hetzner-dns

You can automate Hetzner DNS record management by using a helper wrapper to generate plan and HTTP-request payloads for A, AAAA, CNAME, and TXT records. The wrapper injects the API token as an Auth-API-Token header without exposing it to the model.

The safest way to update TXT records for domain verification is using guarded write operations that support adding or removing specific record values. This requires explicit operator grant for mutations and allows dry-run payload generation for review before live execution.

To find the record ID for a Hetzner DNS RRset, you list zones and retrieve existing RRsets to inspect the current DNS data. This discovery phase acts as a preflight check to identify the exact record-id values required before performing any updates or deletes.

Yes, you can plan DNS zone changes in Hetzner before executing live API calls by generating request payloads for review. The runtime only performs live API mutations when the emitted request is explicitly executed, ensuring safe preflight planning.

No, you do not provide your Hetzner DNS API token directly to the model. The provided DNS helper wrapper automatically injects the HETZNER_DNS_API_TOKEN as an Auth-API-Token header, ensuring your credentials remain secure and unexposed.

Guarded writes for Hetzner DNS infrastructure automation require tier-gating for read, write, and delete actions, meaning mutations need explicit operator grant. This safety constraint prevents unauthorized changes but requires validation before executing live API requests.