DNS & SSL
Every domain, record and certificate in one ledger.
BETAZones and records across Route 53, Cloudflare, Azure DNS, Cloud DNS, OCI and your own PowerDNS or BIND, plus the certificates that depend on them, all issued, renewed, deployed and watched, with every DNS change planned, verified and reversible.
SEE IT RUN
THE MANUAL WAY
How certificates and DNS fail in practice.
RENEWED, NEVER RELOADED
The certificate renewed on schedule. The web server was never reloaded, kept serving the old one, and the site went offline on the date everyone thought had been handled.
THE APEX RECORD
A record at the root of the domain was edited by hand during a migration. Email and the website stopped resolving together, and the old value was not written down anywhere.
FIVE PROVIDERS, NO LIST
Domains are split across a registrar, Cloudflare and two clouds. Asking "which certificates expire this month" means logging into all of them.
WHAT TALOS DOES
Six tasks that no longer depend on calendar reminders.
One ledger across providers
Zones and records from five cloud providers and self-hosted nameservers, plus domain expiry from public registration data, with no registrar credentials needed for that part.
Changes that plan, verify and reverse
Each change shows its diff and what else it affects, re-reads live state before applying, checks the authoritative nameservers after, and rolls back as an ordinary change with the same protections.
Issuance with a pre-flight
ACME certificates over DNS-01 or HTTP-01. A free pre-flight checks zone access, CAA records and rate-limit budget first, so attempts stay within the certificate authority’s rate limits.
Renewal that ends with a deploy
Certificates renew inside thirty days and are pushed to the hosts and cloud load balancers that serve them. A renewal that is not deployed has changed nothing.
Endpoint scanning
Talos connects to each endpoint and reads the certificate currently being served, so a renewed-but-never-reloaded certificate shows up before it expires.
DNSSEC, revocation and CT
DNSSEC status, OCSP and CRL revocation checks, opt-in certificate-transparency monitoring, and a lint pass over every zone.
HOW IT RUNS
Every action is a tracked job.
WHAT MAKES THIS DIFFERENT
Talos tells normal DNS caching apart from a real failure.
After a DNS change, public resolvers will keep serving the old answer until its TTL runs out. Treat that as a failure and every change ever made raises a false alarm. Ignore it and a genuinely broken change looks the same as a slow one. Talos separates the two: the authoritative nameservers must agree immediately, and public resolvers are allowed until the old TTL has passed. Changes that touch the root of a domain, and revealing a private key, need a second person to approve.
RELATED CAPABILITIES
Import your zones, read-only.
Domains, records and certificates are discovered first. Nothing is changed until you take a zone under management.