diff --git a/.woodpecker/dns.yml b/.woodpecker/dns.yml
index 0e117ea..1a0a918 100644
--- a/.woodpecker/dns.yml
+++ b/.woodpecker/dns.yml
@@ -1,37 +1,30 @@
 pipeline:
   validate:
-    image: alpine
+    image: alpine:3.16
     when:
       path: "dns/**"
       event: pull_request
-    secrets:
-      - linode_token
-      - aws_access_key_id
-      - aws_secret_access_key
     commands:
       - apk add --no-cache terraform
       - terraform version
-      - |
-        cd dns
-        echo 'token = "$${LINODE_TOKEN}"' > .auto.tfvars
-        terraform validate
-        terraform plan
+      - cd dns
+      - terraform init
+      - terraform validate
+      - terraform plan -var "token=$LINODE_TOKEN"
+    secrets: [linode_token, aws_access_key_id, aws_secret_access_key]
 
   deploy:
-    image: alpine
+    image: alpine:3.16
     when:
       path: "dns/**"
+      branch: main
       event: push
-    secrets:
-      - linode_token
-      - aws_access_key_id
-      - aws_secret_access_key
     commands:
       - apk add --no-cache terraform
       - terraform version
-      - |
-        cd dns
-        echo 'token = "$${LINODE_TOKEN}"' > .auto.tfvars
-        terraform validate
-        terraform plan -out deploy.plan
-        terraform apply deploy.plan
+      - cd dns
+      - terraform init
+      - terraform validate
+      - terraform plan -out deploy.plan -var "token=$LINODE_TOKEN"
+      - terraform apply deploy.plan -var "token=$LINODE_TOKEN"
+    secrets: [linode_token, aws_access_key_id, aws_secret_access_key]
diff --git a/dns/main.tf b/dns/main.tf
index fb72342..17da10f 100644
--- a/dns/main.tf
+++ b/dns/main.tf
@@ -5,6 +5,15 @@ terraform {
 			version = "1.26.0"
 		}
 	}
+
+	backend "s3" {
+		bucket = "treehouse-state"
+		key = "tfstate"
+		region = "us-southeast-1"
+		endpoint = "us-southeast-1.linodeobjects.com"
+		skip_credentials_validation = true
+		skip_region_validation = true
+	}
 }
 
 provider "linode" {
@@ -149,3 +158,10 @@ resource "linode_domain_record" "apex_domainkey" {
 	record_type = "TXT"
 	target = "v=DKIM1; k=rsa; s=email; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlJGZN1aCAUd8CqyQA7Akzkvns+Wq/w70ft2xr0B8jFp0DtW8BtyLLAsErpIp5ZTDgReYGgL7cNcSsNQRn+d6ZaOBGlC/gH1T3KYfbsvavOdnbGx9gofi6x8I5QOOLhp7epK5YkaP/Igg58Zm0ni3jdeMCuX+qkJVqn2WVv8IcRtIA3zJrTYOW3lGCj1ieezl5ref+43mFvcUqidToR9XyHNmi1RowmWAofbZASXkNqZiR1P2Jw3s7q6p0fAEz6bODNOmngIlRAaKjBfDVezsaTeQJwsMg9g58GigVTSb9gMHRZon61yxWcCJtcivPug7xAVlVU+MMkDr7MfvUke5KQIDAQAB"
 }
+
+resource "linode_domain_record" "apex_test" {
+	domain_id = "${linode_domain.treehouse_domain.id}"
+	name = "test"
+	record_type = "TXT"
+	target = "this is a test record"
+}