Public DNS view
The root domain’s records visible through a public resolver are scanned. This is not a complete zone export, and recursive cache behavior can affect results.
Meaningful change history
Added and removed records appear in snapshots. TTL drift caused by recursive caches is not treated as a content change.
Optional Cloudflare connection
A Cloudflare token limited to Zone: Read and DNS: Read can synchronize provider records in read-only mode. zonehelm does not write DNS records.