DNS change management for enterprises.
Approval workflows, multi-provider support, drift detection, and full audit trails.

Website · Documentation · Changelog · Contact

Netra gives infrastructure teams safe, auditable control over DNS changes across all their providers. Every record change goes through an approval workflow before touching production DNS — with full audit logging, drift detection, and compliance controls built in.

End users pick a domain and submit a request. Netra routes it to the right provider automatically — they don't need to know whether the zone lives on Windows DNS, Route 53, or Cloudflare.

Workflow & Compliance

• Two-person approval rule — submitter cannot approve their own request
• One-click approve/reject from Slack, Teams, Discord, or email
• Maintenance windows — restrict when changes can be applied
• Change management (CAB) — require ticket references for specific environments
• Immutable audit log — every action logged with actor, timestamp, IP, and detail
• Rollback — one-click revert of any applied change

Multi-Provider

• Manage all providers from a single UI
• Provider-agnostic workflow — users don't need to know where a zone lives
• Zone import, auto-sync, and BIND file import
• Drift detection — periodic comparison of live DNS vs expected state

Access & Authentication

• Three-tier roles — Admin, Approver, User
• SSO — Okta, Microsoft Entra ID, Generic OIDC
• LDAP / Active Directory with group-based role mapping
• API tokens for CI/CD pipelines
• IP allowlist

Integrations

• Notifications — Slack, Teams, Discord, PagerDuty, Opsgenie, Email, Webhooks
• CI/CD — GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, Azure DevOps
• Terraform provider
• Syslog / SIEM forwarding (Splunk HEC, Elastic, Loki)
• Prometheus metrics endpoint
• Scheduled compliance reports

Operations

• Ships with SQLite (zero-config) or connect PostgreSQL for HA
• Automated database backups with configurable retention
• Structured JSON logging
• Health probes for Kubernetes and Docker orchestration
• Graceful shutdown — zero dropped requests during deploys

• Linux host (x86_64 or ARM64)
• Docker Engine 24+ and Docker Compose v2
• 1 GB RAM minimum, 2 GB recommended
• 1 GB disk for the application, plus storage for your DNS database

Single container. No external dependencies. No configuration files required — everything is configured through the browser after first boot.

mkdir netra && cd netra

Create a docker-compose.yml:

services:
  netra:
    image: ghcr.io/netradns/netra:latest
    container_name: netra
    restart: unless-stopped
    ports:
      - "8089:3000"
    volumes:
      - ./data:/data

  winrm-proxy:
    image: ghcr.io/netradns/netra-winrm-proxy:latest
    container_name: netra-winrm-proxy
    restart: unless-stopped
    volumes:
      - ./data:/data:ro

docker compose up -d

A production-ready docker-compose.yml with log rotation, healthchecks, resource limits, and internal DNS hints is included in this repo.

mkdir -p netra/data && cd netra

docker run -d \
  --name netra \
  --restart unless-stopped \
  -p 8089:3000 \
  -v ./data:/data \
  ghcr.io/netradns/netra:latest

docker run -d \
  --name netra-winrm-proxy \
  --restart unless-stopped \
  -v ./data:/data:ro \
  ghcr.io/netradns/netra-winrm-proxy:latest

Open http://your-server:8089 and complete the setup wizard.

Data is stored in ./data/ — back up this directory to preserve your database and configuration.

docker compose pull
docker compose up -d

Netra runs database migrations automatically on startup. No manual steps required.

Netra includes built-in backup support configurable from Settings → Database:

• On-demand and scheduled backups
• Configurable retention policy
• Network storage support (NFS/SMB mount)

For manual backup, stop the container and copy the ./data/ directory.

Netra is designed to be safe by default in production environments:

• Approval on by default — no DNS changes are applied until explicitly approved
• Two-person rule — submitter cannot approve their own request
• Encryption at rest — WinRM passwords and cloud credentials stored using AES-256-GCM
• Session management — persistent sessions with configurable TTL and max concurrency
• IP allowlist — restrict access by source IP
• Audit everything — immutable log of every action with actor, timestamp, IP, and detail

See SECURITY.md for vulnerability reporting.

resource "netra_dns_request" "web" {
  domain       = "example.com"
  record_type  = "A"
  record_name  = "www"
  record_value = "10.0.1.50"
  action       = "create"
}

- name: Create DNS Record
  run: |
    curl -X POST https://netra.corp.local/api/requests \
      -H "Authorization: Bearer ${{ secrets.NETRA_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{
        "domain_name": "example.com",
        "record_type": "A",
        "record_name": "api",
        "record_value": "10.0.2.100",
        "action": "create"
      }'

Full documentation including provider setup guides, SSO configuration, CI/CD integration, API reference, and troubleshooting is available at netradns.com/docs.html.

• Documentation: netradns.com/docs.html
• Questions, bug reports, & feature requests: netradns.com/contact.html
• Security vulnerabilities: see SECURITY.md

Netra is commercial software. See LICENSE for terms.

Get in touch to schedule a demo or start a trial.