Skip to main content
POST
Import a zone file
Requires the IAM action dns:ImportZoneFile. See DNS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

Idempotency-Key
string

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.

Maximum string length: 255

Path Parameters

zone_id
string<uuid>
required

DNS Zone ID

Body

zone_file
string
required

The zone file, as text. $ORIGIN, $TTL, $GENERATE, relative names and parenthesised multi-line records are all honoured; $INCLUDE is refused, because the path it names would be read on our filesystem rather than yours.

Example:

"$ORIGIN example.com.\n$TTL 3600\nwww IN A 203.0.113.10\n@ IN MX 10 mail.example.com.\ndkim IN TXT \"v=DKIM1; k=rsa; p=MIIBIjANBgkqh\"\n"

Response

The file was imported. Read skipped before concluding the zone matches the file.

import
object

What the import did. records_created plus records_replaced is every RRset taken from the file; anything in skipped is still in the file but not in the zone.