diff --git a/playbooks/dns.yml b/playbooks/dns.yml
new file mode 100644
index 0000000..e9603bb
--- /dev/null
+++ b/playbooks/dns.yml
@@ -0,0 +1,12 @@
+---
+# dns.yml — manage the public DNS zone (wingu.me) at Gandi LiveDNS as code.
+# Runs on the control node (ubongo) against the Gandi API — no host config.
+# Run: make check PLAYBOOK=dns  then  make deploy PLAYBOOK=dns
+- name: Manage public DNS (Gandi LiveDNS)
+  hosts: control
+  connection: local
+  gather_facts: false
+  become: false
+  roles:
+    - role: public_dns
+      tags: [public_dns]