This walkthrough adds a TXT record to example.com, then undoes it. It touches nothing that serves traffic, so you can try it on a live zone. You need a member role of Tech or higher on the zone.
Simulate the change.
Open the domain, go to DNS → Records and select Add record. Choose
TXT, name_changecontrol-test, any content, and write a reason such asTry change control. The dialog shows the Preview: the version the domain is at, the version the change would create and the exact diff.openwaf-cloud ctl records add example.com type=TXT name=_changecontrol-test \ content="hello" --reason "Try change control" --dry-run--dry-runasks the API to simulate the change and prints the plan, for exampleversión 7 → 8and one+ records[id=…]line. Nothing is applied.Apply it.
Select Apply change. The dialog confirms
Applied · version 8.Run the same command without
--dry-run. The CLI simulates again, shows the diff and asks for confirmation (¿Aplicar? [s/N]); answery. Add--waitto wait until every edge node has applied the new version.The write carries the version you simulated against. If someone else changed the zone in the meantime, it is refused and nothing is applied: see Simulate, then confirm.
Find it in the history.
Go to Changes → History. The new version is at the top with your name, the action
Record addedand your reason. Changes compares it with the version before it.openwaf-cloud ctl zones history example.com --limit 5 openwaf-cloud ctl zones diff example.com 7 8Revert it.
In Changes → History, select Revert on the version before yours (version 7), keep or edit the reason and confirm.
openwaf-cloud ctl zones revert example.com 7 --reason "Undo the change control test"The revert does not delete version 8. It creates version 9, whose configuration is the one saved in version 7, with action
zone.revertand a note of where it was restored from.
Next steps
- Configuration versions explains what each version holds.
- Propagation to the edge shows how to check that every edge node has the new version.
- Audit log covers changes that are not zone configuration, such as members, tokens or cache purges.