diff --git a/pkg/apis/externaldns/types.go b/pkg/apis/externaldns/types.go
index bf7a99ba2..480593f14 100644
--- a/pkg/apis/externaldns/types.go
+++ b/pkg/apis/externaldns/types.go
@@ -350,7 +350,7 @@ func (cfg *Config) ParseFlags(args []string) error {
 	app.Flag("transip-keyfile", "When using the TransIP provider, specify the path to the private key file (required when --provider=transip)").Default(defaultConfig.TransIPPrivateKeyFile).StringVar(&cfg.TransIPPrivateKeyFile)
 
 	// Flags related to policies
-	app.Flag("policy", "Modify how DNS records are synchronized between sources and providers (default: sync, options: sync, upsert-only)").Default(defaultConfig.Policy).EnumVar(&cfg.Policy, "sync", "upsert-only")
+	app.Flag("policy", "Modify how DNS records are synchronized between sources and providers (default: sync, options: sync, upsert-only, create-only)").Default(defaultConfig.Policy).EnumVar(&cfg.Policy, "sync", "upsert-only", "create-only")
 
 	// Flags related to the registry
 	app.Flag("registry", "The registry implementation to use to keep track of DNS record ownership (default: txt, options: txt, noop, aws-sd)").Default(defaultConfig.Registry).EnumVar(&cfg.Registry, "txt", "noop", "aws-sd")
diff --git a/plan/policy.go b/plan/policy.go
index 2ef32b698..e3c0c3baf 100644
--- a/plan/policy.go
+++ b/plan/policy.go
@@ -25,6 +25,7 @@ type Policy interface {
 var Policies = map[string]Policy{
 	"sync":        &SyncPolicy{},
 	"upsert-only": &UpsertOnlyPolicy{},
+	"create-only": &CreateOnlyPolicy{},
 }
 
 // SyncPolicy allows for full synchronization of DNS records.
@@ -35,7 +36,7 @@ func (p *SyncPolicy) Apply(changes *Changes) *Changes {
 	return changes
 }
 
-// UpsertOnlyPolicy allows evrything but deleting DNS records.
+// UpsertOnlyPolicy allows everything but deleting DNS records.
 type UpsertOnlyPolicy struct{}
 
 // Apply applies the upsert-only policy which strips out any deletions.
@@ -46,3 +47,13 @@ func (p *UpsertOnlyPolicy) Apply(changes *Changes) *Changes {
 		UpdateNew: changes.UpdateNew,
 	}
 }
+
+// CreateOnlyPolicy allows only creating DNS records.
+type CreateOnlyPolicy struct{}
+
+// Apply applies the create-only policy which strips out updates and deletions.
+func (p *CreateOnlyPolicy) Apply(changes *Changes) *Changes {
+	return &Changes{
+		Create:	changes.Create,
+	}
+}
\ No newline at end of file
diff --git a/plan/policy_test.go b/plan/policy_test.go
index 8580cfe72..4cffca4d7 100644
--- a/plan/policy_test.go
+++ b/plan/policy_test.go
@@ -52,6 +52,12 @@ func TestApply(t *testing.T) {
 			&Changes{Create: baz, UpdateOld: fooV1, UpdateNew: fooV2, Delete: bar},
 			&Changes{Create: baz, UpdateOld: fooV1, UpdateNew: fooV2, Delete: empty},
 		},
+		{
+			// CreateOnlyPolicy clears the list of updates and deletions.
+			&CreateOnlyPolicy{},
+			&Changes{Create: baz, UpdateOld: fooV1, UpdateNew: fooV2, Delete: bar},
+			&Changes{Create: baz, UpdateOld: empty, UpdateNew: empty, Delete: empty},
+		},
 	} {
 		// apply policy
 		changes := tc.policy.Apply(tc.changes)
@@ -68,6 +74,7 @@ func TestApply(t *testing.T) {
 func TestPolicies(t *testing.T) {
 	validatePolicy(t, Policies["sync"], &SyncPolicy{})
 	validatePolicy(t, Policies["upsert-only"], &UpsertOnlyPolicy{})
+	validatePolicy(t, Policies["create-only"], &CreateOnlyPolicy{})
 }
 
 // validatePolicy validates that a given policy is of the given type.