Reconciliation and Drift

The stored state of a managed zone is the desired state. If someone changes something directly at the provider — through its web console, a script, or another tool — a deviation arises. This deviation is called Drift, and it is displayed rather than silently corrected.

Drift kinds

Kind	Meaning
MODIFIED	The entry exists on both sides but has different values at the provider
DELETED	We know the entry; it is missing at the provider
ADDED	An entry exists at the provider that we do not know

Resolving

For every finding there are three options:

• Enforce — our desired state is pushed through at the provider. The way to go for unwanted external changes.
• Adopt — the provider’s state becomes the new desired state. The way to go when the change there was intentional and correct.
• Ignore — this combination of name and type will no longer be reported. For entries that are deliberately maintained elsewhere.

When checks run

The reconciliation runs cyclically in the background (at most every 15 minutes, with backoff on repeated failures), additionally before applying changes, and at any time manually via Check now in the zone.

Why this matters

After restoring a backup, the stored state may be older than the one at the provider. The drift mechanism turns this into no data loss: whatever happened since shows up as MODIFIED or ADDED and can be brought back deliberately via Adopt. The providers thus serve as a second leg to stand on — a desired-state DNS manager loses less in a restore than an ordinary application.

Propagation traffic light

After every change, each record row of the zone shows a traffic light: how far has the new state spread?

Colour	Meaning
Red	The provider’s authoritative name servers do not serve the new state yet.
Yellow	Live at the provider, but at most half of the public test resolvers are current.
Dark green	The majority of test resolvers is current — caches may lag until the TTL expires.
Light green	The TTL has elapsed since the authoritative confirmation — every cache may be current (computed).

Checks run automatically after every change (every 30 seconds at first, relaxing over time, until everything is light green) and manually via Check propagation. The tooltip shows the counters (authoritative servers, resolvers) and, on dark green, the time from which the change counts as fully propagated. The test resolvers are configurable in the core settings under propagation.resolvers (also via DNSE_PROPAGATION_RESOLVERS); without an entry Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9) and OpenDNS (208.67.222.222) are asked — so an internal company DNS can be watched too.