展示 HN：Dnswer – 基于浏览器的 DNS 更改审批和多提供商同步
1 分•作者: Quibus99•4 天前
想象一下，您需要管理分布在多个 DNS 提供商处的域的 DNS。您希望在所有区域应用一致的 DNS 设置，但唯一的方法是逐个区域手动应用相同的更改（使用多个控制面板）。这既繁琐又容易出错。您希望将权限委派给其他团队，但很多时候唯一的方法是授予对所有内容的访问权限。如果出现问题，您将不知道是谁造成的，也不知道具体更改了什么。
现有的解决方案是基础设施即代码 (IaC)。OctoDNS 或 DNSControl 等工具可以帮助您解决上述部分问题。但它们要求整个团队都熟悉设置管道、命令行工具和 Git。
借助 dnswer，我希望在浏览器中提供相同级别的结构：
* 在发布 DNS 更改之前进行暂存/预览（编辑和发布是不同的角色）
* 可重用的记录块，带有每个区域的变量（不是一次性模板：更新一次，批量升级使用它的所有区域）
* 从完全访问到仅对单个记录具有写入访问权限的细粒度访问控制
* 多提供商同步，具有漂移检测和解决
* 在您的提供商处预配新区域，而不仅仅是导入现有区域
* 更改后的名称服务器验证（验证更改是否已生效）
* 对于没有 API 的提供商，提供可共享的更改请求，并支持按需重新验证（无需 dnswer 帐户即可查看）
* 现代记录类型（HTTPS/SVCB）和用于邮件的 DANE/TLSA，以及证书漂移监控
* 一个区域日志，显示了什么被更改、谁更改的以及为什么
您可以通过以下几种方式了解更多信息：
* 学习：[https://dnswer.net/show/](https://dnswer.net/show/)（演练；带注释的屏幕截图解释了如何使用关键功能）
* 试用：[https://app.demo.dnswer.net/](https://app.demo.dnswer.net/)（沙盒环境，带有模拟提供商，免费；注册并验证您的电子邮件即可进入）
* 定价：[https://dnswer.net/pricing](https://dnswer.net/pricing)
如果您想使用自己的区域和 API 访问您的 DNS 提供商来试用：我正在寻找最多十个团队（最好管理跨多个提供商的 20 多个域）愿意使用 dnswer 管理实际区域。这不是一个大型 Beta 测试：我想观察它实际的使用情况并快速进行调整。前 3 个月免费，早期用户在价格上涨后仍可享受 2 年的优惠价格。如果您有兴趣，请发送电子邮件至 joost@dnswer.net 联系。
在您这样做之前，有几件事值得了解。dnswer 不在您的解析路径中：您的记录保留在您的提供商处，您的名称服务器会继续响应。如果 dnswer 出现故障，DNS 仍会继续解析，您仍然可以直接在提供商的控制面板中更改记录，只是会暂时失去上面的工作流程，直到它恢复。您可以随时离开：每个区域都可以导出为 BIND 文件，您的记录描述会以注释的形式保留，因此您的文档会随您一同带走。您的提供商凭据会进行静态加密。
我构建它是为了解决我在过去 20 年中遇到的 DNS 问题。我也想了解其他人遇到的 DNS 问题。
技术栈：Django/DRF、PostgreSQL、NATS、Lit Web Components，使用 Ansible 部署。
查看原文
Imagine you have to manage DNS for domains spread across multiple DNS providers. You want to apply consistent DNS settings across your zones but the only way is applying the same change manually zone by zone (using multiple control panels). Tedious and a mistake is bound to happen. You want to delegate permissions to other teams but many times the only way is handing out access to everything. If something breaks you have no idea who did it and what exactly was changed.<p>The existing solution is IaC. Tools like OctoDNS or DNSControl can help you with some of the problems described above. But they require the whole team to feel at home with setting up pipelines, command line tools and git.<p>With dnswer I want to provide the same level of structure, but in a browser:<p>- staging / preview before publishing DNS changes (edit and publish are separate roles)<p>- reusable blocks of records with per-zone variables (not a one-off template: update once, bulk-upgrade every zone that uses it)<p>- granular access control from full access down to write access on just a single record<p>- multi-provider sync with drift detection and resolution<p>- provision new zones at your provider(s), not only importing existing ones<p>- nameserver verification after changes (verifies that the change is live)<p>- for providers without an API, a shareable change request with on-demand re-verification (viewable without a dnswer account)<p>- modern record types (HTTPS/SVCB) and DANE/TLSA for mail, with cert-drift monitoring<p>- a zone logbook showing what changed, who did it, and why<p>There are a few ways you can learn more about it:<p>- Learn: <a href="https://dnswer.net/show/" rel="nofollow">https://dnswer.net/show/</a> (walkthroughs; annotated screenshots explaining how to use key features)<p>- Try it: <a href="https://app.demo.dnswer.net/" rel="nofollow">https://app.demo.dnswer.net/</a> (sandbox with mock providers, free; sign up and verify your email to get in)<p>- Pricing: <a href="https://dnswer.net/pricing" rel="nofollow">https://dnswer.net/pricing</a><p>If you want to try it with your own zones and API access to your DNS provider(s): I'm looking for up to ten teams (ideally managing 20+ domains across multiple providers) willing to manage real zones using dnswer. Not a big beta: I want to watch how it actually gets used and adapt things quickly. Free for the first 3 months, and early users keep their price for 2 years even after it goes up for new customers. If you're interested, reach out by emailing joost@dnswer.net.<p>A few things worth knowing before you do. dnswer is not in your resolution path: your records stay at your provider and your nameservers keep answering. If dnswer is down, DNS keeps resolving and you can still change records directly in your provider's control panel, you just lose the workflow on top until it is back. You can leave whenever you like: every zone exports as a BIND file with your record descriptions preserved as comments, so your documentation comes with you. Your provider credentials are encrypted at rest.<p>I've built it to solve the DNS problems I ran into in the last 20 years. I'd like to learn about other people's DNS problems as well.<p>Tech stack: Django/DRF, PostgreSQL, NATS, Lit web components, deployed with Ansible.