dns/export

Export all DNS records for a zone as a BIND-format zone file (RFC 1035).

When to Use

Backup DNS configuration: Schedule a nightly export to S3 or another storage system to maintain a versioned history of DNS records for disaster recovery.
Provider migration: Export the zone file from Cloudflare to import into another DNS provider, or to migrate a zone from one Cloudflare account to another.
Environment documentation: Generate a point-in-time snapshot of all DNS records for a zone to include in infrastructure documentation or handover packages.
Cross-environment comparison: Export the staging and production zones and diff them to detect configuration drift before a release.
Disaster recovery preparation: Keep an exported zone file in a secure offline location so DNS can be recreated on any provider if Cloudflare becomes unavailable.

Configuration

Connection

Field	Type	Required	Description
`ApiToken`	string	required	Scoped Cloudflare API Token with `DNS.Read` permission. Store in BizFirst Credentials Manager.

Operation Fields

Field	Type	Required	Description
`ZoneId`	string	required	32-character hexadecimal Zone ID to export records from.

Sample Configuration

{
  "resource": "dns",
  "operation": "export",
  "connection": {
    "ApiToken": "{{ $credentials.cloudflare_dns_read }}"
  },
  "ZoneId": "023e105f4ecef8ad9ca31a8372d0c353"
}

Validation Errors

Code	Condition	Resolution
`MISSING_API_TOKEN`	ApiToken is empty	Set the ApiToken credential in the connection panel
`MISSING_ZONE_ID`	ZoneId is empty	Provide the Zone ID
`UNKNOWN_ERROR`	Cloudflare API error	Verify Zone ID and token permissions

Output

Success Port

Field	Type	Description
`zoneFile`	string	Complete BIND zone file content in RFC 1035 format. Can be written directly to S3, a file store, or passed to dns/import.

Error Port

On failure, the error port receives an object with code and message.

Sample Output

{
  "zoneFile": ";; Exported from Cloudflare\n$ORIGIN example.com.\n$TTL 1\n@ IN SOA victor.ns.cloudflare.com. dns.cloudflare.com. 2026052601 10000 2400 604800 3600\n@ IN NS victor.ns.cloudflare.com.\n@ IN NS uma.ns.cloudflare.com.\n@ IN A 198.51.100.4\nwww IN CNAME example.com.\nmail IN A 198.51.100.5\n@ IN MX 10 mail.example.com.\n@ IN TXT \"v=spf1 include:_spf.example.com ~all\"\n"
}

Expression Reference

Expression	Returns
`{{ $node.DnsExport.output.zoneFile }}`	Full BIND zone file as a string

Node Policies & GuardRails

Policy	Detail
Use DNS.Read scoped token	Export is read-only — do not over-scope the token
Store ApiToken in Credentials Manager	Never hardcode the token in configuration JSON
Store exports with timestamps	When writing zone files to S3 or storage, include a timestamp in the file name: `example.com-2026-05-26.zone`
Treat zone files as sensitive data	Zone files reveal your full DNS configuration — store in access-controlled locations, not public buckets
Validate before import	If using the exported file for dns/import, verify the zone file is valid RFC 1035 before passing it to the import operation

Examples

Example 1: Nightly DNS Backup to S3

Scheduled workflow (2:00 AM UTC): (1) Call zone/list to get all active zone IDs. (2) For each zone, call dns/export. (3) Write each zone file to S3 at dns-backups/{zoneName}/{date}.zone. (4) Send a nightly summary notification with backup file counts.

Example 2: Staging vs. Production Diff

Before each release: (1) Call dns/export on staging zone. (2) Call dns/export on production zone. (3) Feed both zone files into a CodeExecute node running a diff. (4) Send the diff output to the release Slack channel for review before DNS changes are applied to production.

Example 3: Zone File for Disaster Recovery Package

Monthly workflow: Export zone files for all production zones. Bundle them with other infrastructure documentation (TLS cert metadata, zone settings) into a ZIP file. Upload to an offline cold storage bucket with a 7-year retention policy for compliance requirements.