The One-Click DNS Manager provides a unified control interface for local DNS servers (BIND9, PowerDNS) and cloud-based managed DNS providers (Cloudflare, DigitalOcean, Route53, Hetzner, Vultr, and more).

Unlike raw command-line tools that require memorizing long flag combinations, the DNS module is driven by an interactive Terminal UI (TUI) menu system triggered via one-click --dns.

# Launch interactive DNS Registry Management UI
one-click --dns

All sensitive provider tokens, AWS secret keys, and API credentials stored by the DNS manager are encrypted at rest using OpenSSL with AES-256-CBC PBKDF2 salt derivation.

• Master Encryption Key: Generated automatically using openssl rand -base64 64 and locked down with strict 600 file permissions.
• Cluster Controller Safeguard: In a Fleet environment, DNS zone creation and modification rights are restricted exclusively to the primary Controller Node. Fleet worker nodes are prevented from making local state edits.
• Live API Verification: Credentials are verified via active handshake calls (e.g., Cloudflare token verification, DigitalOcean account ping) prior to committing them to disk.

The DNS Manager dynamically routes API calls or local zone configuration entries depending on the selected backend provider:

When running one-click --dns, the system prompts you to select or initialize an active FQDN domain context, then presents the core management dashboard:

╔════════════════════════════════════════════════════════════╗
║                  Registry Management                       ║
╠════╦═══════════════════════════════════════════════════════╣
║ 1  ║ Add/Configure DNS Provider                            ║
║ 2  ║ Initialize New Domain Zone                            ║
║ 3  ║ Add Record                                            ║
║ 4  ║ List Records                                          ║
║ 5  ║ Authority Status                                      ║
║ 0  ║ Back / Exit                                           ║
╚════╩═══════════════════════════════════════════════════════╝

Menu Action Breakdowns

1. Add/Configure DNS Provider

Walks through API token generation, encryption, master key verification, and live API connection testing for any supported provider.

2. Initialize New Domain Zone

Creates domain metadata structures (meta.conf), registers the zone on local or remote cloud endpoints, and automatically provisions default baseline records:

• Root A Record: Directs root domain (@) to target IP address.
• CNAME Record: Provisions www alias pointing back to the root domain.

3. Add Record

Interactive prompt for creating standardized DNS record types across both local BIND zone files and remote provider APIs:

• A / AAAA — IPv4 / IPv6 host mapping.
• CNAME — Canonical name alias.
• TXT — Encapsulated text definitions (SPF, DKIM, verification tokens).
• MX — Priority-weighted mail server routing.
• SRV — Service locator records (Service, Target, Priority, Weight, Port).

4. List Records

Fetches active records directly from the selected domain's provider API (parsed via jq) or renders local BIND zone files to standard output.

5. Authority Status

Runs real-time public name server queries using dig +short NS and compares them against the registered provider's expected authoritative nameservers to detect propagation or delegation issues.

When selecting bind or local as your provider, One-Click includes full package and service lifecycle automation:

If BIND9 is not present, the system automatically detects the OS package manager (apt-get, dnf, or yum), installs bind9 / dnsutils, enables the service daemon via systemctl, and auto-reloads zone files gracefully whenever new records are committed.