diff --git a/src/dns/caas.js b/src/dns/caas.js
index 15ee955a8..09e406a91 100644
--- a/src/dns/caas.js
+++ b/src/dns/caas.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -34,6 +35,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.token === domains.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
+}
+
 function upsert(domainObject, location, type, values, callback) {
     assert.strictEqual(typeof domainObject, 'object');
     assert.strictEqual(typeof location, 'string');
diff --git a/src/dns/cloudflare.js b/src/dns/cloudflare.js
index 886fbdfa8..194f86ddc 100644
--- a/src/dns/cloudflare.js
+++ b/src/dns/cloudflare.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -28,6 +29,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.token === domains.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
+}
+
 function translateRequestError(result, callback) {
     assert.strictEqual(typeof result, 'object');
     assert.strictEqual(typeof callback, 'function');
diff --git a/src/dns/digitalocean.js b/src/dns/digitalocean.js
index bc0a93863..94421e6cb 100644
--- a/src/dns/digitalocean.js
+++ b/src/dns/digitalocean.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -31,6 +32,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.token === domains.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
+}
+
 function getInternal(dnsConfig, zoneName, name, type, callback) {
     assert.strictEqual(typeof dnsConfig, 'object');
     assert.strictEqual(typeof zoneName, 'string');
diff --git a/src/dns/gandi.js b/src/dns/gandi.js
index 9f97697bb..d96f30900 100644
--- a/src/dns/gandi.js
+++ b/src/dns/gandi.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -29,6 +30,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.token === domains.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
+}
+
 function upsert(domainObject, location, type, values, callback) {
     assert.strictEqual(typeof domainObject, 'object');
     assert.strictEqual(typeof location, 'string');
diff --git a/src/dns/gcdns.js b/src/dns/gcdns.js
index e325c703f..424a7b77e 100644
--- a/src/dns/gcdns.js
+++ b/src/dns/gcdns.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -24,6 +25,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.credentials.private_key === domains.SECRET_PLACEHOLDER && currentConfig.credentials) newConfig.credentials.private_key = currentConfig.credentials.private_key;
+}
+
 function getDnsCredentials(dnsConfig) {
     assert.strictEqual(typeof dnsConfig, 'object');
 
diff --git a/src/dns/godaddy.js b/src/dns/godaddy.js
index d00fc2e82..5794c56d8 100644
--- a/src/dns/godaddy.js
+++ b/src/dns/godaddy.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -35,6 +36,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.apiSecret === domains.SECRET_PLACEHOLDER) newConfig.apiSecret = currentConfig.apiSecret;
+}
+
 function upsert(domainObject, location, type, values, callback) {
     assert.strictEqual(typeof domainObject, 'object');
     assert.strictEqual(typeof location, 'string');
diff --git a/src/dns/interface.js b/src/dns/interface.js
index c332489aa..94841eb9e 100644
--- a/src/dns/interface.js
+++ b/src/dns/interface.js
@@ -8,6 +8,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -23,6 +24,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    // in-place injection of tokens and api keys which came in with domains.SECRET_PLACEHOLDER
+}
+
 function upsert(domainObject, location, type, values, callback) {
     assert.strictEqual(typeof domainObject, 'object');
     assert.strictEqual(typeof location, 'string');
diff --git a/src/dns/manual.js b/src/dns/manual.js
index 850056e79..081a2e46a 100644
--- a/src/dns/manual.js
+++ b/src/dns/manual.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -21,6 +22,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+
+}
+
 function upsert(domainObject, location, type, values, callback) {
     assert.strictEqual(typeof domainObject, 'object');
     assert.strictEqual(typeof location, 'string');
diff --git a/src/dns/namecheap.js b/src/dns/namecheap.js
index bd4160c4f..3ff8e4193 100644
--- a/src/dns/namecheap.js
+++ b/src/dns/namecheap.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -28,6 +29,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.token === domains.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
+}
+
 // Only send required fields - https://www.namecheap.com/support/api/methods/domains-dns/set-hosts.aspx
 function mapHosts(hosts) {
     return hosts.map(function (host) {
diff --git a/src/dns/namecom.js b/src/dns/namecom.js
index 788c1994c..1a9bf6422 100644
--- a/src/dns/namecom.js
+++ b/src/dns/namecom.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -30,6 +31,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.token === domains.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
+}
+
 function addRecord(dnsConfig, zoneName, name, type, values, callback) {
     assert.strictEqual(typeof dnsConfig, 'object');
     assert.strictEqual(typeof zoneName, 'string');
diff --git a/src/dns/noop.js b/src/dns/noop.js
index 8f30ad337..639541797 100644
--- a/src/dns/noop.js
+++ b/src/dns/noop.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -17,6 +18,9 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+}
+
 function upsert(domainObject, location, type, values, callback) {
     assert.strictEqual(typeof domainObject, 'object');
     assert.strictEqual(typeof location, 'string');
diff --git a/src/dns/route53.js b/src/dns/route53.js
index 815e91f38..0497adeb7 100644
--- a/src/dns/route53.js
+++ b/src/dns/route53.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -24,6 +25,10 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.secretAccessKey === domains.SECRET_PLACEHOLDER) newConfig.secretAccessKey = currentConfig.secretAccessKey;
+}
+
 function getDnsCredentials(dnsConfig) {
     assert.strictEqual(typeof dnsConfig, 'object');
 
diff --git a/src/dns/wildcard.js b/src/dns/wildcard.js
index 99531ff8a..c6101a171 100644
--- a/src/dns/wildcard.js
+++ b/src/dns/wildcard.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     removePrivateFields: removePrivateFields,
+    injectPrivateFields: injectPrivateFields,
     upsert: upsert,
     get: get,
     del: del,
@@ -22,6 +23,9 @@ function removePrivateFields(domainObject) {
     return domainObject;
 }
 
+function injectPrivateFields(newConfig, currentConfig) {
+}
+
 function upsert(domainObject, location, type, values, callback) {
     assert.strictEqual(typeof domainObject, 'object');
     assert.strictEqual(typeof location, 'string');
diff --git a/src/domains.js b/src/domains.js
index ac1d630d2..59e06c0a4 100644
--- a/src/domains.js
+++ b/src/domains.js
@@ -35,7 +35,6 @@ module.exports = exports = {
 
 var assert = require('assert'),
     async = require('async'),
-    asyncIf = require('./asyncif.js'),
     config = require('./config.js'),
     constants = require('./constants.js'),
     DatabaseError = require('./databaseerror.js'),
@@ -310,11 +309,17 @@ function update(domain, data, auditSource, callback) {
         error = validateTlsConfig(tlsConfig, provider);
         if (error) return callback(error);
 
-        asyncIf(!!config, (done) => verifyDnsConfig(config, domain, zoneName, provider, done), function (error, sanitizedConfig) {
+        api(provider).injectPrivateFields(config, domainObject.config);
+
+        verifyDnsConfig(config, domain, zoneName, provider, function (error, sanitizedConfig) {
             if (error) return callback(error);
 
-            let newData = { zoneName: zoneName, provider: provider, tlsConfig: tlsConfig };
-            if (config) newData.config = sanitizedConfig;
+            let newData = {
+                config: sanitizedConfig,
+                zoneName: zoneName,
+                provider: provider,
+                tlsConfig: tlsConfig
+            };
 
             domaindb.update(domain, newData, function (error) {
                 if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));