DNS Pipeline Teardown Controls: Keeping Destructive Zone Changes Reviewable

Description and use

DNS teardown controls in CI/CD: enforce a domain allowlist, default to record deletion, and require explicit zone deletion with audit logging.

Problem

Automated DNS pipelines risk accidental zone deletion when a variable is empty or mis‑configured, leading to loss of mail, TXT, and service discovery records.

Outcome

By enforcing an allowlist, defaulting to record deletion, and logging intent, the pipeline prevents accidental zone wipes while still enabling rapid, intentional teardowns.

Workflow

• 1. Define a domain allowlist in the pipeline configuration.
• 2. Before any DNS call, check that the target domain is in the allowlist.
• 3. Log an audit event with action, domain, actor, run ID, and reason.
• 4. For cleanup jobs, call the record‑delete endpoint; for explicit teardown, call the zone‑delete endpoint after separate review.
• 5. Use a small request body that contains only the capability schema fields.
• 6. Handle rate‑limiting with exponential backoff and idempotency keys.

Evidence

To prevent accidental DNS zone deletion in an automated pipeline, require an explicit domain allowlist and make record deletion the default destructive operation.

Source

Log intent first. A small audit event containing the action, domain, actor, pipeline run ID, and reason gives the successful destructive action a trail that can be correlated later.

Source