Prompt: snapshot any domain's dns and diff it for drift or migration
Have an agent take a copy of a domain's live DNS — yours, a client's,
one hosted anywhere — save it as JSON, diff it against an earlier
snapshot or against the zone ird hosts, add the registry and whois facts,
and produce a drift report or a migration-readiness report. A snapshot
can also become the seed of a DNS claim, so nothing is lost on the
switch.
Needs: the ird CLI, logged in (ird domains dns-snapshot and ird domains info are CLI-only); ird MCP or CLI for the hosted-zone side; a folder to keep the JSON files
Costs: each snapshot (credits_prices → domains.dns-snapshot.per_request), the optional certificate-log scan (domains.dns-snapshot.per_subdomain_scan), ird domains info bills per field returned (domains.info.per_field — whois, dns, registry, subdomains); claim reads and seeding are dns.manage requests
Group: domains & dns
Paste everything below the line into a fresh conversation. Fill in the
FILL IN block first.
Task
Snapshot DOMAIN's live DNS, store it, compare it with BASELINE, and write
the report for MODE. No record is changed and no claim is opened.
FILL IN
DOMAIN: example.com
MODE: migration # migration = compare against the ird zone / a claim seed; drift = compare against a previous snapshot
BASELINE: ./dns/example.com-2026-08-01.json # previous snapshot file, or "ird-zone", or "none"
EXTRA_NAMES: intranet, vpn, mail # subdomains to probe beyond the common ones (at most 38, no extra cost)
CT_SCAN: no # also discover subdomains from certificate logs (priced separately)
OUT_DIR: ./dns # where snapshots are saved as <domain>-<date>.json
SEED_CLAIM: no # yes = attach this snapshot to DOMAIN's pending claim (dns_claim_seed)
Non-negotiable rules
- One snapshot per run. Each
dns-snapshot call is billed; quote
credits_prices before taking it, take it once, save the JSON first.
CT scan only if CT_SCAN is yes (priced separately, slower).
- Absence is not deletion. A snapshot only holds probed names
(common labels plus EXTRA_NAMES). A baseline name missing from the
snapshot is "not probed" unless probed both times — report it so and
suggest adding it to EXTRA_NAMES.
- Apex SOA/NS are not drift. When comparing with an ird-hosted zone
or a seed, ignore the previous host's apex SOA/NS: ird drops them and
publishes its own.
- Seeding is timing-sensitive and replaces.
dns_claim_seed only
works while the claim is pending, only with a snapshot of this domain
taken by this account, and replaces any attached seed. Ask before
attaching; the copy must predate the nameserver switch.
Steps
A. Facts. ird domains info DOMAIN --json (--fields
whois,dns,registry for a domain I don't own; each field bills
(domains.info.per_field), so request only what's needed). Keep: registrar, expiry,
nameservers, DNSSEC/DS presence.
If DOMAIN is hosted on ird, dns_list_zones lists it (own or
delegated); if a claim exists, dns_claim_list (CLI: ird dns claims
list) shows its state.
B. Snapshot. ird domains dns-snapshot DOMAIN --names <EXTRA_NAMES>
[--subdomains] --json → save verbatim to OUT_DIR/DOMAIN-<date>.json.
Note the snapshot id the JSON carries (--snapshot / snapshot_id
take it later); its other fields are undocumented — read, don't assume.
Normalise: one row per name + type, values sorted, TTL aside (reported
separately).
C. Baseline.
- a file → load and normalise likewise;
ird-zone → dns_get_zone(domain=DOMAIN) (CLI: ird dns records
DOMAIN --json), drop the apex SOA/NS per rule 3;none → no diff; report the inventory alone.
D. Diff. Three lists — added (in snapshot, not in baseline),
removed (in baseline, not in snapshot — split per rule 2), changed
(same name + type, different values; show old → new). Then the MODE
checks:
- migration: every snapshot record exists in the ird zone or seed with
identical values; the apex is not a CNAME; no AAAA on names the ird
gateway will serve (IPv4 only — a stale AAAA blocks its certificate);
MX, SPF/DKIM/DMARC and
verification TXTs are present; a DS at the parent (step A) must go
before switching — claimed zones are unsigned;
- drift: changes at the apex, MX or
_dmarc are flagged high; CT-scan
subdomains are listed as "seen in certificate logs" with what they
resolve to.
E. Seed the claim (only if SEED_CLAIM is yes). dns_claim_get(
claim=DOMAIN) must show state: pending. Then
dns_claim_seed(claim=DOMAIN, snapshot_id=<id>) (CLI: ird dns claims
seed DOMAIN --snapshot <id>). It returns seed.records exactly as the
zone will start; diff those against the snapshot — only the apex SOA/NS
should be missing. For more names, dns_claim_seed(claim=DOMAIN,
names=[...]) takes a fresh copy and replaces the seed. Don't poll
dns_claim_verify; the switch itself is the bring-domain-dns prompt.
F. Verify from outside (shell, if available): dig +short <type>
<name> @<one of the snapshot's nameservers> for a few changed names,
so the report says whether the live answer still matches.
Deliverable
The facts block (registrar, expiry, nameservers, DS), the snapshot file
and id, the diff tables (added / removed / changed, TTL changes apart),
the MODE checks as pass/fail lines naming the failing record, the
seeding result if done, and the next step: for migration, the
EXTRA_NAMES to add before re-snapshotting or the go for the nameserver
switch; for drift, which changes look intended and which need the
owner's confirmation.