octoDNS syncs DNS records to provider APIs. The main controls are credential scope, change review, and deployment pipeline security.
- 🔐 Use least privilege tokens - Provider tokens should have minimum required permissions per zone/account
- 🔐 Store secrets securely - Use secret managers (AWS Secrets Manager, HashiCorp Vault), never commit to repositories
- 🔐 Rotate credentials regularly - Implement credential rotation and remove stale service accounts
- 🔐 Use environment variables - Reference secrets via
env/VARIABLE_NAME syntax, not hardcoded values
- ✅ Enforce pull-request review - Require review for all zone config changes
- ✅ Use CI validation - Run
octodns-validate before sync/apply
- ✅ Restrict production access - Limit
--doit execution to trusted CI runners or operators
- ✅ Branch protection - Protect main branches with required reviews and status checks
- ✅ Separate environments - Use different configs for staging/production
Example GitHub Actions:
- name: Validate DNS changes
run: octodns-sync --config-file=config/production.yaml
# Dry-run by default - shows planned changes
- name: Apply DNS changes
run: octodns-sync --config-file=config/production.yaml --doit
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
# Only apply on main branch pushes
Security measures:
- Run dry-run on every PR
- Require manual approval for production changes
- Use OIDC for cloud provider authentication (no long-lived credentials)
- 📋 Enable provider audit logs - Keep provider-side audit logs enabled
- 📋 Record change metadata - Log actor identity, commit SHA, and timestamp for each sync
- 📋 Alert on out-of-band changes - Monitor for DNS changes made outside octoDNS
- 📋 Version control all configs - Store zone files in Git for full audit trail
- 📋 Regular exports - Use
octodns-dump to backup current state periodically
When using octoDNS with self-hosted DNS servers like BIND, PowerDNS, or Knot DNS:
- 🔐 Secure API access - Use TLS and API key authentication
- 🔐 Network isolation - Restrict octoDNS access to DNS server APIs
- 🔐 Zone file permissions - Protect zone files with proper file permissions (0640)
- 🔐 TSIG keys - Use TSIG for DNS updates when supported
- 🔐 Monitor zone transfers - Log and alert on AXFR/IXFR operations
When running octoDNS in containers:
- 🔐 Don’t hardcode credentials - Use Docker secrets or environment variables
- 🔐 Restrict volume mounts - Only mount necessary config directories
- 🔐 Run as non-root - Add
USER 1000 to Dockerfile
- 🔐 Scan images - Regularly scan container images for vulnerabilities
For audited environments:
- Change management - All DNS changes tracked via Git commits
- Separation of duties - Different teams manage configs vs. deployment
- Audit trail - Full history of who changed what and when
- Rollback capability - Git enables quick rollback to previous state
- Documentation - Zone files serve as living documentation