Introducing the official Command-Line Interface for OnlyDNS. Manage DNS zones, record sets, automated 1-click DNSSEC, and RFC 2136 TSIG keys directly from your terminal or CI/CD pipelines with zero-install npx execution and structured JSON outputs.
Modern developers and infrastructure engineers shouldn't have to break their flow to click through web dashboards just to update a DNS record, check DNSSEC keys, or provision TSIG credentials. Today, we are excited to release @onlydns/cli, our official command-line interface designed to bring fast, type-safe authoritative DNS management straight into your terminal and CI/CD pipelines.
Built on TypeScript and packaged as a lightweight, zero-bloat CLI, @onlydns/cli supports both global installation and zero-install execution via npx or bunx. It provides full access to the OnlyDNS System API, human-friendly formatted terminal tables, and strict, clean JSON output for integration with tools like jq, Python, and bash deployment scripts.
Instant Installation & Execution
You can install the CLI globally or run it on-demand without installing:
Install once to have the onlydns command available everywhere:
npm install -g @onlydns/cli
# Or: pnpm add -g @onlydns/cli
# Or: bun add -g @onlydns/cliRun directly in ephemeral environments or Docker containers:
npx @onlydns/cli domains list
bunx @onlydns/cli records list example.comFlexible & Secure Authentication
The OnlyDNS CLI supports multiple authentication mechanisms structured for local development and headless CI/CD runners:
1. Stored Credentials (Local Machines)
Store your API token securely with file mode 0600 permissions (readable only by your user account):
# Save your API key to ~/.config/onlydns/config.json
onlydns config login
# Check authentication status
onlydns config show 2. Environment Variables & Flags (CI/CD)
In automated pipelines (GitHub Actions, GitLab CI, Jenkins), supply the token via environment variable or command-line flag:
export ONLYDNS_API_KEY="your_api_token"
onlydns domains list
# Or pass explicitly per command:
onlydns -k "your_api_token" records list example.comCore CLI Functionalities
🌐 1. Domain & Record Management
Manage zones and record sets with intuitive subcommands and powerful pattern filters:
# List all managed domains
onlydns domains list
# Create a new domain zone
onlydns domains create example.com
# List all records in a zone
onlydns records list example.com
# Find records matching specific criteria
onlydns records find example.com --name api
onlydns records find example.com --type A
onlydns records find example.com --value 192.0.2.1
# Add / Append DNS record values (merges safely into existing sets)
onlydns records add example.com --name www --type A --value 192.0.2.1 --ttl 300
onlydns records add example.com --name @ --type TXT --value "v=spf1 include:example.com ~all"
# Update / Replace all values for a record
onlydns records update example.com --name www --type A --value 192.0.2.100 --ttl 600
# Remove an entire record
onlydns records remove example.com --name old-service --type A🛡️ 2. Automated 1-Click DNSSEC
Inspect cryptographic DS keys or toggle DNSSEC signing instantly:
# Check DNSSEC status and DS record parameters (Key Tag, Digest Type, Digest)
onlydns dnssec status example.com
# Enable automated DNSSEC signing
onlydns dnssec enable example.com
# Disable DNSSEC signing
onlydns dnssec disable example.com🔐 3. RFC 2136 TSIG Keys
Provision cryptographic TSIG keys for dynamic DNS and automated Let's Encrypt / ZeroSSL certificate issuance via Certbot, acme.sh, Caddy, or Traefik:
# List all account TSIG keys
onlydns tsig list
# Generate a new TSIG key (key name is generated automatically)
onlydns tsig create --algo hmac-sha256
# View TSIG permissions configured on a domain
onlydns tsig get-domain example.com
# Configure TSIG permissions for Dynamic DNS Updates & AXFR across zone
onlydns tsig set-permissions example.com <key_name> --update --transfer
# Restrict Dynamic DNS Updates to specific subdomain(s) (e.g. ACME challenges)
onlydns tsig set-permissions example.com <key_name> --update --subdomain _acme-challengeScripting with Structured JSON & jq
Every command in @onlydns/cli supports the global --json flag, emitting clean, unadorned JSON arrays and objects suitable for parsing with jq or Python:
# Extract all A record IP targets for a domain
onlydns --json records list example.com | \
jq -r '.[] | select(.type=="A") | .records[]'
# Check if DNSSEC is enabled in a deployment script
IS_SIGNED=$(onlydns --json dnssec status example.com | jq -r '.enabled')
if [ "$IS_SIGNED" = "true" ]; then
echo "DNSSEC verified!"
fiExplore the Documentation & Features
To learn more about the OnlyDNS CLI and related automation capabilities, check out our dedicated resource hubs:
- Dedicated CLI Feature Guide: Comprehensive flag reference, environment configurations, and advanced command parameters.
- RFC 2136 / TSIG ACME How-To Guides: Step-by-step SSL/TLS certificate automation tutorials for Certbot, acme.sh, Caddy, Traefik, and cert-manager.
- Automated 1-Click DNSSEC: Cryptographic zone signing with automatic Zone Signing Key (ZSK) rollover.
- AI Agents & MCP Integration: Model Context Protocol tooling for Claude Desktop and Cursor.
- Zero-Downtime Migration: Step-by-step zone transfer and record migration guide.
- Web Management Interface: Visual DNS record management alongside CLI and API automation.