feat: support the new DNS API (#703)

Add support for the new [DNS
API](https://docs.hetzner.cloud/reference/cloud#dns).

The DNS API is currently in **beta**.

See the [DNS API beta
changelog](https://docs.hetzner.cloud/changelog#2025-10-07-dns-beta) for
more details.

tests/integration/targets/zone/aliases

@@ -0,0 +1,3 @@
+cloud/hcloud
+gather_facts/no
+azp/group2

tests/integration/targets/zone/defaults/main/common.yml

@@ -0,0 +1,29 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+# Azure Pipelines will configure this value to something similar to
+# "azp-84824-1-hetzner-2-13-test-2-13-hcloud-3-9-1-default-i"
+hcloud_prefix: "tests"
+
+# Used to namespace resources created by concurrent test pipelines/targets
+hcloud_run_ns: "{{ hcloud_prefix | md5 }}"
+hcloud_role_ns: "{{ role_name | split('_') | map('batch', 2) | map('first') | flatten() | join() }}"
+hcloud_ns: "ansible-{{ hcloud_run_ns }}-{{ hcloud_role_ns }}"
+
+# Used to easily update the server types and images across all our tests.
+hcloud_server_type_name: cax11
+hcloud_server_type_id: 45
+
+hcloud_server_type_upgrade_name: cax21
+hcloud_server_type_upgrade_id: 93
+
+hcloud_image_name: debian-12
+hcloud_image_id: 114690389 # architecture=arm
+
+hcloud_location_name: hel1
+hcloud_location_id: 3
+hcloud_datacenter_name: hel1-dc2
+hcloud_datacenter_id: 3
+
+hcloud_network_zone_name: eu-central

tests/integration/targets/zone/defaults/main/main.yml

@@ -0,0 +1,4 @@
+# Copyright: (c) 2019, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+hcloud_zone_name: "{{ hcloud_ns }}.de"

tests/integration/targets/zone/tasks/cleanup.yml

@@ -0,0 +1,5 @@
+---
+- name: Cleanup test_zone
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent

tests/integration/targets/zone/tasks/main.yml

@@ -0,0 +1,31 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+- name: Check if cleanup.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/cleanup.yml"
+  register: cleanup_file
+
+- name: Check if prepare.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/prepare.yml"
+  register: prepare_file
+
+- name: Include cleanup tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+  when: cleanup_file.stat.exists
+
+- name: Include prepare tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/prepare.yml"
+  when: prepare_file.stat.exists
+
+- name: Run tests
+  block:
+    - name: Include test tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/test.yml"
+
+  always:
+    - name: Include cleanup tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+      when: cleanup_file.stat.exists

tests/integration/targets/zone/tasks/test.yml

@@ -0,0 +1,317 @@
+---
+- name: Test missing required parameters
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: present
+  ignore_errors: true
+  register: result
+- name: Verify missing required parameters
+  ansible.builtin.assert:
+    that:
+      - result is failed
+      - 'result.msg == "missing required arguments: mode"'
+
+- name: Test create with check mode
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    ttl: 10800
+    labels:
+      key: value
+  check_mode: true
+  register: result
+- name: Verify create with check mode
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Test create primary
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    ttl: 10800
+    labels:
+      key: value
+  register: result
+- name: Verify create primary
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone.id is not none
+      - result.hcloud_zone.name == hcloud_zone_name
+      - result.hcloud_zone.mode == "primary"
+      - result.hcloud_zone.primary_nameservers | count == 0
+      - result.hcloud_zone.ttl == 10800
+      - result.hcloud_zone.labels.key == "value"
+      - result.hcloud_zone.delete_protection == false
+      - result.hcloud_zone.status == "ok"
+      - result.hcloud_zone.registrar == "other"
+      - result.hcloud_zone.authoritative_nameservers.assigned == ["hydrogen.ns.hetzner.com.", "oxygen.ns.hetzner.com.", "helium.ns.hetzner.de."]
+      - result.hcloud_zone.authoritative_nameservers.delegated == []
+      - result.hcloud_zone.authoritative_nameservers.delegation_last_check is none
+      - result.hcloud_zone.authoritative_nameservers.delegation_status == "unknown"
+
+- name: Test create primary idempotency
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    ttl: 10800
+    labels:
+      key: value
+  register: result
+- name: Verify create primary idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test update primary
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    ttl: 3600
+    labels:
+      key: changed
+      new: value
+    delete_protection: true
+  register: result
+- name: Verify update primary
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone.name == hcloud_zone_name
+      - result.hcloud_zone.mode == "primary"
+      - result.hcloud_zone.ttl == 3600
+      - result.hcloud_zone.labels.key == "changed"
+      - result.hcloud_zone.labels.new == "value"
+      - result.hcloud_zone.delete_protection == true
+
+- name: Test update primary idempotency
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    ttl: 3600
+    labels:
+      key: changed
+      new: value
+    delete_protection: true
+  register: result
+- name: Verify update primary idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test delete primary with delete protection
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent
+  ignore_errors: true
+  register: result
+- name: Verify delete primary with delete protection
+  ansible.builtin.assert:
+    that:
+      - result is failed
+      - result.failure.code == "protected"
+
+- name: Test update primary delete protection
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    delete_protection: false
+  register: result
+- name: Verify update primary delete protection
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone.delete_protection == false
+
+- name: Test delete primary
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent
+  register: result
+- name: Verify delete primary
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Test create secondary
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: secondary
+    primary_nameservers:
+      - address: 203.0.113.1
+        port: 53
+  register: result
+- name: Verify create secondary
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone.id is not none
+      - result.hcloud_zone.name == hcloud_zone_name
+      - result.hcloud_zone.mode == "secondary"
+      - result.hcloud_zone.primary_nameservers | count == 1
+      - result.hcloud_zone.primary_nameservers[0].address == "203.0.113.1"
+      - result.hcloud_zone.primary_nameservers[0].port == 53
+      - result.hcloud_zone.ttl == 3600
+
+- name: Test create secondary idempotency
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: secondary
+    primary_nameservers:
+      - address: 203.0.113.1
+        port: 53
+  register: result
+- name: Verify create secondary idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test update secondary
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    primary_nameservers:
+      - address: 203.0.113.1
+        port: 5353
+  register: result
+- name: Verify update secondary
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone.name == hcloud_zone_name
+      - result.hcloud_zone.mode == "secondary"
+      - result.hcloud_zone.primary_nameservers | count == 1
+      - result.hcloud_zone.primary_nameservers[0].address == "203.0.113.1"
+      - result.hcloud_zone.primary_nameservers[0].port == 5353
+
+- name: Test update secondary idempotency
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    primary_nameservers:
+      - address: 203.0.113.1
+        port: 5353
+  register: result
+- name: Verify update secondary idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test delete secondary
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent
+  register: result
+- name: Verify delete secondary
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Test create primary from zonefile
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    zonefile: |
+      $ORIGIN	{{ hcloud_zone_name }}.
+      $TTL	3600
+
+      @ 300 IN CAA 0 issue "letsencrypt.org"
+
+      @	600	IN	A	192.168.254.2
+      @	600	IN	A	192.168.254.3
+
+      @	IN	AAAA	fdd0:367a:0cb7::2
+      @	IN	AAAA	fdd0:367a:0cb7::3
+
+      www	IN	CNAME	{{ hcloud_zone_name }}.
+      blog	IN	CNAME	{{ hcloud_zone_name }}.
+
+      anything	IN	TXT	"some value"
+  register: result
+- name: Verify create primary from zonefile
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone.id is not none
+      - result.hcloud_zone.name == hcloud_zone_name
+      - result.hcloud_zone.mode == "primary"
+      - result.hcloud_zone.primary_nameservers | count == 0
+      - result.hcloud_zone.ttl == 3600
+      - result.hcloud_zone.labels | count == 0
+      - result.hcloud_zone.delete_protection == false
+      - result.hcloud_zone.status == "ok"
+      - result.hcloud_zone.registrar == "other"
+
+- name: Test create primary from zonefile idempotency
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    zonefile: |
+      $ORIGIN	{{ hcloud_zone_name }}.
+      $TTL	3600
+
+      @ 300 IN CAA 0 issue "letsencrypt.org"
+
+      @	600	IN	A	192.168.254.2
+      @	600	IN	A	192.168.254.3
+
+      @	IN	AAAA	fdd0:367a:0cb7::2
+      @	IN	AAAA	fdd0:367a:0cb7::3
+
+      www	IN	CNAME	{{ hcloud_zone_name }}.
+      blog	IN	CNAME	{{ hcloud_zone_name }}.
+
+      anything	IN	TXT	"some value"
+  register: result
+- name: Verify create primary from zonefile idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test import from zonefile
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    zonefile: |
+      @	SOA	hydrogen.ns.hetzner.com. dns.hetzner.com. 2025032100 86400 10800 3600000 3600
+
+      @	NS	hydrogen.ns.hetzner.com.
+      @	NS	oxygen.ns.hetzner.com.
+      @	NS	helium.ns.hetzner.de.
+
+      $ORIGIN	{{ hcloud_zone_name }}.
+      $TTL	3600
+
+      @ 300 IN CAA 0 issue "letsencrypt.org"
+
+      @	600	IN	A	192.168.254.2
+      @	600	IN	A	192.168.254.3
+
+      @	IN	AAAA	fdd0:367a:0cb7::2
+      @	IN	AAAA	fdd0:367a:0cb7::3
+
+      www	IN	CNAME	{{ hcloud_zone_name }}.
+      blog	IN	CNAME	{{ hcloud_zone_name }}.
+
+      anything	IN	TXT	"some value"
+    state: import
+  register: result
+- name: Verify import from zonefile
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone.id is not none
+      - result.hcloud_zone.name == hcloud_zone_name
+      - result.hcloud_zone.mode == "primary"
+      - result.hcloud_zone.primary_nameservers | count == 0
+      - result.hcloud_zone.ttl == 3600
+      - result.hcloud_zone.labels | count == 0
+      - result.hcloud_zone.delete_protection == false
+      - result.hcloud_zone.status == "ok"
+      - result.hcloud_zone.registrar == "other"
+
+- name: Test delete primary from zonefile
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent
+  register: result
+- name: Verify delete primary from zonefile
+  ansible.builtin.assert:
+    that:
+      - result is changed

tests/integration/targets/zone_info/aliases

@@ -0,0 +1,3 @@
+cloud/hcloud
+gather_facts/no
+azp/group2

tests/integration/targets/zone_info/defaults/main/common.yml

@@ -0,0 +1,29 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+# Azure Pipelines will configure this value to something similar to
+# "azp-84824-1-hetzner-2-13-test-2-13-hcloud-3-9-1-default-i"
+hcloud_prefix: "tests"
+
+# Used to namespace resources created by concurrent test pipelines/targets
+hcloud_run_ns: "{{ hcloud_prefix | md5 }}"
+hcloud_role_ns: "{{ role_name | split('_') | map('batch', 2) | map('first') | flatten() | join() }}"
+hcloud_ns: "ansible-{{ hcloud_run_ns }}-{{ hcloud_role_ns }}"
+
+# Used to easily update the server types and images across all our tests.
+hcloud_server_type_name: cax11
+hcloud_server_type_id: 45
+
+hcloud_server_type_upgrade_name: cax21
+hcloud_server_type_upgrade_id: 93
+
+hcloud_image_name: debian-12
+hcloud_image_id: 114690389 # architecture=arm
+
+hcloud_location_name: hel1
+hcloud_location_id: 3
+hcloud_datacenter_name: hel1-dc2
+hcloud_datacenter_id: 3
+
+hcloud_network_zone_name: eu-central

tests/integration/targets/zone_info/defaults/main/main.yml

@@ -0,0 +1,4 @@
+# Copyright: (c) 2019, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+hcloud_zone_name: "{{ hcloud_ns }}.de"

tests/integration/targets/zone_info/tasks/cleanup.yml

@@ -0,0 +1,5 @@
+---
+- name: Cleanup test_zone
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent

tests/integration/targets/zone_info/tasks/main.yml

@@ -0,0 +1,31 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+- name: Check if cleanup.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/cleanup.yml"
+  register: cleanup_file
+
+- name: Check if prepare.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/prepare.yml"
+  register: prepare_file
+
+- name: Include cleanup tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+  when: cleanup_file.stat.exists
+
+- name: Include prepare tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/prepare.yml"
+  when: prepare_file.stat.exists
+
+- name: Run tests
+  block:
+    - name: Include test tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/test.yml"
+
+  always:
+    - name: Include cleanup tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+      when: cleanup_file.stat.exists

tests/integration/targets/zone_info/tasks/prepare.yml

@@ -0,0 +1,9 @@
+---
+- name: Create test_zone
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    ttl: 3600
+    labels:
+      key: value
+  register: test_zone

tests/integration/targets/zone_info/tasks/test.yml

@@ -0,0 +1,77 @@
+# Copyright: (c) 2025, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+- name: Gather hcloud_zone_info
+  hetzner.hcloud.zone_info:
+  register: result
+- name: Verify hcloud_zone_info
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_info | list | count >= 1
+
+- name: Gather hcloud_zone_info in check mode
+  hetzner.hcloud.zone_info:
+  check_mode: true
+  register: result
+- name: Verify hcloud_zone_info in check mode
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_info | list | count >= 1
+
+- name: Gather hcloud_zone_info with correct id
+  hetzner.hcloud.zone_info:
+    id: "{{ test_zone.hcloud_zone.id }}"
+  register: result
+- name: Verify hcloud_zone_info with correct id
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_info | list | count == 1
+
+- name: Gather hcloud_zone_info with wrong id
+  hetzner.hcloud.zone_info:
+    id: "{{ test_zone.hcloud_zone.id }}4321"
+  ignore_errors: true
+  register: result
+- name: Verify hcloud_zone_info with wrong id
+  ansible.builtin.assert:
+    that:
+      - result is failed
+
+- name: Gather hcloud_zone_info with correct name
+  hetzner.hcloud.zone_info:
+    name: "{{ hcloud_zone_name }}"
+  register: result
+- name: Verify hcloud_zone_info with correct name
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_info | list | count == 1
+
+- name: Gather hcloud_zone_info with wrong name
+  hetzner.hcloud.zone_info:
+    name: "invalid-{{ hcloud_zone_name }}"
+  register: result
+- name: Verify hcloud_zone_info with wrong name
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_info | list | count == 0
+
+- name: Gather hcloud_zone_info with correct label selector
+  hetzner.hcloud.zone_info:
+    label_selector: "key=value"
+  register: result
+- name: Verify hcloud_zone_info with correct label selector
+  ansible.builtin.assert:
+    that:
+      - >
+        result.hcloud_zone_info
+        | selectattr('name', 'equalto', hcloud_zone_name)
+        | list | count == 1
+
+- name: Gather hcloud_zone_info with wrong label selector
+  hetzner.hcloud.zone_info:
+    label_selector: "key!=value"
+  register: result
+- name: Verify hcloud_zone_info with wrong label selector
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_info | list | count == 0

tests/integration/targets/zone_rrset/aliases

@@ -0,0 +1,3 @@
+cloud/hcloud
+gather_facts/no
+azp/group2

tests/integration/targets/zone_rrset/defaults/main/common.yml

@@ -0,0 +1,29 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+# Azure Pipelines will configure this value to something similar to
+# "azp-84824-1-hetzner-2-13-test-2-13-hcloud-3-9-1-default-i"
+hcloud_prefix: "tests"
+
+# Used to namespace resources created by concurrent test pipelines/targets
+hcloud_run_ns: "{{ hcloud_prefix | md5 }}"
+hcloud_role_ns: "{{ role_name | split('_') | map('batch', 2) | map('first') | flatten() | join() }}"
+hcloud_ns: "ansible-{{ hcloud_run_ns }}-{{ hcloud_role_ns }}"
+
+# Used to easily update the server types and images across all our tests.
+hcloud_server_type_name: cax11
+hcloud_server_type_id: 45
+
+hcloud_server_type_upgrade_name: cax21
+hcloud_server_type_upgrade_id: 93
+
+hcloud_image_name: debian-12
+hcloud_image_id: 114690389 # architecture=arm
+
+hcloud_location_name: hel1
+hcloud_location_id: 3
+hcloud_datacenter_name: hel1-dc2
+hcloud_datacenter_id: 3
+
+hcloud_network_zone_name: eu-central

tests/integration/targets/zone_rrset/defaults/main/main.yml

@@ -0,0 +1,4 @@
+# Copyright: (c) 2019, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+hcloud_zone_name: "{{ hcloud_ns }}.de"

tests/integration/targets/zone_rrset/tasks/cleanup.yml

@@ -0,0 +1,5 @@
+---
+- name: Cleanup test_zone
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent

tests/integration/targets/zone_rrset/tasks/main.yml

@@ -0,0 +1,31 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+- name: Check if cleanup.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/cleanup.yml"
+  register: cleanup_file
+
+- name: Check if prepare.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/prepare.yml"
+  register: prepare_file
+
+- name: Include cleanup tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+  when: cleanup_file.stat.exists
+
+- name: Include prepare tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/prepare.yml"
+  when: prepare_file.stat.exists
+
+- name: Run tests
+  block:
+    - name: Include test tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/test.yml"
+
+  always:
+    - name: Include cleanup tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+      when: cleanup_file.stat.exists

tests/integration/targets/zone_rrset/tasks/prepare.yml

@@ -0,0 +1,9 @@
+---
+- name: Create test_zone
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    ttl: 10800
+    labels:
+      key: value
+  register: test_zone

tests/integration/targets/zone_rrset/tasks/test.yml

@@ -0,0 +1,186 @@
+---
+- name: Test missing required parameters # noqa: args[module]
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    state: present
+  ignore_errors: true
+  register: result
+- name: Verify missing required parameters
+  ansible.builtin.assert:
+    that:
+      - result is failed
+      - 'result.msg == "one of the following is required: id, name"'
+
+- name: Test create with check mode
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    ttl: 300
+    labels:
+      key: value
+    records:
+      - value: 201.118.10.11
+        comment: web server 1
+      - value: 201.118.10.12
+        comment: web server 2
+  check_mode: true
+  register: result
+- name: Verify create with check mode
+  ansible.builtin.assert:
+    that:
+      - result is changed
+
+- name: Test create
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    ttl: 300
+    labels:
+      key: value
+    records:
+      - value: 201.118.10.11
+        comment: web server 1
+      - value: 201.118.10.12
+        comment: web server 2
+  register: result
+- name: Verify create
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone_rrset.zone == test_zone.hcloud_zone.id
+      - result.hcloud_zone_rrset.id == "www/A"
+      - result.hcloud_zone_rrset.name == "www"
+      - result.hcloud_zone_rrset.type == "A"
+      - result.hcloud_zone_rrset.ttl == 300
+      - result.hcloud_zone_rrset.labels.key == "value"
+      - result.hcloud_zone_rrset.change_protection == false
+      - result.hcloud_zone_rrset.records | count == 2
+      - result.hcloud_zone_rrset.records[0].value == "201.118.10.11"
+      - result.hcloud_zone_rrset.records[0].comment == "web server 1"
+      - result.hcloud_zone_rrset.records[1].value == "201.118.10.12"
+      - result.hcloud_zone_rrset.records[1].comment == "web server 2"
+
+- name: Test create idempotency
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    ttl: 300
+    labels:
+      key: value
+    records:
+      - value: 201.118.10.11
+        comment: web server 1
+      - value: 201.118.10.12
+        comment: web server 2
+  register: result
+- name: Verify create idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test update
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    ttl: 60
+    labels:
+      key: changed
+      new: value
+    records:
+      - value: 201.118.10.11
+        comment: web server 1
+      - value: 201.118.10.13
+        comment: web server 3
+    change_protection: true
+  register: result
+- name: Verify update
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone_rrset.zone == test_zone.hcloud_zone.id
+      - result.hcloud_zone_rrset.id == "www/A"
+      - result.hcloud_zone_rrset.ttl == 60
+      - result.hcloud_zone_rrset.labels.key == "changed"
+      - result.hcloud_zone_rrset.labels.new == "value"
+      - result.hcloud_zone_rrset.change_protection == true
+      - result.hcloud_zone_rrset.records | count == 2
+      - result.hcloud_zone_rrset.records[0].value == "201.118.10.11"
+      - result.hcloud_zone_rrset.records[0].comment == "web server 1"
+      - result.hcloud_zone_rrset.records[1].value == "201.118.10.13"
+      - result.hcloud_zone_rrset.records[1].comment == "web server 3"
+
+- name: Test update idempotency
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    ttl: 60
+    labels:
+      key: changed
+      new: value
+    records:
+      - value: 201.118.10.11
+        comment: web server 1
+      - value: 201.118.10.13
+        comment: web server 3
+    change_protection: true
+  register: result
+- name: Verify update idempotency
+  ansible.builtin.assert:
+    that:
+      - result is not changed
+
+- name: Test delete with change protection
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    state: absent
+  ignore_errors: true
+  register: result
+- name: Verify delete with change protection
+  ansible.builtin.assert:
+    that:
+      - result is failed
+      - result.failure.code == "protected"
+
+- name: Test delete zone with change protection
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent
+  ignore_errors: true
+  register: result
+- name: Verify delete zone with change protection
+  ansible.builtin.assert:
+    that:
+      - result is failed
+      - result.failure.code == "protected"
+
+- name: Test update change protection
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    change_protection: false
+  register: result
+- name: Verify update delete protection
+  ansible.builtin.assert:
+    that:
+      - result is changed
+      - result.hcloud_zone_rrset.change_protection == false
+
+- name: Test delete
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    state: absent
+  register: result
+- name: Verify delete
+  ansible.builtin.assert:
+    that:
+      - result is changed

tests/integration/targets/zone_rrset_info/aliases

@@ -0,0 +1,3 @@
+cloud/hcloud
+gather_facts/no
+azp/group2

tests/integration/targets/zone_rrset_info/defaults/main/common.yml

@@ -0,0 +1,29 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+# Azure Pipelines will configure this value to something similar to
+# "azp-84824-1-hetzner-2-13-test-2-13-hcloud-3-9-1-default-i"
+hcloud_prefix: "tests"
+
+# Used to namespace resources created by concurrent test pipelines/targets
+hcloud_run_ns: "{{ hcloud_prefix | md5 }}"
+hcloud_role_ns: "{{ role_name | split('_') | map('batch', 2) | map('first') | flatten() | join() }}"
+hcloud_ns: "ansible-{{ hcloud_run_ns }}-{{ hcloud_role_ns }}"
+
+# Used to easily update the server types and images across all our tests.
+hcloud_server_type_name: cax11
+hcloud_server_type_id: 45
+
+hcloud_server_type_upgrade_name: cax21
+hcloud_server_type_upgrade_id: 93
+
+hcloud_image_name: debian-12
+hcloud_image_id: 114690389 # architecture=arm
+
+hcloud_location_name: hel1
+hcloud_location_id: 3
+hcloud_datacenter_name: hel1-dc2
+hcloud_datacenter_id: 3
+
+hcloud_network_zone_name: eu-central

tests/integration/targets/zone_rrset_info/defaults/main/main.yml

@@ -0,0 +1,4 @@
+# Copyright: (c) 2019, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+hcloud_zone_name: "{{ hcloud_ns }}.de"

tests/integration/targets/zone_rrset_info/tasks/cleanup.yml

@@ -0,0 +1,5 @@
+---
+- name: Cleanup test_zone
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    state: absent

tests/integration/targets/zone_rrset_info/tasks/main.yml

@@ -0,0 +1,31 @@
+#
+# DO NOT EDIT THIS FILE! Please edit the files in tests/integration/common instead.
+#
+---
+- name: Check if cleanup.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/cleanup.yml"
+  register: cleanup_file
+
+- name: Check if prepare.yml exists
+  ansible.builtin.stat:
+    path: "{{ role_path }}/tasks/prepare.yml"
+  register: prepare_file
+
+- name: Include cleanup tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+  when: cleanup_file.stat.exists
+
+- name: Include prepare tasks
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/prepare.yml"
+  when: prepare_file.stat.exists
+
+- name: Run tests
+  block:
+    - name: Include test tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/test.yml"
+
+  always:
+    - name: Include cleanup tasks
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/cleanup.yml"
+      when: cleanup_file.stat.exists

tests/integration/targets/zone_rrset_info/tasks/prepare.yml

@@ -0,0 +1,36 @@
+---
+- name: Create test_zone
+  hetzner.hcloud.zone:
+    name: "{{ hcloud_zone_name }}"
+    mode: primary
+    ttl: 3600
+    labels:
+      key: value
+  register: test_zone
+
+- name: Create test_zone_rrset1
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+    ttl: 600
+    labels:
+      key: value
+    records:
+      - comment: webserver 1
+        value: 201.34.52.45
+      - comment: webserver 2
+        value: 201.34.52.46
+  register: test_zone_rrset1
+
+- name: Create test_zone_rrset2
+  hetzner.hcloud.zone_rrset:
+    zone: "{{ hcloud_zone_name }}"
+    name: blog
+    type: A
+    records:
+      - comment: webserver 3
+        value: 201.34.52.47
+      - comment: webserver 4
+        value: 201.34.52.48
+  register: test_zone_rrset2

tests/integration/targets/zone_rrset_info/tasks/test.yml

@@ -0,0 +1,96 @@
+# Copyright: (c) 2025, Hetzner Cloud GmbH <info@hetzner-cloud.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+- name: Gather hcloud_zone_rrset_info
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+  register: result
+- name: Verify hcloud_zone_rrset_info
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_rrset_info | list | count >= 1
+
+- name: Gather hcloud_zone_rrset_info in check mode
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+  check_mode: true
+  register: result
+- name: Verify hcloud_zone_rrset_info in check mode
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_rrset_info | list | count >= 1
+
+- name: Gather hcloud_zone_rrset_info with wrong zone
+  hetzner.hcloud.zone_rrset_info:
+    zone: invalid.de
+  ignore_errors: true
+  register: result
+- name: Verify hcloud_zone_rrset_info with wrong zone
+  ansible.builtin.assert:
+    that:
+      - result is failed
+
+- name: Gather hcloud_zone_rrset_info with correct id
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+    id: www/A
+  register: result
+- name: Verify hcloud_zone_rrset_info with correct id
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_rrset_info | list | count == 1
+
+- name: Gather hcloud_zone_rrset_info with wrong id
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+    id: invalid/A
+  register: result
+- name: Verify hcloud_zone_rrset_info with wrong id
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_rrset_info | list | count == 0
+
+- name: Gather hcloud_zone_rrset_info with correct name
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+    name: www
+    type: A
+  register: result
+- name: Verify hcloud_zone_rrset_info with correct name
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_rrset_info | list | count == 1
+
+- name: Gather hcloud_zone_rrset_info with wrong name
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+    name: invalid
+    type: A
+  register: result
+- name: Verify hcloud_zone_rrset_info with wrong name
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_rrset_info | list | count == 0
+
+- name: Gather hcloud_zone_rrset_info with correct label selector
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+    label_selector: "key=value"
+  register: result
+- name: Verify hcloud_zone_rrset_info with correct label selector
+  ansible.builtin.assert:
+    that:
+      - >
+        result.hcloud_zone_rrset_info
+        | selectattr('id', 'equalto', "www/A")
+        | list | count == 1
+
+- name: Gather hcloud_zone_rrset_info with wrong label selector
+  hetzner.hcloud.zone_rrset_info:
+    zone: "{{ hcloud_zone_name }}"
+    label_selector: "key!=value"
+  register: result
+- name: Verify hcloud_zone_rrset_info with wrong label selector
+  ansible.builtin.assert:
+    that:
+      - result.hcloud_zone_rrset_info | list | count == 0