# Reconciled a 20‑record DNS zone declaratively against the Cloudflare API with separate audit and BIND‑export entry points, and turned the CDN proxy back off on privacy grounds after building it. 2025 **Situation.** The company's DNS carried about twenty records across a web presence, a git subdomain, two personal redirects, mail routing through a hosted mailbox provider, a transactional sending domain and the authentication records for both. All of it lived in a provider's web console, which means the current state was whatever the last person to click had left behind. **Task.** The zone had to become a declaration in the repository, with a way to compare that declaration against what the provider is actually serving. **Action.** The zone is written as data — live records, application records, transport‑policy records and a separate list of records pending removal, which is the honest way to record a deletion that has not happened yet. One play reconciles it against the provider's API. Two more entry points sit behind explicit opt‑in tags: an audit that reports the difference without changing anything, and an export that writes the zone out in the standard zone‑file format so it can be read by something that is not this repository. The most interesting decision was a reversal. Proxying the two web faces through the provider's content network was built, worked, and was then turned back off — because it costs the one sentence the company's privacy page is about. With a proxy in front, another company handles every visitor's address and every URL they request, before we do, under their policy rather than ours. For a business whose distinguishing claim is that nobody is watching, that is a worse trade than the attacks it defends against. **Result.** The zone is versioned, comparable and exportable, and the one decision that went against the obvious default is written down with its reasoning so that nobody re‑litigates it by accident. The audit path is the part that gets used most, because knowing the difference is more often what is wanted than closing it. --- - Role: Network and DNS Engineer - Categories: [APIs & Integration](https://engineer.company/categories/api/), [Infrastructure](https://engineer.company/categories/infrastructure/), [Automation & CI/CD](https://engineer.company/categories/automation/), [Networking & VPN](https://engineer.company/categories/networking/), [Security](https://engineer.company/categories/security/), [Python](https://engineer.company/categories/python/) - Services: [Infrastructure as Code](https://engineer.company/services/infrastructure-as-code/), [System Administration](https://engineer.company/services/system-administration/), [Networking & VPN Setup](https://engineer.company/services/networking-vpn/), [Security & Access Management](https://engineer.company/services/security-access/)