Namecheap DNS
from your terminal.

✓ Validated before anything is sent

Records are checked against your input and against the zone the write would produce, so conflicts with what is already there are caught too. Nothing is written if anything would be invalid.

• A holds IPv4, AAAA holds IPv6 — each suggests the other when swapped
• CNAME, ALIAS, NS and MX point at a hostname, not an IP or URL
• CAA flags and tags, SRV’s four fields, URL records with a scheme
• No CNAME at the root, no CNAME sharing a host, one SPF per host
• TTL inside the 60–60000 seconds Namecheap accepts

Legal-but-suspect input — a duplicate record, an over-long TXT string — is a warning, not a refusal. Checks are scoped to the hosts you are changing, so an old problem elsewhere never blocks an unrelated update.

↺ Every change is reversible

The zone is snapshotted locally before each write, and dns rollback puts it back — through the same diff-and-confirm flow, so you see what it will do first.

$ namecheap dns rollback example.com --list
╭────────────┬─────────────────────────┬─────────┬──────────────╮
│ ID         │ Taken                   │ Records │ Before       │
├────────────┼─────────────────────────┼─────────┼──────────────┤
│ 1755600000 │ 2025-08-19 10:40:00 UTC │ 1       │ preset apply │
│ 1755500000 │ 2025-08-18 06:53:20 UTC │ 2       │ dns sync     │
╰────────────┴─────────────────────────┴─────────┴──────────────╯

Snapshots carry the account’s mail routing mode alongside the records — restoring one without the other would silently unpublish your MX. The 20 most recent per domain are kept.

⚿ Your API key is not in a dotfile

A Namecheap API key is full control of the account’s domains. auth login puts it in the OS keychain — Keychain on macOS, Credential Manager on Windows, Secret Service on Linux — so the config file holds no secret and is safe to sync or commit.

Credentials are verified against the API before being saved, so a mistyped key is never stored. Headless machines fall back to a 0600 config file rather than failing, and auth status tells you which source answered.

↔ Writes are read back

A success response is not proof the change landed. After a write the zone is read again and compared, and a mismatch is its own error — not a green tick over a zone that never changed.

The same suspicion runs through the retry policy: transient failures retry three times with backoff, but everything that spends money — domains renew, whoisguard renew, transfer start — is excluded, so a lost response can never become a second charge.