Use a token created in the current Hetzner Console project for the Hetzner DNS connection. Tokens from the old standalone DNS Console are not valid credentials for the Cloud API. Migrating the zone and migrating its automation credentials are separate tasks.
IN THIS ARTICLE
01 Prepare the project
In Hetzner Console, select the project containing the intended DNS zones and create an API token with the access required for DNS management. A read-only token can inspect resources but cannot apply customer edits. Project placement determines the scope of resources that this credential can reach.
Inventory existing zones and any protection settings before replacing an older connection. Hetzner supports zone deletion protection and record-set change protection, which can intentionally block a requested operation. Preserve those protections until the owner has reviewed the relevant change.
02 Configure Domain Nexus
- Add or edit the server connection and choose Hetzner DNS (Hetzner Cloud API).
- Paste the current project credential into Hetzner Console API token.
- Leave API URL at the Cloud API default supplied by this build. Do not point it at the old standalone DNS API or a browser-console URL.
- Review Default zone TTL, then save and run the check.
- Read an owned zone and its record sets. Apply one temporary TXT change, wait for the provider operation and read the final state.
Common questions
Why does the same domain appear missing after migration?
Check the project selected for the new token and the actual location of the migrated zone. Do not create a second zone until you have confirmed the intended provider resource and its ownership.
Why is an edit or deletion rejected?
Inspect token access, project scope and protection on the zone or record set. A provider action that is still pending also needs its final result checked. Removing protection is a deliberate administrative decision, not a routine retry step.
The current Domain Nexus adapter does not advertise a Hetzner signing-key workflow. Use the capabilities shown by the installed build and do not infer DNSSEC management support merely from the presence of DS as a record type.
Related articles
- Move managed zones to another DNS provider with a verified rollback point
- Choose among the DNS providers supported by Domain Nexus
- Resolve DNS drift and changes with an unknown provider outcome
- Run a controlled DNS provider acceptance check before assigning customer packages
- Connect DNSPod using its ID and token credential format