Porkbun domains and DNS, as code.

The providers

Both are on the Terraform Registry and the OpenTofu registry, and both are maintained by independent developers, not by Porkbun. File provider bugs on their GitHub repositories.

Mind the secret key's variable name: it differs between the two, and copying one provider's setup into the other is the usual cause of an authentication error. They also name the MX and SRV priority differently (priority in jianyuan/porkbun, prio in marcfrederick/porkbun).

Set it up

1. Create an API key at porkbun.com/account/api. For a pipeline that only manages DNS, give the key just the dns permission (plus read) and limit it to the domains and source IPs it needs.
2. Turn on API access for those domains. It is opt-in per domain in Domain Management (one at a time or in bulk) unless the account has it on for every domain.
3. Export the keys: export PORKBUN_API_KEY=pk1_... and the secret under your provider's variable name.
4. Write the config, then terraform plan and terraform apply (or tofu):

terraform {
  required_providers {
    porkbun = {
      source = "jianyuan/porkbun"
    }
  }
}

# Reads PORKBUN_API_KEY and PORKBUN_SECRET_KEY from the environment.
provider "porkbun" {}

resource "porkbun_dns_record" "apex" {
  domain  = "example.com"
  type    = "A"
  content = "203.0.113.10"
}

resource "porkbun_dns_record" "www" {
  domain    = "example.com"
  subdomain = "www"
  type      = "CNAME"
  content   = "example.com"
}

resource "porkbun_dns_record" "mail" {
  domain   = "example.com"
  type     = "MX"
  content  = "mx1.example.net"
  priority = 10
}

Already have records? Bring them under management with an import block instead of recreating them. jianyuan/porkbun's record IDs are <record id>_<domain>_<type>; the record ID is in the API's /dns/retrieve response.

import {
  to = porkbun_dns_record.www
  id = "123456789_example.com_CNAME"
}

Test it without touching anything real

A Porkbun sandbox key, which starts pk1_sb_, uses the same API address as a live key, so any provider works with one unchanged. Every DNS, nameserver and registration call then runs against an isolated environment with fake credit: no real records change and nothing is charged. Get one at porkbun.com/account/api, or instantly with no account by sending {"sandbox": true} to /apikey/request (details).

With live keys, the account's guardrails still apply to Terraform: the monthly API spend limit, low-balance alerts, and per-key domain, IP and permission limits.

Registrations are permanent. terraform destroy on a porkbun_domain only drops it from state, because no API can undo a registration; the domain stays yours until it expires. Use max_cost and prevent_destroy.

Other DNS-as-code and certificate tools

Not on Terraform? These manage Porkbun DNS directly.

Prefer an official provider for the zone itself? Keep the registration at Porkbun and point the nameservers at any DNS host, or move the zone into your own Cloudflare account with Cloudflare connect and manage it with Cloudflare's provider.

Questions