knotctl

Manage authoritative DNS records via knotctl CLI with TSIG-authenticated RFC 2136 updates.

1|Updated Mar 18, 2024
One-click install
npx skills add https://github.com/erfianugrah/dotfiles --skill knotctl
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: knotctl
Source: https://github.com/erfianugrah/dotfiles/tree/main/.pi/agent/skills/knotctl
Command: npx skills add https://github.com/erfianugrah/dotfiles --skill knotctl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Knot DNS edits often require error-prone tooling, awkward secret handling, and risky partial changes; this Skill enables direct, authoritative DNS record editing with strong safety constraints. It is designed for operators who need to update records like A/AAAA/MX/CNAME/NS/TXT/SRV/CAA (and to read/transfer zones) without relying on Cloudflare APIs or interactive nsupdate workflows.

Core Features & Use Cases

  • Live record editing with verification: Add, set (including multi-value atomic rrset replacement), remove, list, and export zones while optionally polling until changes are queryable.
  • Declarative YAML reconciliation: Apply a zone YAML file additively by default, optionally prune drift, and keep idempotency by diffing at the rrset level (name + type + canonicalized content + TTL).
  • Safety guardrails for server-managed and DNSSEC types: Prevent risky removals of apex NS/SOA and DNSSEC records and restrict edits to editable record types.
  • Sub-zone aware routing: Choose the correct zone using longest-suffix match against known_zones to avoid silent miswrites.

Quick Start

Use the knotctl tool to reconcile a YAML plan by running: Knotctl apply zones/lab.erfi.io.yml --prune.

Frequently Asked Questions about knotctl

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage authoritative DNS records using YAML reconciliation?

YAML reconciliation manages authoritative DNS records by applying declarative zone files additively, optionally pruning drift, and diffing at the rrset level for idempotency. It drives TSIG-authenticated RFC 2136 updates to ensure safe, verified changes.

What is the best way to automate RFC 2136 DNS updates without nsupdate?

Automating RFC 2136 DNS updates without nsupdate is best achieved by driving the knotctl CLI for live, TSIG-authenticated changes. This replaces interactive workflows with a verification-first approach, supporting atomic multi-value rrset replacements and zone exports.

How does longest-suffix zone inference prevent silent DNS miswrites?

Longest-suffix zone inference prevents silent DNS miswrites by matching target record names against known_zones to route edits to the correct sub-zone. This ensures authoritative updates are applied to the precise zone without accidental cross-zone modifications.

Can I remove apex SOA or DNSSEC records during zone reconciliation?

You cannot remove apex SOA or DNSSEC records during zone reconciliation due to built-in safety guardrails. The process restricts edits to editable record types and prevents risky removals of server-managed records to maintain zone stability.

Does knotctl support dry-run planning and drift pruning for zone files?

Knotctl supports dry-run planning and drift pruning for zone files by evaluating declarative YAML configurations before applying them. This allows operators to preview changes and optionally prune existing records that diverge from the declared state.

Why does canonical content normalization matter for multi-value rrset replacement?

Canonical content normalization matters for multi-value rrset replacement because it standardizes record data before diffing. This ensures idempotent YAML reconciliation accurately detects drift and performs atomic updates without redundant or partial modifications.