Re-check that proxied records point to NSIN (external DNS)

Content type: application/json

• checkedinteger

  Proxied records looked up.

• okinteger

  Records that resolve to NSIN.

• missinteger

  Records that resolve elsewhere or not at all.

• messagestring

  A one-line summary of the outcome.

• recordsarray of Record
  Item fields

  • idinteger
  • namestring

    Record name relative to the domain. @ is the apex.

  • original_namestring

    The fully-qualified name, with trailing dot.

  • typestring
    One of: "A" "AAAA" "CNAME" "ANAME" "NS" "TXT" "MX" "SRV" "PTR" "CAA" "TLSA" "SSHFP" "URI"
  • destinationstring

    The record's value. For a proxied record this is the origin the edge connects to, and the published DNS answer is the NSIN proxy IP instead — see dns_content.

  • dns_contentstring

    What is actually published in DNS. Equals the proxy IP for proxied records.

  • ttlinteger

    TTL in seconds.

  • proxiedboolean

    Route this hostname through the NSIN edge. Only A, AAAA, CNAME and ANAME may be proxied.

  • captchaboolean

    Challenge visitors before passing them to the origin.

  • editableboolean

    False for records NSIN manages on your behalf.

  • managed_bystring

    The platform feature that owns this record, or empty for a record you created. email_routing marks the MX, SPF and DKIM rows Email Routing publishes; they are removed by disabling routing, never through the record endpoints (which refuse them while locked).

  • user_idinteger
  • domain_idinteger
  • schemestring

    Protocol the edge uses to reach the origin of a proxied record.

    • Https — TLS to port (443 when the port is unset or out of range).
    • Http — plain HTTP to port (80 when unset or out of range).
    • Auto — HTTPS on 443 first, falling back to plain HTTP. The port is always 443.
    • Default — accepted on input, and so are an empty or unrecognised value, but stored as Auto with port 443: a record never reads back as Default.
    One of: "Http" "Https" "Auto" "Default"
  • portinteger

    Origin port for proxied records: 443 for Auto, otherwise as set (default 443 for Https, 80 for Http).

  • host_headerstring

    Overrides the Host header (and SNI) sent to the origin.

  • host_header_modestring

    Which name a proxied CNAME/ANAME sends to its origin as the Host header (and SNI) when host_header is empty: empty — the record's own hostname (the default); target — the hostname it points at.

    One of: "" "target"
  • gateway_preset_idinteger | null

    The gateway this record was created for, or null for a record you made. A gateway record is not editable here; rename or remove it through the gateway endpoints.

  • gateway_allowed_hostsstring

    Gateway records only: a JSON array, as a string, of the other hostnames the gateway's service links to. The edge serves them under /_nsin/<host>/ on the gateway hostname.

  • gateway_rewrite_urlsboolean

    Gateway records only — whether the edge rewrites URLs in responses to go through the gateway.

  • monitorboolean

    Include this record in uptime monitoring.

  • timeoutinteger

    How long an edge node waits for the origin to start responding before returning 504, in seconds. Default 60, maximum 1800 (30 minutes). Only applies to proxied records.

    Default: 60
  • mx_priorityinteger

    Only meaningful for MX.

  • commentstring

    Free-form note.

  • created_atstring (date-time)
  • updated_atstring (date-time)
  • deleted_atstring | null (date-time)

    Always null — deleted records are never returned.

  • edge_statusstring

    External-DNS domains, proxied records only. Whether the name resolves to NSIN's edge, as last checked: ok — every address it resolves to is ours; miss — it resolves elsewhere, only partly to us, or not at all; error — the first lookup failed and nothing is known yet. Absent until the first check, and always absent on a managed-DNS domain.

    One of: "ok" "miss" "error"
  • edge_viastring

    How an ok record reaches NSIN: through the CNAME target (cname), by publishing our address directly (a), or proxy — DNS points at another CDN or proxy, but that service forwards to NSIN and the edge is serving the host (judged from the last 24h of request logs). A CNAME keeps working when our addresses change; an A record does not.

    One of: "cname" "a" "proxy"
  • edge_detailstring

    What the name actually resolves to, for display.

  • edge_checked_atstring (date-time)
• next_manual_check_atstring (date-time)

  When this endpoint accepts the next call for this domain.

{
  "checked": 0,
  "ok": 0,
  "miss": 0,
  "message": "string",
  "records": [
    {
      "id": 0,
      "name": "www",
      "original_name": "www.example.com.",
      "type": "A",
      "destination": "string",
      "dns_content": "string",
      "ttl": 0,
      "proxied": true,
      "captcha": true,
      "editable": true,
      "managed_by": "string",
      "user_id": 0,
      "domain_id": 0,
      "scheme": "Http",
      "port": 0,
      "host_header": "string",
      "host_header_mode": "",
      "gateway_preset_id": 0,
      "gateway_allowed_hosts": "string",
      "gateway_rewrite_urls": true,
      "monitor": true,
      "timeout": 60,
      "mx_priority": 0,
      "comment": "string",
      "created_at": "2026-01-01T00:00:00Z",
      "updated_at": "2026-01-01T00:00:00Z",
      "deleted_at": "2026-01-01T00:00:00Z",
      "edge_status": "ok",
      "edge_via": "cname",
      "edge_detail": "string",
      "edge_checked_at": "2026-01-01T00:00:00Z"
    }
  ],
  "next_manual_check_at": "2026-01-01T00:00:00Z"
}

Content type: application/json

• checkingboolean
  One of: true
• checkManualCheck

  One manual check and its last outcome.

  Fields

  • kindstring

    Which check: ns delegation, txt verification, dv SSL delegation, edge proxied-record reachability, email_dns Email Routing records.

    One of: "ns" "txt" "dv" "edge" "email_dns"
  • statestring

    running — the check is in flight; poll again. done — it completed and ok carries the verdict. error — it could not reach an answer (a resolver was unreachable). An error is never a verdict about the domain's DNS.

    One of: "running" "done" "error"
  • okboolean

    The verdict of a done check.

  • messagestring

    What to show the user.

  • started_atstring (date-time)

    When the check started.

  • finished_atstring (date-time)

    When it finished. Absent while running.

• messagestring

  What to show the user while the check runs.

{
  "checking": true,
  "check": {
    "kind": "ns",
    "state": "running",
    "ok": true,
    "message": "string",
    "started_at": "2026-01-01T00:00:00Z",
    "finished_at": "2026-01-01T00:00:00Z"
  },
  "message": "string"
}

Content type: application/json

• errorstringrequired

  Human-readable description of what went wrong.

• error_codestring
  One of: "managed_dns"

{
  "error": "string",
  "error_code": "managed_dns"
}

Content type: application/json

• errorstringrequired

  Human-readable description of what went wrong.

{
  "error": "invalid API key"
}

Content type: application/json

• errorstringrequired

  Human-readable description of what went wrong.

{
  "error": "read-only API key"
}

Content type: application/json

• errorstring
• retry_after_secondsinteger

{
  "error": "string",
  "retry_after_seconds": 0
}