---
title: "Keep DNS records in code · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/dns-as-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep DNS records in code

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Rule: Manage every DNS record of every domain in code, changed by pull request. Never edit a record in the provider's web panel.
- How: Use a tool such as OctoDNS, DNSControl or a Terraform provider for your DNS host. Keep mail, verification and certificate records there too. Run the tool's preview in the pull request and apply from CI. Add records from the [CAA](https://agentwranglers.se/playbook/website/hosting-and-network/caa-records) and [DNSSEC](https://agentwranglers.se/playbook/website/hosting-and-network/dnssec) rules. Remove records for retired services as in [dangling DNS](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/dangling-dns).
- Check: A daily job runs the tool's preview against the live zone. It reports no difference.

Example:

```hcl
# A DNS host's provider, here Cloudflare's
resource "cloudflare_dns_record" "apex" {
  zone_id = var.zone_id
  name    = "example.com"
  type    = "A"
  content = "203.0.113.10"
  ttl     = 3600
}
```

```yaml
# OctoDNS: config/example.com.yaml
'':
  - type: A
    value: 203.0.113.10
  - type: CAA
    value: { flags: 0, tag: issue, value: letsencrypt.org }
www:
  type: CNAME
  value: example.com.
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/dns-as-code`.

- Previous: [Require tokens for the metadata service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/metadata-service-tokens)
- Next: [Shorten the TTL before you move a record](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/lower-ttl-before-changes)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)