Set DNS records for a domain you own

Upserts DNS records at the rrset level: for each (type, name) present in the payload, existing records at that (type, name) are replaced by the ones you send; rrsets NOT mentioned in the payload are preserved, and NS records are never touched. An automatic server-side backup of the zone is taken before every write.

Concurrency: pass the zone_version from a prior GET (body field or If-Match header). If the zone changed since, the write fails with 409 DNS_VERSION_CONFLICT and returns the current records + version so you can re-merge and retry.

Mail routing: a change to where the domain's mail is delivered (its MX or NS records, the address records an MX host inside the zone resolves through, or those of a host that receives Domani mail and publishes no MX) needs the email:auth_secrets scope, since whoever receives the mail receives its sign-in codes. Without it the request answers 403 INSUFFICIENT_SCOPE before anything changes, and a token confined to mailboxes answers 403 MAILBOX_CONFINED even with it. Other records need only domains:write. Every routing change is recorded in the audit log.