Example Terraform file for importing DNS Records from DigitalOcean

example.com.import.txt

digitalocean_domain.example example.com
digitalocean_record.example example.com,<DO ID>
digitalocean_record.fd-gmail-txt example.com,<DO ID>
digitalocean_record.fd-mx["alt1.aspmx.l.google.com."] example.com,<DO ID>
digitalocean_record.fd-mx["alt2.aspmx.l.google.com."] example.com,<DO ID>
digitalocean_record.fd-mx["aspmx.l.google.com."] example.com,<DO ID>
digitalocean_record.fd-mx["aspmx2.googlemail.com."] example.com,<DO ID>
digitalocean_record.fd-mx["aspmx3.googlemail.com."] example.com,<DO ID>
digitalocean_record.fd-ns["1"] example.com,<DO ID>
digitalocean_record.fd-ns["2"] example.com,<DO ID>
digitalocean_record.fd-ns["3"] example.com,<DO ID>
digitalocean_record.fd-www example.com,<DO ID>

example.com.tf

/**
 * The following is a full example of how import your DNS records from DigitalOcean into Terraform. The Terraform
 * documentation is okay, but some things aren't obvious, like how to import records. Suggestions on how to improve this
 * Terraform configuration are welcome.
 *
 * Versions:
 * Terraform v0.12.29
 * + provider.aws v2.70.0
 * + provider.digitalocean v1.22.1
 *
 * Terraform docs: https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/record
 * API Docs for Digital Ocean. Needed to get ids or importing.
 * https://developers.digitalocean.com/documentation/v2/#list-all-domain-records
 *
 * To get your DO token go to: https://cloud.digitalocean.com/account/api/tokens
 *
 * To retrieve records run:
 * curl -X GET -H "Content-Type: application/json" -H "Authorization: Bearer <DO Token>" "https://api.digitalocean.com/v2/domains/example.com/records"
 *
 * To import a domain record:
 * terraform import digitalocean_record.www example.com,<id from DO api>
 *
 * To import a domain record with for_each
 * terraform import 'digitalocean_record.example-mx["alt1.aspmx.l.google.com."] example.com,<id from DO api>
 *
 * To do a mass import edit example.com.import.txt with the correct DigitalOcean IDs and then run the following.
 * while IFS= read -r line; do terraform import $(echo $line | awk '{print $1}') $(echo $line | awk '{print $2}'); done < example.com.import.txt
 */

locals {
  default_ttl = 1800
  mx_records = {
    "aspmx.l.google.com." = 1
    "alt1.aspmx.l.google.com." = 5
    "alt2.aspmx.l.google.com." = 5
    "aspmx2.googlemail.com." = 10
    "aspmx3.googlemail.com." = 10
  }
}

/**
 * The following Droplets would be in another file, included here for a more complete example.
 */
resource "digitalocean_droplet" "web" {
  image   = "docker-18-04"
  name    = "web.example.com"
  region  = "nyc2"
  size    = "s-1vcpu-1gb"
  backups = true
}
resource "digitalocean_droplet" "db" {
  image   = "ubuntu-18-04-x64"
  name    = "db.example.com"
  region  = "nyc2"
  size    = "s-1vcpu-1gb"
  backups = true
}

resource "digitalocean_domain" "example" {
  name = "example.com"
}

// idx: 1, id: example.com,<id from DO api>
// idx: 2, id: example.com,<id from DO api>
// idx: 3, id: example.com,<id from DO api>
resource "digitalocean_record" "example-ns" {
  for_each = toset(["1", "2", "3"])
  domain   = digitalocean_domain.example.name
  type     = "NS"
  name     = "@"
  value    = "ns${each.value}.digitalocean.com."
  ttl      = local.default_ttl
}

// id: example.com,<id from DO api>
resource "digitalocean_record" "example" {
  domain = digitalocean_domain.example.name
  type   = "A"
  name   = "@"
  value  = digitalocean_droplet.web.ipv4_address
  ttl    = local.default_ttl
}

// id: example.com,<id from DO api>
resource "digitalocean_record" "example-www" {
  domain = digitalocean_domain.example.name
  type   = "A"
  name   = "www"
  value  = digitalocean_droplet.web.ipv4_address
  ttl    = local.default_ttl
}

// id: example.com,<id from DO api>
resource "digitalocean_record" "example-web" {
  domain = digitalocean_domain.example.name
  type   = "A"
  name   = "web"
  value  = digitalocean_droplet.web.ipv4_address
  ttl    = local.default_ttl
}

// id: example.com,<id from DO api>
resource "digitalocean_record" "example-db" {
  domain = digitalocean_domain.example.name
  type   = "A"
  name   = "db"
  value  = digitalocean_droplet.db.ipv4_address
  ttl    = local.default_ttl
}

// id: example.com,<id from DO api>
resource "digitalocean_record" "example-gmail-txt" {
  domain = digitalocean_domain.example.name
  type   = "TXT"
  name   = "@"
  value  = "v=spf1 a include:aspmx.googlemail.com ~all"
  ttl    = local.default_ttl
}

// value = aspmx.l.google.com., id: example.com,<id from DO api>
// value = alt1.aspmx.l.google.com., example.com,<id from DO api>
// value = alt2.aspmx.l.google.com., example.com,<id from DO api>
// value = aspmx2.googlemail.com., example.com,<id from DO api>
// value = aspmx3.googlemail.com., example.com,<id from DO api>
resource "digitalocean_record" "example-mx" {
  for_each = local.mx_records
  domain   = digitalocean_domain.example.name
  type     = "MX"
  name     = "@"
  priority = each.value
  value    = each.key
  ttl      = local.default_ttl
}

/**
 * The following is an example of how to use AWS SES verification tokens and dkim tokens and these resources would
 * probably be put in another file for organization.
 */
resource "aws_ses_domain_identity" "example" {
  domain = example
}

resource "aws_ses_domain_dkim" "example" {
  domain = aws_ses_domain_identity.example.domain
}

// id: example.com,<id from DO api>
resource "digitalocean_record" "example-az-txt" {
  domain = digitalocean_domain.example.name
  type   = "TXT"
  name   = "_amazonses"
  value  = aws_ses_domain_identity.example.verification_token
  ttl    = local.default_ttl
}

// token: <token 1>, id = example.com,<id from DO api>
// token: <token 1>, id = example.com,<id from DO api>
// token: <token 1>, id = example.com,<id from DO api>
resource "digitalocean_record" "example-az-dkim_tokens" {
  for_each = toset(aws_ses_domain_dkim.example.dkim_tokens)
  domain   = digitalocean_domain.example.name
  type     = "CNAME"
  name     = "${each.value}._domainkey"
  value    = "${each.value}.dkim.amazonses.com."
  ttl      = local.default_ttl
}