Search... ⌘ K
Get Started Contact Sales

Troubleshoot Integrated DNS Providers

Table of Contents

Most problems with Integrated DNS Providers come from the direction of a sync, changes made outside DNSimple, or record types that one provider does not support. Find your symptom below. For how the feature works, see What Are Integrated DNS Providers and Why Use Them?.

Connecting a provider fails

If DNSimple cannot reach the provider with the details you entered, the connection is not saved, and DNSimple shows an error such as:

Could not link provider to the account. AWS production (Route53): There was an error retrieving zones in AWS: Could not get hosted zones. Please review your AWS permissions: The security token included in the request is invalid.

The text after “Please review your AWS permissions” or “Please review your Azure permissions” comes from the provider and names the problem.

  • Invalid token or key: check that you copied the access key ID and secret access key, or the Azure client ID and client secret, without extra spaces, and that the key is still active.
  • Access denied: the AWS user or Azure app registration is missing a permission. Compare it with the prerequisites for Route 53 or Azure DNS.

If connecting works but adding, changing, or deleting records later fails with “Could not change zone records”, “Could not create hosted zone”, or “Could not delete hosted zone”, the credentials are valid but lack that specific permission.

A sync deleted records I needed

A sync makes the destination match the source for record types both providers support. Records of those types at the destination that are not at the source are deleted. Record types the source does not support, such as ALIAS records at DNSimple, stay as they are. If you synced in the wrong direction, for example from Route 53 to DNSimple when DNSimple had the complete set, the shared DNSimple records that were missing at Route 53 are gone.

The deleted records are not listed one by one in the activity log, so you may not be able to rebuild them from it. Contact support as soon as possible, and tell us the domain and roughly when you synced.

To avoid this, before every sync:

  1. Import the records from the provider, so the Record Editor shows the current records at both providers.
  2. Compare the records labeled with each provider.
  3. Choose the provider with the records you want to keep as the .

Changes made at Route 53 or Azure DNS do not show in DNSimple

DNSimple does not watch your providers for changes, and there is no automatic or API-triggered sync. When you change records directly at Route 53 or Azure DNS:

  1. Import the records to update DNSimple’s view of the provider.
  2. If you want the changes in the DNSimple zone too, sync with that provider as the source.

To keep both providers in step without manual work, make changes in DNSimple and select every provider when you add or edit a record. If your other provider supports zone transfers, Secondary DNS can copy changes automatically instead. Azure DNS does not support zone transfers.

There is no button to sync

The Record Editor shows the button only inside the warning. If the warning is not there, the providers already have the same records. If you changed records at the provider, import them first, and the warning appears if they differ.

CoreDNS never appears in the sync dialog. It loads the zone from DNSimple on its own, as in CoreDNS is not serving the zone.

A record is missing at the provider

Each provider supports a different set of record types, and a sync leaves out types the destination does not support:

  • ALIAS and POOL records exist only at DNSimple. Route 53 and Azure DNS do not receive them. Both point at hostnames, not IP addresses. To serve a similar answer there, add A or AAAA records for the addresses those hostnames currently resolve to.
  • URL records are written to Route 53 and Azure DNS as an A record that points to the DNSimple redirector.
  • SSHFP, SVCB, and HTTPS records are supported by Route 53 but not by Azure DNS.

Each provider’s reference lists its record types: Route 53, Azure DNS, CoreDNS.

Both providers answer DNS for the domain

If the domain’s name servers include both DNSimple and Route 53 (or Azure DNS), resolvers may ask either one, so both must have the same records. The Record Editor shows when they differ. Sync them, and remember that ALIAS, POOL, and URL records are not served the same way by every provider.

DNSSEC does not work while two providers answer for the domain. To use DNSSEC, point the name servers to only one provider, and enable DNSSEC there.

If you meant to move DNS to one provider instead, change the name servers to that provider only.

A zone is still in DNSimple after I deleted it at the provider

Deleting a zone at Route 53 or Azure DNS, or disconnecting the provider, does not delete the domain from your DNSimple account. DNSimple keeps it so you can go on managing it here. If you no longer need it, delete the domain in DNSimple.

CoreDNS is not serving the zone

  • Check that the zone is added to CoreDNS in DNSimple: the domain’s card lists CoreDNS under .
  • Check the Corefile: account_id must be the account that has the zone, and identifier must match the you entered. Without a matching identifier, DNSimple does not show the cluster’s status.
  • Check the API token in DNSIMPLE_TOKEN. A scoped token needs set to Read-only and set to Full access.
  • Changes reach CoreDNS on its refresh interval, 1 minute by default.

How to Use CoreDNS as an Integrated DNS Provider walks through a working setup.

Cloudflare or Gandi only offers a waitlist

Cloudflare and Gandi are listed on the page, but they are not available yet. Their button only lets you leave your email address to register your interest. To use Cloudflare with a domain at DNSimple today, see Use Cloudflare with DNSimple.

Zones are in more than one AWS account

You can connect several AWS accounts to one DNSimple account. Connect each one with its own , and choose the right connection when you add a zone. A zone belongs to one connection, so all of its records go to the same AWS account. If you need one domain’s records split across AWS accounts, contact support to talk through the options.

Have more questions?

If you have any questions about Integrated DNS Providers, contact support, and we will be happy to help. You can also read more about DNSimple integrations.