List the DNS zones of the Hetzner Cloud project, including status, mode, default TTL, assigned nameservers and record counts.

Get the full details of a single DNS zone.

Export the full contents of a DNS zone as a zone file (BIND format).

Create a new DNS zone. Use mode "primary" for zones managed at Hetzner, or "secondary" with primary_nameservers to transfer the zone from external primaries. A primary zone can optionally be initialized from a zone file. Creating a zone with primary_nameservers or a zonefile asks a person first — those two carry the whole content of the zone, exactly like change_primary_nameservers and import_zonefile do.

Update the labels of a DNS zone. The given set replaces all existing labels. (Other zone properties are changed via the dedicated change_zone_* tools.)

Permanently delete a DNS zone including all its records. This is irreversible. The first call returns a short-lived confirmation token; ask the user, then call again with confirm_token.

Import a zone file (BIND format) into an existing primary zone. This REPLACES the current records of the zone. The first call returns a short-lived confirmation token bound to exactly this zone file; ask the user, then call again with confirm_token. Consider export_zonefile first as a backup.

Change the default Time To Live (TTL) of a DNS zone. Applies to RRSets without an explicit TTL.

Enable or disable the delete protection of a DNS zone. Enabling is immediate; DISABLING removes the last safeguard against delete_zone and therefore needs a confirm_token, exactly like a deletion.

Replace the primary nameservers of a secondary zone (the servers Hetzner transfers the zone from). The ENTIRE zone content will be taken from the new primaries on the next transfer. Only applicable to zones in secondary mode. The first call returns a short-lived confirmation token bound to exactly this nameserver list.

List the RRSets (DNS record sets) of a zone, including their records, TTLs and protection status.

Get a single RRSet (DNS record set) of a zone by name and type.

Create a new RRSet (DNS record set) in a zone, e.g. an A record for "www". Fails if an RRSet with the same name and type already exists — use set_records or add_records in that case.

Update the labels of an RRSet. The given set replaces all existing labels. (Records and TTL are changed via set_records/add_records/remove_records and change_rrset_ttl.)

Permanently delete an RRSet (DNS record set) with all its records. This is irreversible. The first call returns a short-lived confirmation token; ask the user, then call again with confirm_token.

Replace ALL records of an RRSet with the given records. Existing records not listed are removed. Use add_records to append instead. The first call returns a short-lived confirmation token bound to exactly this record list.

Add records to an RRSet. Existing records are kept. Creates the RRSet if it does not exist yet — so denying create_rrset does not remove the ability to create one.

Remove specific records (matched by value) from an RRSet. Removing the last record deletes the RRSet — so denying delete_rrset does not remove the ability to delete one. The first call returns a short-lived confirmation token bound to exactly this record list.

Change the Time To Live (TTL) of an RRSet. Pass null to fall back to the zone's default TTL.

Enable or disable the change protection of an RRSet. Enabling is immediate; DISABLING removes the last safeguard against delete_rrset and set_records and therefore needs a confirm_token.

List actions (asynchronous operations like zone file imports) of all zones, or of a single zone if one is given.

Get a single zone action by ID to check its status and result.