schakl.
All integrations

Domains & DNS Available

OXXA

A domain record knows what public DNS answers. It does not know when the domain expires, whether the transfer lock is off, what the registry has actually delegated, or who the registrant is. Those four facts come from here.

What you need

  • An OXXA reseller login: an API user and an API password. The MD5 password form is deliberately not supported, because there the digest itself is the credential.
  • The oxxa module switched on under Instellingen → Modules (Settings → Modules), and licence cover via Instellingen → Licentie (Settings → Licence). Without cover, reads keep working (the fetched register, expiry dates, the status report), so a lapsed key never hides that a client's domain is running out.
  • The permissions oxxa.settings.manage, oxxa.registrar.sync and oxxa.registrar.manage, granted in Instellingen → Rollen (Settings → Roles). All three are admin-only by default.
  • No webhook and no callback URL. Traffic is outbound only, from the API container to api.oxxa.com; nothing is configured on OXXA's side.
  • Half an hour to walk the first sync. What comes back is OXXA's register, not yours: the first run lays what you renew beside what schakl. knows, and at nearly every agency those two lists differ.

How to connect it

  1. 1 Switch the module on under Instellingen → Modules (Settings → Modules) and hand out the permissions in Instellingen → Rollen (Settings → Roles): oxxa.settings.manage, oxxa.registrar.sync and oxxa.registrar.manage. The last one is the only permission here that changes anything outside schakl.
  2. 2 Add the login under Instellingen → OXXA → Account toevoegen (Add account). Fill in Naam (Name), API-gebruiker (API user) and API-wachtwoord (API password), optionally link a Leveranciersregel (supplier row) and tick In gebruik (In use). The password is never played back; leave the field empty to keep the stored one.
  3. 3 Press Inloggegevens controleren (Check credentials). This fetches your Saldo (balance) and the permitted Extensies (TLDs), and it is mandatory: without that suffix list schakl. cannot split a name into sld and tld and refuses every action. Rotating the password later clears the list, the balance and the verified badge, so a stale badge can never speak for a password nobody has tested.
  4. 4 Press Register ophalen (Fetch register). The result line reads how many domains were pulled, how many matched a domain in schakl. and how many did not. One sync is a single domain_list call plus one lookup per distinct nameserver group, whatever the register's size.
  5. 5 Work the OXXA-register table with the Alleen niet-gekoppelde (Unlinked only) filter. Those are the domains you renew that schakl. has no record of, and usually the most valuable output of the first sync.
  6. 6 Look at one domain: Domeinen → the domain → Registrar (OXXA) panel. It carries Verloopt (expires), Houder (registrant), Verhuisslot (transfer lock), Automatisch verlengen (autorenew), DNSSEC, Nameservergroep (nameserver group) and Nameservers. Controleren bij OXXA (Check at OXXA) re-reads that one domain; only that call fetches DNSSEC and the registrant's name, because register-wide it would cost one request per contact handle.
  7. 7 Move a delegation under Nameservers wijzigen bij OXXA (Change nameservers at OXXA): two to six nameservers, or press Nameservers van Cloudflare gebruiken (Use Cloudflare's nameservers) to take the assigned pair straight from the panel above. Then Versturen naar OXXA (Send to OXXA). If the delegation was already right, you are told nothing changed.

The Cloudflare hand-off is two buttons, on purpose

First Koppelen aan Cloudflare in the panel above: that adopts or creates the zone and stores the nameservers Cloudflare assigns. Then the push here. There is deliberately no single button firing both. You see exactly what will be pushed before it leaves, each leg reports its own outcome, and a failed second leg leaves a finished first leg rather than an ambiguous half-success. After the push, Publieke DNS antwoordt nog met andere nameservers dan het register heeft (public DNS still answers with different nameservers than the register holds) is the normal state for minutes to hours; it is not a failure.

Nameserver groups are shared objects, and that is the trap

OXXA has no per-domain nameserver list: it works with groups, and OXXA's own documentation says an edit to a group is applied to every domain using that profile. So schakl. finds or creates a group named schakl- followed by a hash of exactly that nameserver set, and never, under any circumstance, edits an existing one. Two consequences. Cloudflare assigns a different pair per zone, so expect roughly one schakl- group per connected domain; the groups accumulate and are never cleaned up, because deleting is the dangerous direction. And if a schakl- group already exists holding different nameservers, somebody edited it by hand and the push is refused outright: reusing it would repoint every other domain in it. No retry fixes that; you fix it in OXXA's portal.

Three nameserver facts, and they are not the same thing

What public DNS answers, what the registry has delegated and what we asked for are three separate facts. They are stored separately and shown separately, because conflating any two produces warnings that mean nothing: for almost every domain nothing was ever pushed, and never pushed is not drift. Drift is reported, never auto-resolved. The same holds for the panel's warnings: they tell you what is going on and leave the decision with you.

  • Expires within 60 days, or has expired already
  • Transfer lock off, or autorenew off
  • Public DNS does not answer what the register says yet (raised only when the lookup actually answered)

Permissions

Grant these to the role that manages this integration (Settings → Roles). Admin-only by default, and never to the client role.

  • oxxa.settings.manage Add a reseller login, rotate, verify or delete its password. This permission is also what opens Instellingen → OXXA.
  • oxxa.registrar.sync Run a register sync, read the stored register, read one domain's registrar status, refresh that domain and use the account picker. Deliberately not enough to open the settings screen: acting through a credential and replacing it are different acts.
  • oxxa.registrar.manage Push a domain's nameservers to OXXA. That is the only action here that changes the outside world. All three permissions are admin-only by default and are never granted to the seeded client role.

What it deliberately does not do

  • A green settings screen proves your reseller login is right and nothing more. After connecting, walk the fetched register once against what you see at OXXA itself; that is the check that counts.
  • There is no background sync. Register ophalen is a button. A register changes slowly, and a cron writing rows nobody asked for would turn a parsing bug into a silent data problem across the whole register instead of a visible failure on the screen of the person who pressed it.
  • No register, transfer or renew, and no availability search. The first three spend money and are irreversible; the last is the one command with a published daily quota.
  • DNSSEC and the registrant are read, never written. A reseller's contact handle is shared across dozens or hundreds of domains, so one edit would rewrite the WHOIS of that whole cohort.
  • The registrant is shown beside your own record, but nothing is compared and there is no mismatch warning. Turning Jansen Beheer B.V. into a party row stays a human act.
  • There is one registrar implementation. The seam for a second exists in the code, but exactly one is registered today. There is no company-page panel either: a registrar is not a place you go, it is something a domain has.

Where to find it Instellingen → OXXA (Settings → OXXA) for the reseller login and the fetched register, plus the Registrar (OXXA) panel on Domeinen → the domain (Domains).

Read the guide

More in this category

Cloudflare

Other integrations

Mollie Stripe Adyen Exact Online SnelStart WordPress