Export the zone as a BIND master file

GET

/domains/{domain}/records/export

const url = 'https://api.nsin.ir/domains/example.com/records/export';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.nsin.ir/domains/example.com/records/export \
  --header 'Authorization: Bearer <token>'

Renders the domain’s records as a standard BIND zone file, served as a download (text/plain, Content-Disposition: attachment).

For a proxied record the file carries the origin the edge connects to, not the NSIN proxy IP that public DNS answers with — the export is the zone as you configured it, so it stays usable if you restore it anywhere else. Proxy state is preserved out of band, in a trailing ; nsin-proxied:true comment that the import endpoints read back. An apex alias (ANAME) is written as a CNAME plus an ; nsin-aname:true marker, because ANAME is not a real DNS type and stops most parsers. A row whose rdata is not valid presentation form is emitted as a ; SKIPPED comment rather than dropped silently.

The SOA is synthesized — PowerDNS owns the live one — and its serial is derived from the records’ last-modified time, so exporting unchanged data twice produces a byte-identical file. The NS set is written only while NSIN is authoritative for the domain; for a domain on external DNS the file carries no delegation, so it will not point the zone back at us if you feed it to another provider.

Record comments are never included. Read-only: requires domain.view, and unlike the write endpoints it stays available while the domain is suspended or expired.

Authorizations

bearerAuth
apiKeyAuth

Parameters

Path Parameters

domain

required

string

The domain name (for example example.com) — not a numeric id.

Example

example.com

Responses

200

Zone file.

text/plain

string

Example

; BIND zone file exported from Nsin for example.com
; Generated 2026-08-31T09:00:00Z
$ORIGIN example.com.
$TTL 3600
example.com.  3600  IN  SOA  ny.nsin.ir. hostmaster.example.com. 2026083101 10800 3600 604800 3600
example.com.  3600  IN  NS  ny.nsin.ir.
example.com.  3600  IN  NS  th.nsin.ir.

example.com.  3600  IN  MX  10 mail.example.net.
blog.example.com.  300  IN  CNAME  hosted.example.net.
www.example.com.  120  IN  A  203.0.113.10  ; nsin-proxied:true

401

Missing, malformed, revoked or expired API key — or the owning account is inactive.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

invalidKey

{
  "error": "invalid API key"
}

403

The key is read-only, your role on the domain lacks the required permission, or the domain’s plan does not include the feature.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

404

No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

429

The key exceeded its request budget (300 requests per minute by default).

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

limited

{
  "error": "rate limit exceeded"
}