1. Confirm the owned zone ID and review its latest reconciliation state. If someone edited the provider directly, investigate that difference before relying on the management inventory.
2. POST to the zone's exports resource with {"format":"bind"} and an idempotency key.
3. Read the returned filename, content, sha256, record_count and conflicts fields.
4. Write the decoded content string to a local file as-is. Do not save the JSON escape sequences, change line endings or append an extra newline before checking its digest.
5. Calculate SHA-256 over those exact file bytes and compare it with the response. Store the matching digest with the export date, zone ID and source server.

On a system with the standard utility available, sha256sum example.com.zone reads the saved file and displays its digest. The digest detects accidental differences from this export response. Keep your authenticated response or trusted change record as the reference; a hash alone is not an independent signature of ownership.

DNS_EXPORT_NO_NAMESERVERS means the assigned server has not supplied the nameservers required to render a usable zone file. Ask the administrator to correct that configuration. Do not invent ns1.example.com without a working nameserver and its required delegation.

A management lock does not automatically prevent this read-only export, but provider capabilities and account permissions still apply. The service returns the text immediately and records an export audit entry; it does not provide access to arbitrary server files.

• Parse and apply a BIND zone import through the API
• Export a portable copy of your DNS records
• Move managed zones to another DNS provider with a verified rollback point
• Keep a portable DNS inventory when the provider has no export button