[dns-operations] Hybrid DNS

[John Levine]

In article <CAAiTEH-stD=7CFJfQy8oHpB--NTeT251ibZ=CeVH2ReAOecUYg at mail.gmail.com>,
Matthew Pounsett <matt at conundrum.com> wrote:
>On 9 September 2018 at 16:52, Mark E. Jeftovic <markjr at easydns.com> wrote:
>
>In order to do this, you have to either be the registrar for the domain, or
>> have API access to the registrar that provides a method to update
>> nameserver delegation. The only other registrar I've ever found that
>> provides a method to update nameservers via API was DNSimple (there may be
>> more now).
>
>Gandi has a registrant-accessible API for managing pretty much every aspect
>of the domain lifecycle (including DNSSEC).

I believe it, but I don't want to have to get the password for
complete control of my users' domain just to install some DS records.

Provisioning DNSSEC isn't too bad when all the pieces are under the
same management.  But often it isn't, and then things work very badly.