.

Porkbun pages retrieved 2026-11-12. Porkbun revises its guides; check the page before relying on a limit. DoDomain is not affiliated with Porkbun.

1. Porkbun, Connect a service to Porkbun DNS. What DNS Connect is, how a service is approved, the signed request and its limits, the review page, the undo link and the callback statuses.
2. Porkbun, Porkbun API documentation. How API keys work (a key plus a secret key, created in the account, scoped by IP, domain and permission) and the DNS record operations they unlock.
3. Porkbun, How to edit DNS records. Porkbun's own panel steps for the manual path, as the DoDomain Porkbun setup guide repeats them.