Restore a DNS backup only after reviewing a preview against the zone as it exists now. The restore service checks the saved snapshot, current management records and provider readback. It can refuse a stale or unsafe plan before publishing changes.
| Method | Resource | Scope | Idempotency-Key |
|---|---|---|---|
POST |
/v2/dns/backups/{backupId}/restore-preview |
dns:backup |
Required |
POST |
/v2/dns/backups/{backupId}/restore |
dns:backup |
Required |
01 Review the intended recovery
- List the zone's backups and select the public backup ID belonging to that zone. Confirm its creation time, record count and reason for capture.
- Resolve an active migration, management lock or unfinished DNS change before starting another recovery. Deleted zones use the separate deleted-zone restore workflow.
- Request
restore-preview. Review records added, updated and removed, protected records retained, skipped historical system records and the reported service impact. - Save the returned
preview_hashwith the approved plan. Check that the snapshot predates the incident without discarding legitimate changes made since then. - Submit
restorewith that exact hash and a new idempotency key for the restore request. Follow the returned changeset or job through approval, execution and verification.
02 When a preview is refused
DNS_RESTORE_DRIFT means the provider and managed record list disagree. Investigate the outside edit or incomplete synchronisation, reconcile the intended state and preview again. DNS_RESTORE_CHANGED means evidence changed after review. Obtain a fresh preview and repeat the review; changing a hash in the request does not provide a valid approval.
The snapshot service preserves currently protected records, including provider-controlled DNSSEC material and system or forwarding records. A backup is therefore not a command to replace every provider setting with historical data. Nameserver delegation, registrar contacts and domain renewal are separate operations.
Common questions
Can I reuse yesterday's approved preview?
Only if it still matches the current checked evidence, which the service verifies. A new record, ownership assignment or provider state can invalidate it. Treat preview conflicts as a reason to inspect the new state.
How do I know the restore succeeded?
Confirm the job's outcome, inspect the resulting record list and query the authoritative nameservers for the affected website, mail and verification records. A completed task does not expire existing resolver caches immediately.