Bootstrap DNS Inventory for Domains That Predate Automation: Capture Before Convergence

Description and use

Capturing a read‑only DNS snapshot before automation prevents accidental record deletion and provides a clear rollback path.

Problem

When domains predate automation, starting DNS automation can inadvertently delete critical records if the current state is not captured and reviewed.

Outcome

Capturing a read‑only DNS snapshot before enabling automation prevents accidental record deletion and provides a clear rollback path.

Workflow

• 1. List all DNS zones via provider API.
• 2. For each zone, retrieve all records.
• 3. Store raw JSON responses exactly as received.
• 4. Normalize records into a table with fields: owner name, type, value, TTL, routing/priority attributes.
• 5. Keep both raw and normalized representations; never overwrite raw copy.
• 6. Compute a deterministic SHA‑256 hash of the snapshot for integrity verification.
• 7. Package raw snapshot, normalized diff, and hash into a review bundle.
• 8. Mark bundle as REVIEW_REQUIRED and prevent write credentials for the bootstrap job.
• 9. Have a human reviewer approve the diff before enabling DNS writes.
• 10. Once approved, proceed with automated provisioning.

Evidence

list every zone, read its records, preserve that read-only snapshot as the initial intended state, and ask a person to review the diff before provisioning starts to converge on it.

Source

Treat silence as “needs review,” not as permission to delete.

Source