Networking and DNS Required

Keep DNS records in code

Manage every DNS record of every domain in code, changed by pull request. Never edit a record in the provider's web panel.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Use a tool such as OctoDNS, DNSControl or a Terraform provider for your DNS host. Keep mail, verification and certificate records there too. Run the tool's preview in the pull request and apply from CI. Add records from the CAA and DNSSEC rules. Remove records for retired services as in dangling DNS.

Example

# A DNS host's provider, here Cloudflare's
resource "cloudflare_dns_record" "apex" {
  zone_id = var.zone_id
  name    = "example.com"
  type    = "A"
  content = "203.0.113.10"
  ttl     = 3600
}

# OctoDNS: config/example.com.yaml
'':
  - type: A
    value: 203.0.113.10
  - type: CAA
    value: { flags: 0, tag: issue, value: letsencrypt.org }
www:
  type: CNAME
  value: example.com.

How to check

A daily job runs the tool's preview against the live zone. It reports no difference.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/dns-as-code.