Overview

Netra is a multi-provider DNS management platform that brings change control, approval workflows, and full audit logging to your DNS infrastructure — regardless of where your zones are hosted.

Organizations use Netra to eliminate unreviewed DNS changes, consolidate management across providers, and maintain compliance with internal change management policies.

The Problem

Most organizations manage DNS across multiple providers — Windows DNS for internal infrastructure, Route 53 or Cloud DNS for public-facing services, sometimes Azure DNS for Microsoft workloads. Each provider has its own console, its own access model, and no built-in change approval process.

The result: DNS changes happen without review, without audit trails, and without anyone knowing until something breaks.

How Netra Solves It

• Unified interface — Manage all providers from one UI. End users pick a domain and submit — they don't need to know which provider hosts it.
• Approval workflows — Every change goes through a configurable review process before touching production DNS.
• Complete audit trail — Every action is logged, exportable, and forwardable to your SIEM.
• Drift detection — Continuous monitoring alerts you when live DNS diverges from approved state.
• Enterprise identity — LDAP/Active Directory, Okta, Microsoft Entra ID, or any OIDC provider with role-based access control.

Who It's For

Architecture

Netra deploys as a containerized application within your network. It connects outbound to your DNS providers — no inbound access required, no data leaves your environment.

Key Principles

• Zero data egress — All data stays within your infrastructure. No telemetry, no cloud dependencies.
• Embedded data store — No external database to provision, patch, or back up separately. (PostgreSQL supported for enterprise deployments that prefer a managed database.)
• Stateless-friendly — Single persistent volume for data. Container can be replaced, scaled, or migrated without coordination.
• Provider-agnostic — Communicates with each DNS provider via its native API. No agents or plugins required on your DNS servers.

Network Requirements

High Availability

Netra supports deployment behind a load balancer with shared persistent storage. Health endpoints are built in for readiness and liveness probes.

DNS Providers

Connect any number of providers and assign domains to each. Netra routes changes to the correct provider automatically.

Supported Providers

Provider-Agnostic Workflow

End users never interact with provider credentials or consoles. They select a domain from a dropdown, fill in the record details, and submit. Netra handles routing, authentication, and execution against the correct provider.

Multi-Provider Domains

Each domain is assigned to exactly one provider. Organizations with hundreds of domains across multiple providers manage them all from the same interface with consistent approval policies.

Change Control

Netra's approval system ensures no DNS change reaches production without appropriate review.

Workflow

1. Submit — Any authorized user creates a DNS change request
2. Pre-flight check — Netra queries live DNS to warn of conflicts before submission
3. Review — An approver or admin reviews and approves/rejects
4. Apply — Approved changes are executed against the DNS provider
5. Verify — Drift detection confirms the change took effect

Two-Person Rule

By default, the submitter cannot approve their own request. A second authorized user must review and approve before any change is applied to production DNS.

Emergency Bypass

Admins and approvers can bypass the two-person rule when necessary — for example, during an incident where the only available responder is also the submitter. Bypass requires explicit confirmation and is prominently flagged in the audit log with full context, ensuring accountability without blocking critical operations.

Scheduled Changes

Approve changes during business hours and schedule them to apply at a specific time — during a deploy window, a maintenance period, or any future date. The change executes automatically with full audit context. No one needs to be awake at 2am to click "apply."

Maintenance Windows

Optionally define time windows when changes are permitted. Approved requests submitted outside the window are queued and applied automatically when the window opens — preventing accidental production changes during business-critical hours.

Request Templates

Administrators create reusable templates for common DNS changes. Users select from a dropdown — reducing errors and standardizing submissions.

Rollback

Any applied change can be rolled back with one click. Rollbacks create an inverse change request that goes through the normal approval workflow, maintaining the audit trail.

Identity & Access

Enterprise identity integration with granular role-based access control. Netra supports multiple authentication methods — from built-in local accounts to enterprise directory services and cloud identity providers.

Authentication Methods

Compatible with Keycloak, Auth0, PingFederate, Authentik, and any standards-compliant OIDC provider.

LDAP / Active Directory

Native LDAP integration for organizations that authenticate against Active Directory or other LDAP-compliant directories. Ideal for environments managing Windows DNS where AD is already the identity source of truth.

• Bind and search — Authenticates users via LDAP bind with configurable base DN and search filter
• Group-based roles — Map AD security groups directly to Netra's Admin, Approver, and User roles
• LDAPS support — Encrypted connections over port 636 with certificate validation
• No IdP subscription required — Works directly against your existing domain controllers

Role Model

Session Security

• Maximum 5 concurrent sessions per user
• Configurable session TTL (1–72 hours)
• Sessions persist across application restarts
• Active session visibility and remote revocation
• Full login/logout/failure history with IP addresses

Notifications

Real-time notifications keep stakeholders informed and enable one-click approvals without opening the UI.

Channels

One-Click Actions

Approve or reject requests directly from notification messages. Actions are authenticated via cryptographically signed tokens — no session required.

Reliability

• Automatic retry with exponential backoff (30s → 2min → 10min, max 3 attempts)
• Per-channel delivery log with status, response time, and error details
• Webhook payload includes structured data for downstream automation (ServiceNow, Ansible, CMDB)

Drift Detection

Continuous monitoring compares live DNS against approved state, alerting when records diverge from what was authorized.

How It Works

1. On a configurable interval, Netra queries live DNS for all managed records
2. Compares live values against the last approved and applied state
3. Differences are flagged as drift alerts on the dashboard
4. Notifications are sent via configured channels

Use Cases

• Detecting unauthorized out-of-band changes made directly in provider consoles
• Identifying propagation failures where approved changes didn't take effect
• Compliance evidence that DNS state matches approved records

Acknowledgment

Drift alerts can be acknowledged individually or in bulk — useful during initial onboarding or planned migrations. Acknowledgments are logged in the audit trail.

Zone Management

Full visibility into your DNS estate with import, export, and continuous synchronization.

Zone Browser

Search, filter, and browse all records across any managed domain. Click any record to view its full change history.

Import Options

• Provider sync — Pull all existing records from a connected provider
• BIND zone file — Upload standard BIND-format zone files
• Auto-sync — Zones re-synchronize automatically on a configurable interval
• Bulk sync — One-click import across all configured domains

Export

• CSV export for reporting and analysis
• BIND zone file export for backup or migration

Bulk Operations

Submit multiple DNS changes via CSV upload. Each row becomes a separate request flowing through the standard approval workflow.

Automation & CI/CD

Integrate DNS management into your existing automation pipelines.

API Tokens

Create named, revocable API tokens for programmatic access. All token usage is recorded in the audit log with the token name for traceability.

CI/CD Integration

• GitHub Actions — Submit DNS changes via HMAC-SHA256 signed webhook as part of deployment workflows
• GitLab CI/CD — Token-verified webhook integration with pipeline metadata
• Bitbucket Pipelines — Token-verified webhook integration for Atlassian environments
• Azure DevOps — Token or Basic auth webhook integration with build metadata
• Pipeline requests are tagged with source system in the audit log
• Configurable auto-approve for trusted pipeline sources (requires explicit CONFIRM acknowledgment)

Terraform Provider

Manage DNS records as infrastructure-as-code. The Netra Terraform provider applies changes directly via the appropriate DNS provider, integrating with your existing IaC review process.

Webhook Payloads

Outbound notifications include structured data objects suitable for downstream automation — ServiceNow ticket creation, Ansible playbook triggers, CMDB synchronization.

Status API

Read-only JSON endpoints for monitoring dashboards — pending request count, drift alert status, and provider health summary.

Compliance & Audit

Immutable audit logging with enterprise-grade retention and forwarding capabilities.

What's Captured

• Every request submission, approval, rejection, and application
• All login attempts (success and failure) with IP addresses and user agents
• Configuration and settings changes
• Provider credential modifications
• Session lifecycle events
• API token creation, usage, and revocation
• Drift detection results and acknowledgments
• Bypass approvals (prominently flagged)

SIEM Integration

Forward audit events in real-time to your security platform:

• Syslog (UDP and TCP)
• HTTP collectors (Splunk HEC, Elastic, custom endpoints)
• Structured JSON format compatible with any log aggregator

Retention & Export

• Configurable retention periods
• CSV export filtered by date range, user, or action type
• Admin-controlled purge with confirmation safeguard

Compliance Alignment

Netra's change control and audit capabilities support compliance with frameworks that require documented change management processes, separation of duties, and audit trails — including SOC 2, ISO 27001, and internal ITIL/ITSM policies.

Deployment Options

Netra deploys within your environment — on-premises, private cloud, or managed cloud infrastructure. No data leaves your network.

Supported Platforms

Resource Requirements

Database Options

Netra ships with an embedded SQLite database — zero configuration, no external dependencies. For organizations that prefer a managed database or need to integrate with existing infrastructure, Netra also supports PostgreSQL as an optional backend.

Switching between engines is non-destructive — Netra includes a built-in migration tool that transfers all data bidirectionally. Connection pooling, SSL, and encrypted credential storage are supported for PostgreSQL deployments.

For SQLite deployments, scheduled backups run automatically on a configurable interval with retention policies and support for network-mounted storage (NFS/SMB). A one-click database download is also available in Settings → Database for ad-hoc backups. PostgreSQL deployments use standard pg_dump tooling managed by your DBA team.

Health Monitoring

Three built-in health endpoints support different orchestration needs: /api/health for general status, /api/health/live for liveness probes (event loop responsive), and /api/health/ready for readiness probes (verifies DB connectivity). Compatible with Kubernetes, Docker healthchecks, ALB target groups, and any monitoring system. Every response includes an X-Request-Id header for log correlation.

Onboarding

Our team provides deployment guidance tailored to your infrastructure. Contact us to schedule a deployment planning session.

Security Model

Netra is designed to be safe by default — approval is enforced from first boot with no configuration required.

Data Protection

• All provider credentials encrypted at rest using AES-256-GCM
• Session tokens cryptographically signed
• No data transmitted to external services — zero telemetry
• All provider communication over encrypted channels (TLS/HTTPS)

Access Control

• Three-tier RBAC (Admin, Approver, User)
• SSO with group-based role mapping (LDAP/AD, OIDC)
• API tokens with named identity for automation
• Session limits and configurable TTL
• Remote session revocation

Change Safety

• Two-person rule enforced by default
• Pre-flight conflict detection before submission
• Confirmation safeguard for overwriting existing records
• Maintenance windows to restrict change timing
• Rollback capability with full audit trail

Operational Security

• Hardened container image with minimal attack surface
• No inbound network access required (outbound-only to providers)
• Structured logging compatible with security monitoring
• Real-time audit event forwarding to SIEM

Next Steps

For detailed configuration guides, API reference, CI/CD pipeline setup, Terraform provider documentation, and troubleshooting, see the Technical Documentation.