Skip to content
Manipulate DNS records on various DNS providers in a standardized way.
Python Other
  1. Python 99.1%
  2. Other 0.9%
Branch: master
Clone or download

Latest commit

AnalogJ Delete config.yml
delete circleci integration. no longer necessary.
Latest commit 57a90f2 Jun 2, 2020


Type Name Latest commit message Commit time
Failed to load latest commit information.
.pytest_cache Clean Oct 17, 2018
examples remove hetzner special handling from (#505) May 6, 2020
lexicon Fixed create and update operations for GoDaddy if CAA records are pre… Jun 1, 2020
tests Fixed create and update operations for GoDaddy if CAA records are pre… Jun 1, 2020
.gitignore Adding a new hetzner provider compatible with (#492) May 3, 2020
.pylintrc Disable code duplication detection, not really relevant for lexicon w… Nov 19, 2018 Update changelog Jun 1, 2020
CODEOWNERS Add initial support for UltraDNS provider Jun 1, 2020 Correct path to vcrpy recordings in docs Mar 22, 2020
Dockerfile was renamed to dehydrated. Oct 8, 2016
LICENSE Initial commit Feb 2, 2016 added VERSION file not as its better for thrid party tool… Feb 17, 2016 Add initial support for UltraDNS provider Jun 1, 2020 Update May 12, 2018
VERSION (v3.3.24) Automated packaging of release by Packagr Jun 1, 2020
appveyor.yml Set up CI with Azure Pipelines (#431) Oct 22, 2019
azure-pipelines.yml Test lowest and highest supported python versions. Move mostly to 3.x ( May 5, 2020
lexicon.1 Adds man page Oct 19, 2018
logo.svg adding logo from nounproject, and added reference in the license sect… Jul 12, 2018
packagr.yml Rename capsule.yml to packagr.yml Nov 24, 2019
pytest.ini Add marker May 5, 2020
setup.cfg add pip package requirements. Feb 5, 2016 Remove additional dependencies for Hetzner. (#502) May 6, 2020
tox.ini Bump pylint to 2.4.3 (#451) Oct 23, 2019



Manipulate DNS records on various DNS providers in a standardized/agnostic way.

Build Status Coverage Status Docker Pulls PyPI PyPI GitHub license


Lexicon provides a way to manipulate DNS records on multiple DNS providers in a standardized way. Lexicon has a CLI but it can also be used as a python library.

Lexicon was designed to be used in automation, specifically letsencrypt.


Only DNS providers who have an API can be supported by lexicon.

The current supported providers are:

Potential providers are as follows. If you would like to contribute one, follow the and then open a pull request.

  • AHNames (docs)
  • DurableDNS (docs) Can't set TXT records
  • Dyn (docs) 💵 requires paid account
  • Dynu
  • EntryDNS (docs) 💵 requires paid account
  • FreeDNS (docs)
  • Host Virtual DNS (docs) 💵 requires paid account
  • HostEurope
  • Infoblox NIOS
  • ironDNS (docs) 💵 requires paid account
  • ISPConfig
  • InternetX autoDNS (docs)
  • Knot DNS
  • KingHost
  • Liquidweb (docs) 💵 requires paid account
  • Loopia (docs) 💵 requires paid account
  • Mythic Beasts(docs)
  • NFSN (NearlyFreeSpeech) (docs) 💵 requires paid account
  • RFC2136 (docs)
  • Servercow (docs)
  • TELE3 (docs)
  • UltraDNS (docs) 💵 requires paid account
  • UnoEuro API
  • WorldWideDns (docs) 💵 requires paid account
  • Zerigo (docs) 💵 requires paid account
  • Zoneedit (docs)
  • Any others I missed


Warning: it is strongly advised with pip to install Lexicon in a Python virtual environment, in order to avoid interference between Python modules preinstalled on your system as OS packages and modules installed by pip (see

To use lexicon as a CLI application, do the following:

pip install dns-lexicon

Some providers (like Route53 and TransIP) require additional dependencies. You can install provider specific dependencies separately:

pip install dns-lexicon[route53]

To install lexicon with the additional dependencies of every provider, do the following:

pip install dns-lexicon[full]

You can also install the latest version from the repository directly.

pip install git+

and with Route 53 provider dependencies:

pip install git+[route53]

As an alternative you can also install Lexicon using the OS packages available for major Linux distributions (see lexicon or dns-lexicon package in


$ lexicon -h
  usage: lexicon [-h] [--version] [--delegated DELEGATED]

  Create, Update, Delete, List DNS entries

  positional arguments:
                          specify the DNS provider to use
      cloudflare          cloudflare provider
      cloudxns            cloudxns provider
      digitalocean        digitalocean provider
      rage4               rage4 provider
      route53             route53 provider
      vultr               vultr provider
      yandex              yandex provider
      zonomi              zonomi provider

  optional arguments:
    -h, --help            show this help message and exit
    --version             show the current version of lexicon
    --delegated DELEGATED
                          specify the delegated domain

  $ lexicon cloudflare -h
  usage: lexicon cloudflare [-h] [--name NAME] [--content CONTENT] [--ttl TTL]
                            [--priority PRIORITY] [--identifier IDENTIFIER]
                            [--auth-username AUTH_USERNAME]
                            [--auth-token AUTH_TOKEN]
                            {create,list,update,delete} domain

  positional arguments:
                          specify the action to take
    domain                specify the domain, supports subdomains as well
                          specify the entry type

  optional arguments:
    -h, --help            show this help message and exit
    --name NAME           specify the record name
    --content CONTENT     specify the record content
    --ttl TTL             specify the record time-to-live
    --priority PRIORITY   specify the record priority
    --identifier IDENTIFIER
                          specify the record for update or delete actions
    --auth-username AUTH_USERNAME
                          specify email address used to authenticate
    --auth-token AUTH_TOKEN
                          specify token used authenticate

Using the lexicon CLI is pretty simple:

# setup provider environmental variables:
export LEXICON_CLOUDFLARE_TOKEN="cloudflare-api-token"

# list all TXT records on cloudflare
lexicon cloudflare list TXT

# create a new TXT record on cloudflare
lexicon cloudflare create TXT --name="" --content="challenge token"

# delete a  TXT record on cloudflare
lexicon cloudflare delete TXT --name="" --content="challenge token"
lexicon cloudflare delete TXT --identifier="cloudflare record id"


Most supported DNS services provide an API token, however each service implements authentication differently. Lexicon attempts to standardize authentication around the following CLI flags:

  • --auth-username - For DNS services that require it, this is usually the account id or email address
  • --auth-password - For DNS services that do not provide an API token, this is usually the account password
  • --auth-token - This is the most common auth method, the API token provided by the DNS service

You can see all the --auth-* flags for a specific service by reading the DNS service specific help: lexicon cloudflare -h

Environmental Variables


Instead of providing Authentication information via the CLI, you can also specify them via Environmental Variables. Every DNS service and auth flag maps to an Environmental Variable as follows: LEXICON_{DNS Provider Name}_{Auth Type}

So instead of specifying --auth-username and --auth-token flags when calling lexicon cloudflare ..., you could instead set the LEXICON_CLOUDFLARE_USERNAME and LEXICON_CLOUDFLARE_TOKEN environmental variables.

If you've got a subdomain delegation configured and need records configured within that (eg, you're trying to set where is configured as a separate zone), set LEXICON_DELEGATED to the delegated domain.

TLD Cache

The tldextract library is used by Lexicon to find the actual domain name from the provided FQDN (eg. is the actual domain in Lexicon stores tldextract cache by default in ~/.lexicon_tld_set where ~ is the current user's home directory. You can change this path using the LEXICON_TLDEXTRACT_CACHE environment variable.

For instance, to store tldextract cache in /my/path/to/tld_cache, you can invoke Lexicon like this from a Linux shell:

LEXICON_TLDEXTRACT_CACHE=/my/path/to/tld_cache lexicon myprovider create TXT ...

Letsencrypt Instructions

Lexicon has an example dehydrated hook file that you can use for any supported provider. All you need to do is set the PROVIDER env variable.

PROVIDER=cloudflare dehydrated --cron --hook --challenge dns-01

Lexicon can also be used with Certbot and the included Certbot hook file (requires configuration).

TroubleShooting & Useful Tools

There is an included example Dockerfile that can be used to automatically generate certificates for your website.

ToDo list

  • Create and Register a lexicon pip package.
  • Write documentation on supported environmental variables.
  • Wire up automated release packaging on PRs.
  • Check for additional dns hosts with apis (from fog, dnsperf, libcloud)
  • Get a list of Letsencrypt clients, and create hook files for them (letsencrypt clients)

Contributing Changes.

If the DNS provider you use is not already available, please consider contributing by opening a pull request and following the



You can’t perform that action at this time.