DNSControl lets you manage DNS as code: the desired records live in a versioned dnsconfig.js file, while provider credentials are supplied separately. On a Linux VPS, the safe operating cycle is to install and pin a DNSControl version, import or define the zone, run dnscontrol preview, inspect every proposed change, and only then run dnscontrol push with narrowly scoped credentials. This guide covers installation, migration of an existing zone, secret handling, provider capability checks, VPS hardening, drift detection, and controlled automation.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What DNSControl deploys
The DNSControl project describes itself as “Infrastructure as Code for DNS.” Its configuration is declarative: you state which registrars, DNS providers, domains, and records should exist, and DNSControl calculates the difference between that desired state and the live provider. The project runs anywhere Go runs, including Linux, as documented in the project repository.
As an Amazon Associate I earn from qualifying purchases.
A normal deployment has two separate inputs:
dnsconfig.js: the reviewable desired state, including domains, record names, values, TTLs, and provider assignments.creds.json: provider definitions and API authentication. Keep this file outside a public repository or generate it from a secret manager.
preview reads the configuration and prints the changes it would make; push performs those changes. Treat push as a production change operation, not as a harmless validation command.
Prepare the Linux VPS
Use a supported Linux distribution with a current security update level and an account that can install software but does not need unrestricted root access for every DNS run. Before installing, gather:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- SSH access with a dedicated Unix account for DNS deployments.
- Outbound HTTPS access to the APIs of every DNS provider you will manage.
- The provider API token or key, limited to the target zones and required DNS actions.
- Registrar access if nameserver delegation or domain creation is part of the migration.
- A current export or backup of each live zone, including SOA, NS, MX, TXT, CNAME, and any provider-specific records.
- A decision about where
dnsconfig.jswill be reviewed (usually Git) and where secrets will be injected (a secret manager, protected CI variable, or a root-readable file outside the repository).
Keep the DNSControl release documented. The releases page currently shows version 5.1.0, but release data changes; verify the version on the day you install and record the exact version in your runbook.
Choose an installation method
| Method | Best fit | Operational considerations |
|---|---|---|
| Linux package or downloadable binary | A small, durable VPS service account | Simple process supervision and easy version pinning; verify the downloaded release and checksum according to the release instructions. |
| Docker | Hosts already using containers or immutable deployments | Mount the project directory read-write only when a command needs it; pin the image tag instead of relying on an implicit latest image. |
| Homebrew on Linux | Administrators already standardizing on Homebrew | Document the formula version and update policy; a package update can change behavior if it is not pinned. |
| Build with Go | Teams that need a reproducible toolchain or source-level control | Record the Go version, module revision, and build flags, then verify the resulting binary before production use. |
All four routes are listed in the DNSControl getting-started documentation. Choose one route for a given VPS rather than mixing binaries and containers in the same automation path.
Binary or package workflow
Create a private working directory and confirm the executable before touching a live zone:
mkdir -p ~/dnscontrol && cd ~/dnscontrol
# install dnscontrol using the chosen official package or Linux binary
dnscontrol versionStore the binary in a controlled location such as /usr/local/bin only after checking its provenance and permissions. Keep the version output in deployment documentation so a rollback can reproduce the same tool.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Container workflow
From the directory containing dnsconfig.js and the credentials supplied at runtime, the official image can run a preview without installing a host binary:
docker run --rm -it -v "$PWD:/dns" ghcr.io/DNSControl/dnscontrol previewFor unattended jobs, replace the interactive flags with the CI runner’s non-interactive settings, mount secrets separately, and pin a specific image tag that corresponds to the version you approved.
Recommended Free Tools
Create the project and protect credentials
The official walkthrough explicitly warns: “Do not store your creds.json file in Git unencrypted.” Keep the file outside the repository, add it to your ignore rules if it resides near the project, and restrict it to the deployment identity:
chmod 700 ~/dnscontrol
chmod 600 ~/dnscontrol/creds.jsonA minimal configuration separates provider naming from the zone declaration:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
var REG_NONE = NewRegistrar('none');
var DSP_PROVIDER = NewDnsProvider('provider_main');
D('example.com', REG_NONE, DnsProvider(DSP_PROVIDER),
A('@', '203.0.113.10'),
CNAME('www', '@'),
MX('@', 10, 'mail.example.net.')
);The matching credentials file can reference an environment variable rather than embedding a token:
{
"provider_main": {
"TYPE": "CLOUDFLAREAPI",
"apitoken": "$DNS_API_TOKEN"
}
}Provider type names, credential keys, and record syntax differ. Use the provider-specific documentation and the supported-provider matrix before adapting this example. Never commit a real token, a generated report containing credentials, or a shell history line that exposes a secret.
Initialize a new zone or migrate an existing one
Start with the interactive initializer
Run dnscontrol init when you are defining a project from scratch. The wizard asks for the DNS provider and registrar, verifies the credentials, and writes starter creds.json and dnsconfig.js files. Inspect both files immediately, remove anything you do not intend to manage, and apply the file-permission restrictions before proceeding.
Import an existing provider zone
For a live domain, dnscontrol get-zones can query a provider and produce a first-draft configuration. Treat that output as an inventory, not as an approved change set:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Export the current zone from the provider and save the export with a timestamp and change-ticket reference.
- Run
dnscontrol get-zonesusing the provider credentials and capture the generated configuration in a temporary branch. - Compare every imported record with the provider export. Pay particular attention to apex records, trailing dots on fully qualified names, TTLs, MX priorities, TXT values, wildcard labels, CAA records, and records created by web, mail, certificate, or verification services.
- Check whether the import preserved provider-specific settings such as proxying, health checks, geo-routing, or DNSSEC metadata. If a setting cannot be represented, document that limitation rather than silently deleting it.
- Normalize the file, commit the intended state, and run a preview until the diff contains only changes you plan to make.
Do not change nameserver delegation and record content in one unreviewed operation. If the migration also moves authoritative nameservers, lower TTLs ahead of the maintenance window according to your existing change policy and keep the old provider available until recursive caches have expired.
Validate, preview, and push safely
Use this sequence for every first deployment and for subsequent changes:
dnscontrol check-creds
dnscontrol preview --full --config dnsconfig.js --creds creds.json
# after review
dnscontrol push --full --config dnsconfig.js --creds creds.jsonWhat each command does
| Command | Purpose | Safe usage |
|---|---|---|
dnscontrol check-creds |
Checks whether the configured provider credentials can be used. | Run before a preview so an authentication failure is separated from a DNS diff. |
dnscontrol preview |
Reads the desired configuration, calculates changes, and prints them without applying them. | Run in a branch, pull request, or read-only scheduled job; save the output for review. |
dnscontrol push |
Uses the same calculation as preview and executes the changes against live providers. | Run only from an approved commit, with a maintenance window and a human or protected CI approval. |
The command reference defines the distinction precisely: “preview reads the dnsconfig.js file (or equivalent), determines what changes are to be made, and prints them. push is the same but executes the changes.” See the preview and push reference.
Read the complete diff
Use --full during migrations so additions, modifications, deletions, delegation changes, and provider names are visible. A deletion can be as damaging as an incorrect address: removing an MX or TXT record may interrupt mail delivery or domain verification. Check that the target domain, provider, record name, value, TTL, and priority are all what you expect.
Limit a staged rollout with --domains or --providers. When you do not want DNSControl to create a missing zone automatically, add --no-populate. This is useful when zone creation and record publication are separate approvals.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use no-change checks for drift
For a read-only drift job, run dnscontrol preview --expect-no-changes. The command exits as a failure when the live state differs from the declared state, allowing CI or monitoring to alert without changing DNS. Investigate whether the difference is an emergency provider-side edit, an uncommitted legitimate change, or a normalization issue before pushing.
Provider capabilities determine the design
DNSControl providers do not all expose the same operations. Before choosing a provider or planning a migration, inspect the live status in the provider matrix for:
| Capability | Why it matters | Decision to record |
|---|---|---|
get-zones |
Determines whether DNSControl can build an initial configuration from the provider. | Use an export and manual transcription when import is unavailable. |
| Zone or domain creation | Controls whether a push can create a missing zone or only edit an existing one. | Separate account-level creation approval from record updates when required. |
| Dual-host operation | Indicates whether the provider can cooperate with another authoritative host during a transition. | Plan nameserver and propagation steps around the provider’s documented behavior. |
| DNSSEC | Determines whether signing and key metadata can be managed through DNSControl. | Keep DNSSEC operations under a documented provider-specific procedure if support is incomplete. |
| Concurrency verification | Shows whether parallel record operations have been tested for that provider. | Use the verified/default mode unless you have a reproducible reason to change it. |
The matrix distinguishes official support from community support. Official support means releases are covered by integration tests and maintainers prioritize fixes; community support may have different maintenance expectations. Confirm this status before putting a provider into an unattended production pipeline.
Understand concurrency modes
The preview/push command reference documents three concurrency modes:
Free tools Windows power users keep installed
One-click scans. No signup required.
--cmode noneruns operations sequentially and is the safest choice when a concurrency problem is suspected.--cmode concurrentallows the normal parallel behavior where the provider’s verified status supports it.--cmode allmaximizes parallelism, is unsafe for ordinary operation, and exists primarily to reproduce bugs.
Do not force all to make a deployment appear faster. If a provider returns rate-limit, ordering, or intermittent consistency errors, rerun with none, capture the provider response, and check the matrix and release notes before changing production settings.
Harden the VPS and the deployment identity
- Create a dedicated Unix account such as
dnsdeploy; do not run routine pushes as root. - Use SSH keys, disable password authentication where your access policy allows, restrict administrative SSH to a management network, and keep the operating system patched.
- Store API tokens in a secret manager or protected CI environment. If a local file is unavoidable, keep it outside the Git checkout, set mode 600, and ensure backups are encrypted.
- Grant each token only the DNS scopes and zones needed for its job. Use a read-only credential for drift previews when the provider supports it, and a separate write credential for approved pushes.
- Keep
dnsconfig.js, review comments, and preview output in version control, but excludecreds.json, shell transcripts, and generated files that may contain secrets. - Log who approved a push, which commit was deployed, which DNSControl version ran, and which domains and providers were targeted. Redact tokens and full secret values from logs.
Automate drift checks and approved changes
A practical pipeline has two distinct paths:
- Drift path: a scheduled job checks out the declared configuration, injects a read-only credential, runs
dnscontrol check-creds, then runsdnscontrol preview --expect-no-changes. A non-zero result opens an alert or ticket; it does not push. - Change path: a pull request shows the preview output, reviewers verify every record change, and a protected CI environment injects the write credential only after approval. The job runs the same version-pinned DNSControl binary or container and then executes
pushfor the approved scope.
Use DNSControl’s variables, macros, transforms, multi-provider uploads, and Git history to keep repeated records consistent across domains. Define shared values once, review the rendered effect in preview, and avoid hiding an exceptional record inside a broad transform. The project overview at dnscontrol.org describes these infrastructure-as-code features.
Quick Recap
Troubleshoot common failures
| Symptom | Likely cause | Recovery |
|---|---|---|
check-creds fails |
Wrong provider type, missing environment variable, expired token, or insufficient scope. | Verify the provider name in dnsconfig.js, confirm the secret is present in the process environment, rotate the token if needed, and test with the smallest permitted scope. |
| Preview proposes deletion of many records | The imported zone is incomplete, names or trailing dots were normalized incorrectly, or the wrong provider/zone was selected. | Stop; compare with the provider export and authoritative answers. Correct the configuration and preview again. Never push a broad deletion diff merely to make preview clean. |
| Push says a zone is missing | The provider does not support automatic creation, or population was intentionally disabled. | Create the zone through the provider’s approved process, verify delegation, then rerun without changing unrelated records. Keep --no-populate when creation must remain manual. |
| Records appear correct at the provider but not from a resolver | Recursive caching, TTLs, delegation, or DNSSEC is delaying or invalidating the answer. | Query the authoritative nameservers directly, check the SOA serial and NS delegation, and wait for the previous TTL before judging propagation. |
| Parallel operations time out or are rate-limited | Provider API limits or an unverified concurrency path. | Retry with --cmode none, reduce the scope with --domains or --providers, and investigate provider limits before re-enabling concurrency. |
| Preview fails only in CI | The runner cannot read the secret, uses a different working directory, or runs a different DNSControl version. | Print non-secret diagnostics such as pwd, dnscontrol version, and the presence (not value) of required environment variables; use an absolute config path and pin the tool version. |
A repeatable operating checklist
- Record the DNSControl version and installation method.
- Back up or export the live zone and document the rollback contact.
- Confirm provider capabilities, support status, and token scopes.
- Keep
dnsconfig.jsunder reviewable version control and credentials outside plaintext Git. - Initialize with
dnscontrol initor import withdnscontrol get-zones. - Run
check-creds, then a full preview; resolve every unexpected diff. - Use scoped flags for staged rollouts and avoid automatic zone creation when it is not approved.
- Push from the approved commit during the change window, then query authoritative nameservers and key records.
- Enable scheduled
preview --expect-no-changeschecks and investigate drift before it becomes an outage.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
