knotctl

What problem does it solve?

Knot DNS edits often require error-prone tooling, awkward secret handling, and risky partial changes; this Skill enables direct, authoritative DNS record editing with strong safety constraints. It is designed for operators who need to update records like A/AAAA/MX/CNAME/NS/TXT/SRV/CAA (and to read/transfer zones) without relying on Cloudflare APIs or interactive nsupdate workflows.

Core Features & Use Cases

• Live record editing with verification: Add, set (including multi-value atomic rrset replacement), remove, list, and export zones while optionally polling until changes are queryable.
• Declarative YAML reconciliation: Apply a zone YAML file additively by default, optionally prune drift, and keep idempotency by diffing at the rrset level (name + type + canonicalized content + TTL).
• Safety guardrails for server-managed and DNSSEC types: Prevent risky removals of apex NS/SOA and DNSSEC records and restrict edits to editable record types.
• Sub-zone aware routing: Choose the correct zone using longest-suffix match against known_zones to avoid silent miswrites.

Quick Start

Use the knotctl tool to reconcile a YAML plan by running: Knotctl apply zones/lab.erfi.io.yml --prune.