octoDNS

octoDNS is a free, open-source “DNS as code” tool for sysadmins, SREs and platform teams who manage zones at one or more DNS providers. You describe records in YAML, keep them in Git, and octoDNS plans and applies the changes to Route 53, Cloudflare, Azure DNS, NS1, PowerDNS, BIND and dozens of other providers. If you are looking for an octoDNS download, there is no installer: it is a Python package installed with pip.

The project was created at GitHub, where it manages GitHub’s own DNS, and is now maintained as the octoDNS project under the MIT licence. Its value is the workflow: every DNS change becomes a reviewed pull request with a dry-run plan, instead of a click in a provider console that nobody can audit later.

octoDNS at a glance

What it does

• Reads zone data from YAML files (the YamlProvider) and treats them as the source of truth.
• Pushes records to one or many targets at once, so the same zone can be served by two providers for redundancy.
• Shows a plan of creates, updates and deletes for every zone and provider before anything changes; nothing is written without --doit.
• Validates configuration and records with octodns-validate, including optional strict and best-practice validators.
• Exports existing zones from a provider into YAML with octodns-dump, which is how most migrations start.
• Syncs between providers directly, for example from Route 53 to another provider, without YAML in between.
• Supports dynamic records (weighted and geo-based answers) on providers that implement them, plus processors that filter or modify records during a sync.
• Extends through provider packages such as octodns-route53, octodns-cloudflare, octodns-azure, octodns-googlecloud, octodns-ns1, octodns-powerdns and octodns-bind.

How sysadmins use it

Set up a workspace

1. Create a virtual environment and install octoDNS plus the provider packages you need.

mkdir dns && cd dns
python -m venv env
source env/bin/activate
pip install octodns octodns-route53 octodns-cloudflare
mkdir config

2. Write config/production.yaml. Keep credentials in environment variables; the env/ prefix tells octoDNS to read them from there.

---
providers:
  config:
    class: octodns.provider.yaml.YamlProvider
    directory: ./config
    default_ttl: 3600
  route53:
    class: octodns_route53.Route53Provider
    access_key_id: env/AWS_ACCESS_KEY_ID
    secret_access_key: env/AWS_SECRET_ACCESS_KEY
zones:
  example.com.:
    sources:
      - config
    targets:
      - route53

Import an existing zone

1. Point a provider at the zone you already run and dump it to YAML.
2. Review the generated file and commit it to Git.

octodns-dump --config-file=./config/production.yaml --output-dir=./config example.com. route53

Plan and apply a change

1. Edit config/example.com.yaml, for example to add an A record at the apex:

---
'':
  ttl: 60
  type: A
  values:
    - 192.0.2.10
    - 192.0.2.11

2. Run a dry run and read the plan: octodns-sync --config-file=./config/production.yaml
3. Apply it: octodns-sync --config-file=./config/production.yaml --doit
4. In a team, run the dry run in CI on every pull request and only run --doit after review and merge.

Install and first run

Requirements. Python 3.10 or newer and pip. octoDNS itself is small; each DNS provider lives in its own package that you install alongside it. API credentials for each provider must have permission to read and edit the zones.

Linux and macOS. Use a virtual environment as shown above, and pin versions in a requirements.txt so CI and laptops run the same code.

Windows. It works with the python.org installer: create the venv with py -m venv env and activate it with envScriptsactivate. Many teams simply run it in WSL or in a CI container instead.

Gotchas.

• octoDNS assumes ownership of every zone you point it at. On --doit it deletes records that are not in your YAML, so always dump first and read the plan.
• Zone names in the config end with a dot (example.com.).
• Not every provider supports every record type or dynamic records; check the provider package’s README.
• Large deletions trigger safety checks; read the warning instead of forcing past it.

Limitations

• No GUI. Everything is YAML and command line, which is the point, but it does not suit teams who want a web console.
• There is no provider for Microsoft Windows DNS Server in the official provider list; on-premises AD DNS needs another approach, such as BIND-compatible zone transfers or a community plugin.
• Provider plugins vary in maturity because many are maintained separately, some by third parties.
• Releases are published on PyPI rather than as GitHub Releases, so watch PyPI or the changelog for updates.
• It manages records, not registrar settings such as domain renewal or nameserver delegation at the registry.

octoDNS vs alternatives

The closest alternative is DNSControl from Stack Exchange, which uses a JavaScript DSL instead of YAML and is distributed as a single Go binary. Terraform with provider-specific DNS resources fits teams that already manage cloud infrastructure with Terraform, but it tracks state in a state file, while octoDNS compares desired YAML against the live provider every time. For general server configuration rather than DNS, look at Rudder or Salt; octoDNS does one job only.

FAQ

How do I install octoDNS?

Create a Python virtual environment and run pip install octodns plus the provider packages you need, for example octodns-route53 or octodns-cloudflare. There is no separate installer to download.

Which octoDNS providers are available?

The documentation lists dozens, including Route 53, Azure DNS, Google Cloud DNS, Cloudflare, NS1, PowerDNS, BIND, DigitalOcean, Hetzner, OVH, Gandi and DNSimple. Each one is a separate pip package.

What does octodns-sync do?

It compares your sources (usually YAML) with each target provider and prints a plan. Adding --doit applies that plan.

What does octodns-validate do?

It loads your configuration and zone files and reports errors without contacting providers, which makes it a good first check in CI.

Does octoDNS work with Windows DNS Server?

Not through an official provider. octoDNS itself runs on Windows with Python, but managing Active Directory-integrated DNS needs a community plugin or a different tool.

Is there an octoDNS GUI?

No. octoDNS is designed for Git and the command line; the “interface” is a pull request with the dry-run plan attached.

Is octoDNS free?

Yes. It is free and open source under the MIT licence. Provider packages are separate projects, so check each one’s licence if that matters to you.

Last checked against official sources: 1 October 2026 (developer website: github.com). Versions and licence terms change — confirm on the developer's site before deploying in production.