Namecheap DNS Management

Safe wrapper around the Namecheap API for DNS operations. Prevents accidental record wipeout by always fetching existing records first and merging changes.

⚠️ Why This Skill Exists

The Namecheap API's setHosts method replaces ALL DNS records for a domain. One wrong API call = your entire DNS config is gone. This skill:

• - ✅ Always fetches existing records first
• ✅ Merges new records with existing ones (unless explicitly replacing)
• ✅ Shows a diff preview before applying changes
• ✅ Auto-backups before every change
• ✅ Supports dry-run mode for safe testing
• ✅ One-command rollback from backups

Setup

1. Install dependencies

CODEBLOCK0

2. Enable Namecheap API access

1. 1. Go to https://ap.www.namecheap.com/settings/tools/apiaccess/
2. Toggle "API Access" ON
3. Whitelist your IP address
4. Copy your API key

3. Set environment variables

Add to ~/.zshrc or ~/.bashrc:

CODEBLOCK1

Usage

Verify DNS and detect ghost records

⚠️ IMPORTANT: Run this first!

CODEBLOCK2

This command compares DNS records visible to the Namecheap API with actual live DNS records (via dig). It will warn you about "ghost records" that exist in DNS but are invisible to the API (email forwarding, URL redirects, etc.).

List current DNS records

CODEBLOCK3

Note: This only shows records visible to the API. Use verify to see ALL records including those managed by Namecheap subsystems.

Add records (safe merge)

CODEBLOCK4

Safety: The skill automatically checks for "ghost records" before making changes. If detected, it will refuse to proceed unless you use --force.

Remove records

CODEBLOCK5

Backup & Restore

CODEBLOCK6

Record Format

TXT Records

CNAME Records

MX Records

A Records

Backup Location

Default: ./backups/ (relative to skill directory)

Configurable via environment variable:
CODEBLOCK11

Format: INLINECODE7

Each backup includes:

• - apiHosts: Records visible to Namecheap API
• INLINECODE9: Actual DNS records captured via INLINECODE10
• Timestamp and domain metadata

This allows you to see what was ACTUALLY live in DNS, not just what the API knew about.

Safety Features

1. 1. Ghost record detection — automatic check for records invisible to API
2. Auto-backup before changes — every add or remove creates a timestamped backup (includes DNS snapshot)
3. Dry-run mode — --dry-run shows what will change without applying
4. Diff preview — see exactly what records will be added/removed
5. Fetch-first — always gets current DNS state before changes
6. Merge logic — adds to existing records instead of replacing
7. Rollback — one command to restore from backup
8. Safety override — --force flag for when you need to bypass ghost record warnings

Examples

Mailgun Setup

CODEBLOCK12

Review the diff, then run without --dry-run to apply.

Known Limitations

⚠️ The Namecheap API is Destructive

The Namecheap domains.dns.setHosts API method replaces ALL DNS records for a domain. There is no "add one record" or "update one record" endpoint. Every change requires:

1. 1. Fetch all existing records (getHosts)
2. Modify the list
3. Upload the entire list (setHosts)

This skill handles this for you by always fetching first and merging changes.

🔍 Ghost Records: The Hidden Danger

Problem: domains.dns.getHosts does NOT return all DNS records. Records managed by Namecheap subsystems are invisible to the API:

• - Email Forwarding — MX, SPF, and DKIM records
• URL Redirect — A/CNAME records for domain parking/redirects
• Third-party integrations — Records added through Namecheap's dashboard for services

Since setHosts replaces all records, using the API can silently delete these hidden records.

🛡️ How This Skill Protects You

1. 1. verify command — Compares API records with actual live DNS (via dig) and warns about ghost records
2. Automatic safety check — Before any add, remove, or restore, the skill checks for ghost records
3. Refuses to proceed — If ghost records are detected, the operation is blocked (unless --force is used)
4. Clear warnings — Shows exactly which records will be lost if you proceed
5. DNS snapshots in backups — Captures actual DNS state via dig, not just API state

When to Use --force

Only use the --force flag when:

• - You've manually verified the ghost records are no longer needed
• You're intentionally removing email forwarding or URL redirects
• You understand and accept that those records will be deleted

Never use --force blindly. Always run verify first to see what will be lost.

Example: The Production Incident

This skill was created after adding Mailgun DNS records via the API wiped out Namecheap's email forwarding records. The email forwarding MX/SPF/TXT records were invisible to getHosts, so the fetch-merge-write pattern deleted them.

Now, the skill would have:

1. 1. Detected the ghost records during INLINECODE33
2. Refused to proceed without INLINECODE34
3. Shown exactly which email forwarding records would be deleted
4. Created a backup including the DNS snapshot

Troubleshooting

"API request failed: IP not whitelisted"

• - Add your current IP to https://ap.www.namecheap.com/settings/tools/apiaccess/
• Check with: INLINECODE35

"Invalid API key"

• - Verify NAMECHEAP_API_KEY is set correctly
• Re-enable API access if needed

"Domain not found"

• - Ensure domain is in your Namecheap account
• Check spelling (case-sensitive)

API Reference

Namecheap API docs: https://www.namecheap.com/support/api/methods/domains-dns/