VPS Snaps

DNS Backups

Back up the DNS your site runs on

Every record in your Cloudflare zones, saved on a schedule to storage you own. When something breaks, see exactly what changed since the backup and put back only that.

Back up your first server free, forever. No credit card required.

We only use your email to create your account. See our Privacy Policy.

A deleted record takes a site down as surely as a dead server

And it is the one part of the stack most backups never see. Connect Cloudflare, choose a zone and a bucket, and each run keeps the whole zone.

  • Every record, as Cloudflare holds it. A, AAAA, CNAME, MX, TXT, CAA, SRV and the rest, with proxying, TTLs, priorities and comments.

  • A BIND file in every backup. The standard zone file format, so the backup is useful with nothing but your storage and any DNS host.

  • Checked as it lands. Hashed on upload and read back from your bucket, like every other backup, with the same schedules and retention. On every plan, Free included.

What lands in your bucket
acme-backups/dns/7c1e9a2f/
  example.com-2026-09-28T02-00-04-512Z.dns.json.gz
What is inside it
{
  "format": "vpssnaps.dns-zone.v1",
  "zone": { "id": "023e105f4ecef8ad9ca31a8372d0c353", "name": "example.com" },
  "takenAt": "2026-09-28T02:00:04.498Z",
  "records": [
    { "type": "A", "name": "www.example.com", "content": "198.51.100.20",
      "proxied": true, "ttl": 1 },
    { "type": "MX", "name": "example.com", "content": "mx1.mailhost.net",
      "priority": 10, "ttl": 3600 },
    …
  ],
  "bind": ";; Domain: example.com. …"
}
Getting it back without us
$ gunzip -c example.com-*.dns.json.gz | jq -r .bind > zone.txt

# then import zone.txt at Cloudflare (DNS → Records → Import)
# or at any DNS host that takes a zone file

A restore that shows its work first

Wiping a zone and reloading it would take the domain off the air while it ran. A restore here is a comparison, and it only writes what the comparison finds.

  1. Step 1

    Preview

    The backup is read from your storage, checked against the checksum recorded when it was taken, and compared with the zone as it is now, record by record. Every difference is listed — changed, deleted, added since — and nothing is written. Anyone in the workspace can run one.

  2. Step 2

    A safety copy first

    Restoring is for owners and admins, who type the zone's name to confirm. Before anything is written, the zone as it is now is stored as a backup of its own, and the changes are worked out against that copy.

  3. Step 3

    Only the differences

    Records that already match are left alone, so the rest of the zone never blinks. A record pointing somewhere else is changed back in place, keeping its proxying and TTL from the backup; a deleted one is created again.

  4. Step 4

    Read back, or put back

    Afterwards the zone is read again and compared with the backup. If Cloudflare refuses a change partway, everything already written is undone from the safety copy, and the restore says which record it refused.

The days it is for

Each of these shows up in the preview as a line you can read before anything is written.

A record deleted while tidying up

The preview shows it as missing. The restore creates it again and touches nothing else.

In the preview

create: A api.example.com → 198.51.100.14

A cutover that pointed at the wrong server

The address goes back, proxied or not, with its old TTL. Records added for the move stay unless you ask for them to go.

In the preview

change: A www.example.com → 203.0.113.99 ⇒ A www.example.com → 198.51.100.20 (proxied)

Email that stopped arriving

An MX priority or an SPF record edited wrong. The old and new values sit side by side before anything changes.

In the preview

change: TXT example.com → "v=spf1 -all" ⇒ TXT example.com → "v=spf1 include:_spf.mailhost.net ~all"

A script or an import that rewrote the zone

Switch on removing records added since the backup, and the zone ends exactly as it was backed up.

In the preview

remove (added since the backup): CNAME old.example.com → legacy.example.net

Four things to know before you rely on it

Where it stops, written down now rather than found out during an outage.

Cloudflare zones only

The connection is to Cloudflare, by signing in or with an API token limited to Zone Read and DNS Edit. Route 53, DigitalOcean DNS and a registrar's own DNS aren't connected, though the BIND file in every backup is the standard zone file format most DNS hosts can import.

Records, not the rest of the zone

What is backed up is the DNS records: every type, with proxying, TTLs, priorities and comments. The zone's SSL mode, page rules, firewall rules, Workers and DNSSEC setting are not in the backup.

Some changes it will not guess at

A record Cloudflare manages itself is skipped. A CNAME is never created beside other records at the same name, which DNS forbids. Where several records at one name changed at once, the backup's are created and the zone's kept, rather than guessing which became which. Anything skipped is named in the preview, with the reason.

Read by our worker, kept by you

A zone has no server of yours to run anything on, so our worker reads it through Cloudflare's API and writes it straight on to your storage — in memory only, never kept. The job page and the DPA both say so.

Setting one up, restoring, and doing it all by hand are in the DNS zone backups guide.

The rest of the way back

DNS is the last hop between a working server and the people trying to reach it. These cover the hops before it.

Failover by DNS

On Pro and Agency, the same Cloudflare connection lets automatic failover point your records at a recovery server — on any cloud, AWS Lightsail and Google Compute Engine included.

Read more

Switching providers

Move a WordPress, Laravel, Craft or Ghost site to a new server, checked on both sides, before you point the DNS at it.

Read more

VPS snapshots

The server the records point at, captured whole inside your own cloud account, on the same schedule and dashboard.

Read more

Powerful features to give you peace of mind

Rest easy knowing your data and your reputation are safe.

Bring your own storage
Backups land in your own S3-compatible bucket — Backblaze B2, Wasabi, Cloudflare R2, or plain S3 — or in your own Google Drive. You hold the keys and the data.
Snapshots stay with your provider
Provider snapshots are created through the provider's own API and never leave your account. We store the snapshot ID, not the image.
Seven providers, one dashboard
DigitalOcean, Hetzner, Vultr, Linode, AWS EC2, Google Compute Engine and Microsoft Azure — scheduled and reviewed from the same place.
A replacement server on demand
Recover now builds a new server on your own DigitalOcean, Hetzner, Vultr, Linode, AWS EC2, AWS Lightsail, Azure or Google Compute Engine account, from its snapshot or from its backups, software included.
Failover on any cloud
When a server stops answering, its traffic moves to the recovery server: by reserved or floating IP where your cloud has one, or by your DNS on Cloudflare, which works on every cloud.
Your DNS zones, backed up
Every record in a Cloudflare zone, kept in your own storage as a BIND file too. A restore previews what differs and writes back only that.
Schedules that fit your traffic
Hourly, daily, weekly, monthly, or a fixed interval in minutes — anchored to your timezone, so a 02:00 job stays at 02:00 across a DST change.
Retention that prunes itself
Set how many days to keep. Older snapshots and archives are cleaned up after each successful run, so storage bills stay flat.
Step-by-step run logs
Every run records what it did, in order, with warnings and errors kept in place — so a failure tells you which step broke.
Complete run history
Status, duration, byte size, and what triggered each run, kept per job. Proof the backup ran, long after the night it ran.
Checksummed on upload
Every archive is hashed as it streams to your bucket and the checksum is stored with the run, so you can verify what landed.
Run on demand
Trigger any job by hand before a migration or a risky deploy, without touching its schedule or its retention window.
Alerts on five channels
Email plus Slack, Microsoft Teams, Google Chat, and Discord — on success, on failure, and on a job that missed its schedule entirely.
Encrypted credentials
SSH keys, database passwords, and storage secrets are sealed with AES-256-GCM before they touch the database.
Team access with roles
Invite your team into a shared workspace as owner, admin, or member, so backups outlive whoever set them up.
View all features
Megan Torres
“We host and manage websites for multiple clients, and manually checking backups was becoming a real headache. Being able to schedule both site files and database backups, set retention policies, and quickly review backup history gives us a much better process for protecting client sites.”
Megan TorresWeb Hosting Agency Owner

Keep a copy of your first zone tonight.

Connect Cloudflare, choose the zone and your bucket, and the first backup runs on the schedule you pick — or right away, by hand.

No credit card required. Cancel anytime.