DNS IaC Idea Tracking Epic

[AntonyBishop]

Background

This is not a workable story. This is an EPIC for agregating ideas and feedback around managing DNS as IaC.

Value

So we don't lose track of all the great ideas.

Ideas

• [ ] Linting for DNS Spike
• [ ] Checking DNS for compliance against NCSC domain security recommendations
• [ ] Identifying dangling DNS records (inactive domains)
• [ ] Valid DMARC record checks
• [ ] Review User Research findings
• [ ] End user form
• [ ] End user form to issue/PR automation
• [ ] Develop roadmap for DNS work
• [ ] Capturing and recording ownership of domains
• [ ] Can we structure repo by Business Area Ownership i.e. HMPPS, OPG, LAA, defensive, etc
• [ ] Identification of delegations and where delegated to
• [ ] Can we use OctoDNS to set defaults e.g. TTL 300 see (From https://github.com/octodns/octodns/blob/main/docs/records.md ttl is optional. When TTL is not specified the YamlProvider’s default will be used.)
• [ ] Metrics
• [ ] There’s some interesting things in here like checkers for SPF: https://github.com/octodns/octodns/tree/main?tab=readme-ov-file#processors
• [ ] I think what I’m talking about is something like a group of custom sources maybe? https://github.com/octodns/octodns/tree/main?tab=readme-ov-file#custom-sources-and-providers
• [ ] So one possible way to do eg the defensive domains thing is using Yaml anchors, like so:

defensive-domain: &defensive-domain
  ttl: 3600
  type: A
  # … some other defensive domain config

zones:
  his-majestys-whatever:
    <<: *defensive-domain

• [ ] It looks like the accepted solution for sharing values/records (eg for defensive domains) is discussed in this issue: https://github.com/octodns/octodns/pull/1050.

Reference/Discussions - https://mojdt.slack.com/archives/CPVD6398C/p1719418679183719