Hi Rob,

Exactly. I just need a quick way to restore in case someone fat fingers a change. I was curious if there was a baked in way to do this using FreeIPA but it sounds like there isn't.

Thanks for the other suggestions. It looks like a zone transfer will probably be the simplest way to get a backup. I also stumbled across this tool: https://github.com/freeipa/zone2dyndb-ldif for converting the zone transfer to something usable by bind-dyndb-ldap so I'm going throw together a script to automate the backups of the zones and another that uses zone2dyndb-ldif to import the backups.