Home

dns-sync

DNS as code. One binary.

A fast, self-contained CLI for syncing DNS records across providers — inspired by OctoDNS, built in C# / .NET 10.

Define your DNS zones as YAML files, then let dns-sync keep your providers in sync.

dns-sync validate --config config.yaml                           # Validate config and zone files
dns-sync plan     --config config.yaml                           # Preview what would change
dns-sync apply    --config config.yaml                           # Apply changes
dns-sync import   --config config.yaml --provider porkbun --all  # Export provider DNS to YAML

---

Pages

Page	Description
Getting Started	Installation, first config, first sync
Commands Reference	All commands and flags (plan, apply, import, validate)
Configuration Reference	All config.yaml options, providers, multi-instance setup
Zone File Format	Writing zone YAML files (records, types, examples)
Editor Setup	JSON Schema for VS Code and JetBrains autocompletion
CI/CD Integration	GitHub Actions, saved plan workflow, Cloud Run

---

Quick example

# config.yaml
providers:
  zones:
    type: yaml
    directory: ./zones

  cloudflare:
    type: cloudflare
    api_token: ${CF_API_TOKEN}
    account_id: ${CF_ACCOUNT_ID}   # optional, recommended

  gcp:
    type: gcp_cloud_dns
    project: my-gcp-project        # optional, inferred from credentials
    credentials_file: /path/to/sa.json  # optional, falls back to ADC

zones:
  example.com.:
    source: zones
    targets:
      - cloudflare
      - gcp

$ dns-sync plan -c config.yaml --wide
Loading config from config.yaml
✓ Config valid (1 zone(s), 2 provider(s))

Running pre-flight checks...
✓ Source provider 'zones' reachable
✓ Target provider 'cloudflare' reachable

Zone: example.com. → cloudflare
  + example.com.                                  MX      3600
      10 mail.example.com., 20 mail2.example.com.
  + example.com.                                  TXT      600
      "v=spf1 include:_spf.google.com ~all"
  + www.example.com.                              CNAME    3600
      app.example.com.
  + api.example.com.                              A        300
      203.0.113.10, 203.0.113.11
  + _dmarc.example.com.                           TXT      600
      "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

  5 create(s)

5 total change(s) — run dns-sync apply to apply.

---

Supported providers

Provider	Read	Write
yaml	✓	✓
cloudflare	✓	✓
gcp_cloud_dns	✓	✓
porkbun	✓	✓
route53	✓	✓

Supported record types

Type	RFC	Description	Status	Notes
A	RFC 1035	IPv4 address	✅ Supported
AAAA	RFC 3596	IPv6 address	✅ Supported
CNAME	RFC 1035	Canonical name alias	✅ Supported
MX	RFC 1035	Mail exchanger	✅ Supported
TXT	RFC 1035	Arbitrary text / SPF / DKIM / DMARC	✅ Supported
NS	RFC 1035	Name server delegation	✅ Supported
CAA	RFC 8659	Certification Authority Authorization	✅ Supported
SRV	RFC 2782	Service locator	✅ Supported
PTR	RFC 1035	Reverse DNS pointer	🗓️ Planned	Common in mail and monitoring setups
HTTPS	RFC 9460	HTTPS service binding	🗓️ Planned	Modern alternative to CNAME-at-apex workarounds
SVCB	RFC 9460	Service binding	🗓️ Planned	Generalized form of HTTPS record
NAPTR	RFC 3403	Naming Authority Pointer	🗓️ Planned	Used in VoIP / SIP / ENUM
TLSA	RFC 6698	TLS cert association (DANE)	🗓️ Planned	Growing adoption with DNSSEC
SSHFP	RFC 4255	SSH public key fingerprint	🗓️ Planned	Useful in DNSSEC-enabled environments
DS	RFC 4034	DNSSEC Delegation Signer	🗓️ Planned	Required for cross-zone DNSSEC delegation
SOA	RFC 1035	Start of Authority	⛔ Not planned	Managed exclusively by the registrar/provider — not user-configurable
DNSKEY	RFC 4034	DNSSEC public key	⛔ Not planned	Generated and rotated automatically by providers
RRSIG	RFC 4034	DNSSEC record signature	⛔ Not planned	Internal DNSSEC signing — transparent to operators
NSEC / NSEC3	RFC 4034 / RFC 5155	DNSSEC authenticated denial	⛔ Not planned	Internal DNSSEC structure — provider-managed
HINFO	RFC 1035	Host information	⛔ Not planned	Obsolete — security risk, rarely used
LOC	RFC 1876	Geographic location	⛔ Not planned	Extremely rare in practice
AFSDB	RFC 1183	AFS database location	⛔ Not planned	Legacy protocol, effectively unused
APL	RFC 3123	Address prefix list	⛔ Not planned	Never saw widespread adoption
CERT	RFC 4398	Certificate record	⛔ Not planned	Superseded by TLSA/DANE
DNAME	RFC 6672	Subtree delegation alias	⛔ Not planned	Niche use case; complex semantics
URI	RFC 7553	URI record	⛔ Not planned	Minimal real-world adoption

Don't see a type you need? We welcome contributions — open a PR or start a discussion.

---

Install

brew tap cl8dep/tap
brew install dns-sync

Or download a binary from the releases page.

---

Source

github.com/cl8dep/dns-sync — MIT License