Feature
Signed webhooks
Record, domain and report changes become events, delivered to the HTTPS endpoints an organization registers, signed with HMAC-SHA256.
Every change writes its deliveries in the same database transaction as the change, so a change is never saved without its deliveries, and a failure to queue them rolls the change back.
Each delivery is signed in the X-DNS-Signature header over the timestamp and the raw body, with the webhook’s signing secret (prefix whsec_). Signing secrets are encrypted at rest under a key-encryption key that can be rotated.
Deliveries go only to public addresses, are retried with backoff and are dead-lettered after five failed attempts. Without the include-content opt-in, a delivery carries metadata only.
More features
All features →- 01
Records and domains
A, CNAME, TXT and SRV records under the domains an organization registers, managed in the dashboard or through the API.
- 02
chmod-style permissions
A 9-bit mode on every record and domain: view, edit and delete for the record owner, the organization and everyone else.
- 03
Public directory
An anonymous, searchable listing of published records and domains, through a strict field allowlist.