# Technitium DNS Server

### DNS Server

Username
Password
Forgot Password?

### DNS Server

New Update Available!
Last Hour Last Day Last Week Last Month Last Year Custom
Start End
100
100%
Total Queries
70
0%
No Error
5
0%
Server Failure
5
0%
NX Domain
10
0%
Refused
10
0%
Authoritative
10
0%
Recursive
10
0%
Cached
10
0%
Blocked
5
0%
Dropped
10
Clients
10
Zones
10
Cache
10
Allowed
10
Blocked
10
Allow List
10
Block List
Top Clients

Client | Queries |
--- | --- | ---

Top Domains

Domain | Hits |
--- | --- | ---

Top Blocked Domains

Domain | Hits |
--- | --- | ---

Page Number
Zones Per Page
0 zones

# | Zone | Type | DNSSEC | Status | Serial | Expiry | Last Modified |
--- | --- | --- | --- | --- | --- | --- | --- | ---
0 zones

- ← Back

### example.com

Primary DNSSEC Enabled catalog
Expiry: 01 Jan 2020 00:00:00
Page Number
Records Per Page
0 records

# | Name | Type | TTL | Data |
--- | --- | --- | --- | --- | ---
0 records

technitium.com

technitium.com

technitium.com

Installed Apps |
--- | ---
Total Apps: 0

Server
Domain
Type
DNS-over-
EDNS Client Subnet
Enable DNSSEC Validation

#### Response

#### Raw Responses ()

DNS Server Domain
The primary fully qualified domain name used by this DNS Server to identify itself.
DNS Server Local End Points
Local end points are the network interface IP addresses and ports you want the DNS Server to listen for requests. The default values work for Windows but on Linux when you have multiple network adapters, you must explicitly specify the network adapter IP addresses here as the local end points.
DNS Server IPv4 Source Addresses
The IPv4 source addresses that the DNS server must use for making all outbound DNS requests when the server is connected to two or more networks. Network addresses are also accepted. By default, the IPv4 address of the network with a default route will be used as the source address.
DNS Server IPv6 Source Addresses
The IPv6 source addresses that the DNS server must use for making all outbound DNS requests when the server is connected to two or more networks. Network addresses are also accepted. By default, the IPv6 address of the network with a default route will be used as the source address. Note that this option will be used only when `Prefer IPv6` option is enabled.
Note! The DNS Server local end point changes will be automatically applied and so you do not need to manually restart the main service.
Default Record TTL
seconds (default 3600)
The default TTL value to use if not specified when adding or updating records in a Zone.
Default Responsible Person
The default SOA Responsible Person email address to use when adding a Primary Zone.
Zone Defaults
Use SOA Serial Date Scheme
The default SOA Serial option to use if not specified when adding a Primary Zone.
Minimum SOA Refresh
seconds (default 300)
The minimum Refresh interval to be used by Secondary, Stub, Secondary Forwarder, and Secondary Catalog zones. This minimum value will be used if a zone's SOA Refresh value is less than it.
Minimum SOA Retry
seconds (default 300)
The minimum Retry interval to be used by Secondary, Stub, Secondary Forwarder, and Secondary Catalog zones zones. This minimum value will be used if a zone's SOA Retry value is less than it.
Zone Transfer Allowed Networks
Enter IP addresses or network addresses one below another that are allowed to perform zone transfer for all zones without any TSIG authentication.
Notify Allowed Networks
Enter IP addresses or network addresses one below another that are allowed to Notify all Secondary Zones.
DNS Apps
Enable Automatic Update
DNS server will check for DNS Apps update every day and will automatically download and install the updates.
IPv6 Support
Prefer IPv6
DNS Server will use IPv6 for querying whenever possible with this option enabled.
Warning! Use this option only if this DNS server has native IPv6 Internet access otherwise it will affect performance.
EDNS UDP Payload Size
bytes (valid range 512-4096; default 1232)
The maximum UDP payload size that can be used to avoid IP fragmentation.
DNSSEC
Enable DNSSEC Validation
DNS Server will validate all responses from name servers or forwarders when this option is enabled.

Warning! Devices that do not have a real-time clock and rely on NTP when booting (e.g. Raspberry Pi), enabling DNSSEC validation will cause failure to resolve the NTP server domain name thus causing the DNS server to fail to validate all other domain names too due to invalid system date/time. To fix this issue, just create a Conditional Forwarder zone for the NTP server domain name (e.g. ntp.org) with forwarder set to `this-server` and Enable DNSSEC Validation option unchecked. This conditional forwarder zone will disable DNSSEC validation for the NTP server domain name and allow the device to update its system data/time on boot.

Warning! When forwarders are configured, DNSSEC validation will work only if the forwarders are security aware i.e. can respond to DNSSEC requests correctly.

Note! Enabling DNSSEC may increase delays in resolving domain names when the cache is initially empty. As the cache fills up, the performance will be normal as expected.

EDNS Client Subnet (ECS)
Enable EDNS Client Subnet
DNS Server will use the public IP address of the request with a prefix length, or the existing Client Subnet option from the request.
ECS IPv4 Prefix Length
(valid range 0-32; default 24)
The IPv4 prefix length to define the client subnet.
ECS IPv6 Prefix Length
(valid range 0-64; default 56)
The IPv6 prefix length to define the client subnet.
ECS IPv4 Override
The IPv4 network address that must be used as ECS for all outbound requests overriding client's actual subnet.
ECS IPv6 Override
The IPv6 network address that must be used as ECS for all outbound requests overriding client's actual subnet.

Warning! EDNS Client Subnet (ECS) option when enabled will compromises user's privacy since the DNS server will send the user's public IP network subnet to name servers or forwarders when resolving requests. When not using encrypted DNS protocols, this information can also be read passively by anyone on the network.

Note! EDNS Client Subnet (ECS) option allows passing the user's client subnet information to name servers or forwarders so that the response may contain IP addresses of servers closer to the user's geographic region. EDNS Client Subnet (ECS) option thus is only useful when the DNS server is hosted in a geographically different region compared to the users that are configured to use it.

Note! Enabling EDNS Client Subnet (ECS) option will significantly increase the DNS server's memory usage since the server will have to cache data for each client subnet separately. It will also increase cache misses since DNS server will have to resolve requests and cache them for each client subnet separately.

Queries Per Minute (QPM) Limit (Requests)
(set 0 to disable)
The maximum queries a client subnet can make per minute on average based on the sample size.
Queries Per Minute (QPM) Limit (Errors)
(set 0 to disable)
The maximum queries that generate an error response a client subnet can make per minute on average based on the sample size. Responses with RCODE as `FormatError`, `ServerFailure`, or `Refused` are considered as error responses.
QPM Sample Size
minutes (valid range 1-60; default 5)
The sample size in minutes to be used for limiting queries per client.
QPM Limit IPv4 Prefix Length
(valid range 0-32; default 24)
The IPv4 prefix length to define the client subnet.
QPM Limit IPv6 Prefix Length
(valid range 0-64; default 56)
The IPv6 prefix length to define the client subnet.
QPM Limit Bypass List
Enter IP addresses or network addresses one below another that are allowed to bypass the QPM limit.
Note! Queries Per Minute (QPM) feature will limit requests from a client subnet based on its IP address and the specified subnet prefix lengths except for loopback IP addresses. The QPM limit configured will be compared with the average count from the sample size which means a client may exceed the QPM limit for a given minute but won't exceed for the given sample size in minutes. Rate limited clients will be listed in orange color on the dashboard top clients table.
Client Timeout
milliseconds (valid range 1000-10000; default 2000)
The amount of time the DNS server must wait before responding with a `ServerFailure` response to a client request when no answer is available.
TCP Send Timeout
milliseconds (valid range 1000-90000; default 10000)
The maximum amount of time the DNS Server will wait for the response to be sent. This option will apply for DNS requests being received by the DNS Server over TCP, TLS, TcpProxy, or HTTPS transports.
TCP Receive Timeout
milliseconds (valid range 1000-90000; default 10000)
The maximum amount of time the DNS Server will wait for receiving data. This option will apply for DNS requests being received by the DNS Server over TCP, TLS, TcpProxy, or HTTPS transports.
QUIC Idle Timeout
milliseconds (valid range 1000-90000; default 60000)
The time interval after which an idle QUIC connection will be closed. This option applies only to QUIC transport protocol.
QUIC Max Inbound Streams
(valid range 1-1000; default 100)
The max number of inbound bidirectional streams that can be accepted per QUIC connection. This option applies only to QUIC transport protocol.
Listen Backlog
(default 100)
The maximum number of pending inbound connections. This option applies to TCP, TLS, TcpProxy, and QUIC transport protocols.
Max Concurrent Resolutions
per CPU core (default 100)
The maximum number of concurrent async outbound resolutions that should be done per CPU core.
Web Service Local Addresses
Local addresses are the network interface IP addresses you want the web service to listen for requests. ANY addresses (0.0.0.0 & [::]) cannot be used together with unicast IP addresses. The default values work for most scenarios so, do not change these defaults unless you have a requirement for the web service to listen on specific networks. Configured unicast IP addresses will be included as Subject Alternative Name (SAN) in the self signed TLS certificate.
Web Service HTTP Port
(default 5380)
Specify the TCP port number for this web console over HTTP protocol.
HTTPS Options
Enable HTTPS
Enable HTTP/3
Enable HTTP to HTTPS Redirection
Use A Self Signed TLS Certificate When TLS Certificate File Path Is Unspecified
Web Service HTTPS Port
(default 53443)
Specify the TCP port number for this web console over TLS protocol.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx or .p12) file path on the server. The path can be relative to the DNS server's config folder. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.
Real IP Header
The HTTP header that must be used to read client's actual IP address when the request comes from a reverse proxy with a private IP address.

Note! The web service port changes will be automatically applied and so you do not need to manually restart the main service. The TLS certificate too will be automatically reloaded when the certificate file's date modified property on disk changes. This web page will be automatically redirected to the new web console URL after saving settings. The HTTPS protocol will be enabled only when a TLS certificate is configured.

When using a reverse proxy with the Web Service, you need to add `X-Real-IP` header to the proxy request with the IP address of the client to allow the Web server to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add `proxy_set_header X-Real-IP $remote_addr;` to make it work.

The web service uses Kestrel web server which supports both HTTP/2 and HTTP/3 protocols when TLS certificate is configured. HTTP/3 protocol support is not available on all platforms. On Windows, it is available only on Windows 11 (build 22000 or later) and Windows Server 2022. On Linux, it requires `libmsquic` to be installed.

Note! The web service will always bind to `[::]` local address for HTTP/3 protocol since this is how the `libmsquic` library is designed to work.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "privkey.pem" -in "cert.pem" -certfile "chain.pem"

Help: Configuring DNS-over-QUIC and HTTPS/3 For Technitium DNS Server
Optional DNS Server Protocols
Enable DNS-over-UDP-PROXY
Enable this option to accept DNS-over-UDP-PROXY requests. It implements the PROXY Protocol for both version 1 & 2 over UDP datagram. Configure Reverse Proxy Network ACL below to allow only requests coming from your reverse proxy server.
Enable DNS-over-TCP-PROXY
Enable this option to accept DNS-over-TCP-PROXY requests. It implements the PROXY Protocol for both version 1 & 2 over TCP connection. Configure Reverse Proxy Network ACL below to allow only requests coming from your reverse proxy server.
Enable DNS-over-HTTP
Enable this option to accept DNS-over-HTTP requests. It must be used with a TLS terminating reverse proxy like nginx. Configure Reverse Proxy Network ACL below to allow only requests coming from your reverse proxy server. Enabling this option also allows automatic TLS certificate renewal with HTTP challenge (webroot) for DNS-over-HTTPS service when DNS-over-HTTP port is set to 80.
Enable DNS-over-TLS
Enable this option to accept DNS-over-TLS requests.
Enable DNS-over-HTTPS
Enable this option to accept DNS-over-HTTPS requests.
Enable DNS-over-HTTP/3
Enable this option to accept DNS-over-HTTP/3 requests.
Enable DNS-over-QUIC
Enable this option to accept DNS-over-QUIC requests.
DNS-over-UDP-PROXY Port
(default 538)
Specify the UDP port number for DNS-over-UDP-PROXY protocol.
DNS-over-TCP-PROXY Port
(default 538)
Specify the TCP port number for DNS-over-TCP-PROXY protocol.
DNS-over-HTTP Port
(default 80)
Specify the TCP port number for DNS-over-HTTP protocol.
DNS-over-TLS Port
(default 853)
Specify the TCP port number for DNS-over-TLS protocol.
DNS-over-HTTPS Port
(default 443)
Specify the TCP port number for DNS-over-HTTPS protocol.
DNS-over-QUIC Port
(default 853)
Specify the UDP port number for DNS-over-QUIC protocol.
Reverse Proxy Network ACL
Configure the ACL above to allow only requests coming from your reverse proxy server for DNS-over-UDP-PROXY, DNS-over-TCP-PROXY, and DNS-over-HTTP protocols. This ACL will also be used for DNS-over-HTTPS protocol for reading Real IP Header. Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx or .p12) file path on the server. The path can be relative to the DNS server's config folder. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.
Real IP Header
The HTTP header that must be used to read client's actual IP address when the request comes from a reverse proxy.

Note! These optional DNS server protocol changes will be automatically applied and so you do not need to manually restart the main service. The TLS certificate too will be automatically reloaded when the certificate file's date modified property on disk changes. The DNS-over-TLS, DNS-over-QUIC, and DNS-over-HTTPS protocols will be enabled only when a TLS certificate is configured.

These optional DNS server protocols are used to host these as a service. You do not need to enable these optional protocols to use them with Forwarders or Conditional Forwarder Zones.

For DNS-over-HTTP, use `http://localhost:8053/dns-query` with a TLS terminating reverse proxy like nginx. For DNS-over-TLS, use `tls-certificate-domain:853`, for DNS-over-QUIC, use `tls-certificate-domain:853`, and for DNS-over-HTTPS use `https://tls-certificate-domain/dns-query` to configure supported DNS clients.

When using a reverse proxy with the DNS-over-HTTP service, you need to add `X-Real-IP` header to the proxy request with the IP address of the client to allow the DNS server to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add `proxy_set_header X-Real-IP $remote_addr;` to make it work.

DNS-over-QUIC protocol support is not available on all platforms. On Windows, it is available only on Windows 11 (build 22000 or later) and Windows Server 2022. On Linux, it requires `libmsquic` to be installed.

Note! The DNS-over-HTTP/3 protocol will always bind to `[::]` local address since this is how the `libmsquic` library is designed to work.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "privkey.pem" -in "cert.pem" -certfile "chain.pem"

Help: How To Host Your Own DNS-over-HTTPS, DNS-over-TLS, And DNS-over-QUIC Services
Help: Configuring DNS-over-QUIC and HTTPS/3 For Technitium DNS Server
TSIG Keys

Key Name | Shared Secret | Algorithm |
--- | --- | --- | ---

The shared secret can be a base64 string or a literal string. Keep the shared secret empty if you want to auto generate a strong key.
Note! You will need to configure these TSIG keys names for zone transfer in the zone options and in the secondary zone SOA record options separately.
Recursion
Deny Recursion
Disables recursion so that this DNS Server works as authoritative only.
Allow Recursion
Enables recursion to allow this DNS Server to resolve any domain name.
Allow Recursion Only For Private Networks (default)
Select this option if you want to support recursion only on private networks. Any recursive request from a public network will be refused.
Use Specified Network Access Control List (ACL)
Select this option to specify networks that must be allowed or denied recursion.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all except loopback.
Note! Disable recursion if you wish this server to act only as authoritative name server for the configured zones.
Recursive Resolver
Randomize Name
Enables QNAME case randomization when using UDP as the transport protocol to improve security.
QNAME Minimization
Enables QNAME minimization for recursive resolution to improve privacy.
NS Revalidation
Enables Delegation Revalidation for recursive resolution.
Resolver Retries
(valid range 1-10; default 2)
The total number of retries the recursive resolver must do per name server.
Resolver Timeout
milliseconds (valid range 1000-10000; default 1500)
The amount of time the recursive resolver must wait between retries.
Resolver Concurrency
(valid range 1-4; default 2)
The number of concurrent requests that should be sent by the recursive resolver to the name servers.
Resolver Max Stack Count
(valid range 10-30; default 16)
The maximum stack count the recursive resolver must use for resolving a domain name.
DNS Cache
Save Cache To Disk
Enable this option to save DNS cache on disk when the DNS server stops. The saved cache will be loaded next time the DNS server starts.
Note! The DNS server will attempt to save cache to disk when it stops which may take time depending on the cache size. If the DNS server takes a lot of time to stop then it may lead to the OS killing the DNS server process causing an incomplete cache to be stored on disk.
Serve Stale
Enable Serve Stale
Enable the Serve Stale feature to improve resiliency by using expired or stale records in cache to respond when the DNS server is unable to reach the upstream or authoritative name servers to refresh the expired records before the Max Wait Time configured below.
Serve Stale TTL
seconds (recommended 259200 i.e. 3 days)
The TTL value in seconds which should be used for cached records that are expired. When the serve stale TTL too expires for a stale record, it gets removed from the cache. Recommended value is between 1-3 days and maximum supported value is 7 days.
Serve Stale Answer TTL
seconds (valid range 0-300; recommended 30)
The TTL value in seconds which should be used for the records in a stale response. This is the TTL value that the client will be using to cache the stale records.
Serve Stale Reset TTL
seconds (valid range 10-900; recommended 30)
The TTL value in seconds which should be used to reset the stale record's TTL value in the cache when the resolver fails to refresh the data. The TTL reset causes the stale records to become valid again so that they can be used to serve requests normally. This reset effectively prevents the resolver from attempting to frequently update the stale records.
Serve Stale Max Wait Time
milliseconds (valid range 0-1800; default 1800)
The time in milliseconds that the DNS server must wait for the resolver before serving stale records from the cache. Lower value will ensure faster response at the expense of not getting updated data from the upstream. Setting value to 0 will instantly return stale answer without waiting for the resolver to fetch updates from the upstream.
Cache Maximum Entries
(default 10000; set 0 to disable)
The maximum number of entries that the cache can store. A relevant value should be configured by monitoring the Cache entries value on Dashboard and the server's memory usage to limit the amount of RAM used by the DNS server. A cache entry is a complete Resource Record Set (RR Set) which is a group of records with the same type for a given domain name. When a value is configured, the DNS server will trigger a clean up operation every few minutes and remove least recently used entries to maintain the maximum allowed entries in cache.
Cache Minimum TTL
seconds (recommended 10)
The minimum TTL value that a record can have in the cache. Set a value to make sure that the records with TTL value less than that stays in cache for a minimum duration.
Cache Maximum TTL
seconds (default 604800)
The maximum TTL value that a record can have in the cache. Set a lower value to allow the records to expire early.
Cache Negative TTL
seconds (recommended 300)
The negative TTL value to use when there is no SOA MINIMUM value available. Negative caching stores records in cache for `NXDOMAIN` and `NODATA` responses.
Cache Failure TTL
seconds (recommended 10)
The failure TTL value to be used for caching failure responses. This allows storing failure record in cache and prevent frequent recursive resolution requests to the name servers that are responding with `ServerFailure` or failing to respond.
Prefetch Eligibility
seconds (recommended 2)
The minimum initial TTL value of a record needed to be eligible for prefetching.
Prefetch Trigger
seconds (recommended 9; set 0 to disable prefetching & auto prefetching)
A record with TTL value less than trigger value will initiate prefetch operation immediately for itself.
Auto Prefetch Sampling
minutes (valid range 1-60; default 5)
The interval to sample eligible domain names from last hour stats for auto prefetch.
Auto Prefetch Eligibility
hits/hour (default 30)
Minimum required hits per hour for a domain name to be eligible for auto prefetch.
The DNS Server cache auto prefetch option can keep eligible domain names from last hour stats "hot" in cache. Auto prefetch eligibility value can be decided by keeping an eye on the hits shown for last hour on the dashboard. Experiment with auto prefetch sampling interval and eligibility to get best results.
Blocking
Enable Blocking
Sets the DNS server to block domain names using Blocked Zone and Block List Zone.
Allow TXT Blocking Report
Specifies if the DNS Server should respond with TXT records containing a blocked domain report for TXT type requests. This option also enables Extended DNS Error blocked domain report in response for requests that support EDNS.
Blocking Temporarily Disabled Till
minutes
Blocking Bypass List
Enter IP addresses or network addresses one below another that are allowed to bypass blocking.
Blocking Type
ANY Address
Uses `0.0.0.0` and `::` IP addresses for blocked domain names.
NX Domain (recommended)
Uses `NX Domain` response for blocked domain names.
Custom Address
Uses custom IP addresses provided below for blocked domain names.
Custom Blocking Addresses (IP Address)
Blocking Answer TTL
seconds (default 30)
The TTL value in seconds that must be used for the records in a blocking response. This is the TTL value that the client will use to cache the blocking response.
Allow / Block List URLs
Quick Add

Enter block list URL one below another in the above text field or use the Quick Add list to add known block list URLs.

For directly using block list files saved on this server, use the `file://` formatted URL path. For example, on Linux the URL should look like `file:///home/folder/myblocklist.txt` and on Windows it should look like `file:///c:/folder/myblocklist.txt`.

Add `!` character at the start of an URL to make it an allow list URL. This option must not be used with allow lists that use `Adblock Plus` format.

Block List Update Interval
hours (valid range 0-168; default 24; set 0 to disable)
The interval in hours to automatically download and update the block lists.
Block List Next Update On
Click the 'Update Now' button to reset the next update schedule and force download and update of the block lists.
Note! DNS Server will use the data returned by the block list URLs to update the block list zone automatically. The expected file format is standard `hosts` file format, plain text file containing list of domains to block, wildcard block list file format, or `Adblock Plus` file format.
Help: Blocking Internet Ads Using DNS Sinkhole
Network Proxy
No Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Username
Password
Proxy Bypass List
Enter IP addresses, network addresses or domain names to never proxy.
Note! When proxy server is configured, DNS Server will use it for all outbound network requests.
Forwarders
Quick Select
Enter forwarder DNS Server IP addresses or URLs one below another in above text field or use the Quick Select list to select desired forwarder.
Forwarder Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-QUIC
Select a protocol that this DNS server must use to query the forwarders specified above.
Concurrent Forwarding
Enable Concurrent Forwarding
Enable this option to allow querying two or more forwarders concurrently instead of sequentially querying them in their given order. The DNS server will automatically select forwarders (based on their average latency) to query and use the fastest response it receives from any of them. If none of the selected forwarders respond in time, the DNS server will similarly select forwarders from the remaining ones and queries them till all are tried before giving up.
Forwarder Concurrency
(valid range 1-10; default 2)
The number of concurrent requests that must be sent when Concurrent Forwarding is enabled for resolving a domain name.
Note! Forwarders are upstream DNS servers which this DNS Server must use to resolve domain names. If no forwarders are configured then the DNS server will use preconfigured ROOT HINTS to perform recursive resolution to resolve domain names.
Note! The `https` URL scheme supports only DNS-over-HTTPS/2 and DNS-over-HTTPS/1.1 protocols. For DNS-over-HTTPS/3, use `h3` URL scheme instead of `https` but note that there wont be any protocol fallback if the connection attempt fails.
Help: Configuring DNS Server For Privacy & Security
Help: Configuring DNS-over-QUIC and HTTPS/3 For Technitium DNS Server
Forwarder Retries
(valid range 1-10; default 3)
The total number of retries the forwarder or conditional forwarder resolver must do per upstream DNS server.
Forwarder Timeout
milliseconds (valid range 1000-10000; default 2000)
The amount of time the forwarder or conditional forwarder resolver must wait between retries.
Logging
Enable Logging
Enable this option to log error and audit logs into the log file.
Ignore Resolver Error Logs
Enable this option to stop logging domain name resolution errors into the log file.
Log All Queries
Enable this option to log every query received by this DNS Server and the corresponding response answers into the log file.
Use Local Time
Enable this option to use local time instead of UTC for logging.
Log Folder Path
The folder path on the server where the log files should be saved. The path can be relative to the DNS server's config folder.
Max Log File Days
days (default 365, set 0 to disable auto delete)
Max number of days to keep the log files. Log files older than the specified number of days will be deleted automatically.
Warning! Enabling query logging will significantly increase the log file size and use up disk space.
Stats
Enable In-Memory Stats
This option will enable in-memory stats and only Last Hour data will be available on Dashboard. No stats data will be stored on disk.
Max Stat File Days
days (default 365, set 0 to disable auto delete)
Max number of days to keep the dashboard stats. Stat files older than the specified number of days will be deleted automatically.

Scope | MAC Address | IP Address |  | Host Name | Lease Obtained | Lease Expires |
--- | --- | --- | --- | --- | --- | --- | ---
Total Leases: 0

Name | Scope Range/Subnet Mask | Network/Broadcast | Interface |
--- | --- | --- | --- | ---
Total Leases: 0

#### Edit Scope

Name
Starting Address
Ending Address
Subnet Mask
Lease Time
Days Hours Minutes
The duration for which the clients should be leased the IP address.
Offer Delay Time
milliseconds
The time duration that the DHCP server delays sending an DHCPOFFER message.
Ping Check
Enable Ping Check
Enable this option to allow DHCP server to find out if an IP address is already in use to prevent IP address conflict when some of the devices on the network have manually configured IP addresses.
Ping Check Timeout
milliseconds (default 1000)
The timeout interval to wait for an ping reply.
Ping Check Retries
(default 2)
The maximum number of ping requests to try.
Warning! Ping check would work as expected only when you make sure that all the client devices with manually configured IP addresses on the network respond to a ping request. Devices running Microsoft Windows by default drop ping requests at host firewall and will cause this ping check to fail to detect in use IP addresses. It is recommended to not rely on this option and instead make sure that you exclude a range of addresses using Exclusions and manually assign IP addresses to your devices only in the excluded range.
Domain Name
The domain name for this network to allow assigning a fully qualified domain name to clients. Use a domain name that you own or that is not in common use like 'home' or 'lan' so that you don't block out an existing domain name. (Option 15)
Domain Search List
The list of domain names that the clients can use as a suffix when searching a domain name. (Option 119)
DNS Updates
Enable DNS Updates
Enable this option to allow the DHCP server to automatically update forward and reverse DNS entries for clients.
DNS TTL
seconds (default 900)
The TTL value of the DNS records updated for the above provided domain name.
Router Address
The default gateway IP address to be used by the clients. (Option 3)
DNS Servers
Use This DNS Server
Enable this option to automatically use this DNS Server.
The DNS server IP addresses to be used by the clients. (Option 6)
WINS Servers
The NBNS/WINS server IP addresses to be used by the clients. (Option 44)
NTP Servers
The Network Time Protocol (NTP) server IP addresses to be used by the clients. (Option 42)
NTP Server Domain Names
Enter NTP server domain names (e.g. pool.ntp.org) above that the DHCP server should automatically resolve and pass the resolved IP addresses to clients as NTP server option. (Option 42)
Static Routes

Destination | Subnet Mask | Router |
--- | --- | --- | ---

The static routes to be used by the clients for accessing specified destination networks. (Option 121)
Bootstrap Server Address
The IP address of next server (TFTP) to use in bootstrap by the clients. If not specified, the DHCP server's IP address is used. (siaddr)
Bootstrap Server Host Name
The optional bootstrap server host name to be used by the clients to identify the TFTP server. (sname/Option 66)
Boot File Name
The boot file name stored on the bootstrap TFTP server to be used by the clients. (file/Option 67)
Vendor Specific Information

Vendor Class Identifier | Vendor Specific Information |
--- | --- | ---

The Vendor Specific Information (option 43) to be sent to the clients that match the Vendor Class Identifier (option 60) in the request. The Vendor Class Identifier can be empty string to match any identifier, or matched exactly, or match a substring, for example `substring(vendor-class-identifier,0,9)=="PXEClient"`. The Vendor Specific Information must be either a colon (:) separated hex string or a normal hex string, for example `06:01:03:0A:04:00:50:58:45:09:14:00:00:11:52:61:73:70:62:65:72:72:79:20:50:69:20:42:6F:6F:74:FF` OR `0601030A0400505845091400001152617370626572727920506920426F6F74FF`.
CAPWAP Access Controller Addresses
The Control And Provisioning of Wireless Access Points (CAPWAP) Access Controller IP addresses to be used by Wireless Termination Points to discover the Access Controllers to which it is to connect. (Option 138)
TFTP Server Addresses
The TFTP Server Address or the VoIP Configuration Server Address. (Option 150)
Generic DHCP Options

Code | Hex Value |
--- | --- | ---

This feature allows you to define DHCP options that are not yet directly supported. To add an option, use the DHCP option code defined for it and enter the value in either a colon (:) separated hex string or a normal hex string format, for example `C0:A8:01:01` OR `C0A80101`.
Exclusions

Starting Address | Ending Address |
--- | --- | ---

The IP address range that must be excluded or not assigned dynamically to any client by the DHCP server.
Note! Make sure to exclude address ranges if you plan to manually assign IP addresses to some of the devices or to assign reserved leases so that these IP addresses are not dynamically allocated in the first place.
Advanced Options
Allow Only Reserved Lease Allocations
Enable this option to stop dynamic IP address allocation and allocate only reserved IP addresses.
Block Locally Administered MAC Addresses
Enable this option to stop dynamic IP address allocation for clients with locally administered MAC addresses. MAC address with 0x02 bit set in the first octet indicate a locally administered MAC address which usually means that the device is not using its original MAC address.
Ignore Client Identifier (Option 61)
This option when enabled will always use the client's MAC address as the identifier to allocate lease instead of the Client Identifier (Option 61) provided by the client in the request. Some Linux distros use a custom Client Identifier instead of the device's MAC Address which can cause issues when the Virtual Machine (VM) in which the OS is installed is cloned causing both the original and cloned clients to get same IP allocated. There can be issues too when the same client changes its Client Identifier and starts getting a different IP address lease. Enabling the Ignore Client Identifier option will fix such issues. Changing this option may cause the existing clients to get a different IP lease on renewal.
Reserved Leases

Host Name | MAC Address | IP Address | Comments |
--- | --- | --- | --- | ---

The reserved IP addresses to be assigned to specific clients based on their MAC address. Set a hostname to override the client's hostname.

Username | Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | --- | ---

Username | Display Name | Status | Recent Login | Previous Login |
--- | --- | --- | --- | --- | ---

Name | Description |
--- | --- | ---

Section | User Permissions | Group Permissions |
--- | --- | --- | ---

20171012

App Name
Class Path
Page Number
Logs Per Page
Order
From
To
Client IP Address
Protocol
Response Type
RCODE
Domain
Type
Class
Found: 0 logs

# | Timestamp | Client IP Address | Protocol | Response Type | RCODE | Domain | Type | Class | Answer |
--- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---
Found: 0 logs

# Technitium DNS Server

Version

Server up since

Copyright (C) 2025 Shreyas Zare (shreyas@technitium.com)
This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions.

Source code available under GNU General Public License v3.0 on GitHub

### What's New?

Read the change log to know what's new in this release.

### API Documentation

The DNS server HTTP API allows any 3rd party app or script to configure the DNS server. The HTTP API is used by this web console and thus all the actions that this web console does can be performed via the API. Read the HTTP API documentation for complete details.

### Help Topics

Read the latest online help topics which contains the DNS Server user manual and covers frequently asked questions.

### Support

For support, send an email to support@technitium.com.

Follow @technitium@mastodon.social on Mastodon.
Checkout Technitium Blog.

Join /r/technitium on Reddit.

### Donate

Make a contribution to Technitium and help making new software, updates, and features possible.

Donate Now!

#### My Profile

Display Name
Username
Session Timeout
seconds (valid range 0-604800; default 1800; set 0 to disable)
Member Of

Group

Active Sessions

Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | ---

#### Create API Token

Username
Password
Token Name
WARNING! The token allows access to API calls with the same privileges as that of the user account. Thus its recommended to create a separate user account with limited permissions as required by the specific task that the token will be used for. The token cannot be used to change the user's password, or update the user profile details.
Username
Token Name
Token
WARNING! The token value above will not be displayed later. You must copy the token value immediately and save it for later use.

#### Change Password

Username
New Password
Confirm Password

#### Forgot Password?

To reset your password, you need to contact the DNS server administrator.

If you are an administrator, follow these steps to reset the 'admin' user's password:

1. Stop the DNS server.
2. Find the DNS Server config folder and locate the auth.config file. The config folder will be found where the DNS Server is installed on Windows or /etc/dns/ folder on Linux.
3. Rename the auth.config file as resetadmin.config
4. Start the DNS Server.
5. Just refresh this web page in the web browser to auto login with default credentials and quickly change the password.

On Linux, stop the DNS server by running 'sudo systemctl stop dns' command and 'sudo systemctl start dns' command to start it.

On Windows, press Win+R to open Run, enter 'services.msc', and press enter to open Services console. Find service named 'Technitium DNS Server' and use the Action menu to start/stop it.

Note: To reset 'admin' password, you will need file system access on the server running this DNS Server. If the 'admin' user does not exists then it will be created automatically.

#### New Update Available

Download Now! Update Instructions
Update Version:
Current Version:
Read Change Logs
Note! It is highly recommended to Backup Settings before installing the update.
Note! You will have to refresh this web page manually after updating the DNS server so that new UI changes are loaded.

#### Add Zone

Zone
Type
Primary Zone (default)
Secondary Zone
Stub Zone
Conditional Forwarder Zone
Secondary Conditional Forwarder Zone
Catalog Zone
Secondary Catalog Zone
Secondary ROOT Zone (RFC 8806)
Catalog Zone
Select a Catalog zone to register as its member zone.
Zone Serial
Use SOA Serial Date Scheme
Primary Name Server Addresses (Optional)
Enter the primary name server addresses to sync the zone from. When unspecified, the SOA Primary Name Server will be resolved and used.
Zone Transfer Protocol
XFR-over-TCP (default)
XFR-over-TLS
XFR-over-QUIC
TSIG Key Name (Optional)
Zone Validation
Use ZONEMD to Validate Zone
When enabled, the secondary zone will be validated using the ZONEMD record after every zone transfer. The zone will get disabled if the validation fails. The zone must be DNSSEC signed for the validation to work.
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-QUIC
Forwarder
Use "This Server"
When using "This Server", if a record does not exists in the zone then the request is forwarded to the DNS server's resolver internally. This allows you to override any record for the forwarded domain name or control its DNSSEC validation.
Enter a forwarder server address above. You can add more forwarders by adding FWD records after the zone is added.
DNSSEC
Enable DNSSEC Validation
Network Proxy
No Proxy
Default Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Proxy Server Username
Proxy Server Password

#### Add Edit Record

Name
.example.com
Type
TTL
seconds
RR Type
Value
Add reverse (PTR) record
Create reverse zone for PTR record
Name Server
Glue Addresses
Primary Name Server
Responsible Person
Serial
Use Serial Date Scheme
Refresh
Retry
Expire
Minimum
Preference
Exchange
Text Data
Use New Line To Split Text Into Multiple Character-Strings
Mailbox
TXT Domain
Priority
Weight
Port
Target
Order
Preference
Flags
Services
Regular Expression
Replacement
Key Tag
DNSSEC Algorithm
Digest Type
Digest
Algorithm
Fingerprint Type
Fingerprint
Certificate Usage
Selector
Matching Type
Certificate Association Data
Enter either a hash value that you have independently generated, OR enter the certificate in PEM format to automatically generate the association data based on the Selector and Matching Type values.
Priority
(set 0 for alias mode)
Target Name
Params

Key | Value |
--- | --- | ---

Automatic Hints
Use Automatic IPv4 Hint
Use Automatic IPv6 Hint
Priority
Weight
URI
Flags
Tag
Authority
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-QUIC
Forwarder
Use "This Server"
When using "This Server", if a record does not exists in the zone then the request is forwarded to the DNS server's resolver internally. This allows you to override any record for the forwarded domain name or control its DNSSEC validation.
Priority
(valid range 0-255; default 0)
Forwarders with high priority (lower value) will be queried before trying for low priority forwarders. Forwarders with the same priority will be concurrently queried.
DNSSEC
Enable DNSSEC Validation
Network Proxy
No Proxy
Default Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Proxy Server Username
Proxy Server Password
App Name
Class Path
Record Data (if any)
Overwrite existing records
Comments
Expiry TTL
seconds (set 0 to disable)
Set to automatically delete the record when the value in seconds elapses since the record’s last modified time.

#### Import -

Enter the records to be imported below in standard zone file format:

Zone File
Overwrite existing records
Enable this option to overwrite existing records for the record types being imported.
Overwrite SOA Serial
Enable this option to overwrite existing SOA record serial with the imported SOA record serial.

Note: The `$ORIGIN` and `$TTL` values will be automatically set if not specified.

Warning! Overwrite SOA serial option when used to set a lower SOA serial value than the current SOA serial will cause secondary zones to fail to sync.

#### Clone Zone -

Source Zone
New Zone

#### Convert Zone -

Convert To
Primary Zone
Conditional Forwarder Zone

#### Zone Options -

Catalog Zone
Select a Catalog zone to register as its member zone.
Override Options
Override Query Access Option
Enable to override Query Access option in the Catalog zone.
Override Zone Transfer Option
Enable to override Zone Transfer option in the Catalog zone.
Override Notify Option
Enable to override Notify option in the Catalog zone.
Notify Failed Name Servers
Note! When a zone becomes a member of a Catalog zone, all of the Catalog zone's Options are inherited unless they are explicitly overridden using the Override Options.
Primary Name Server Addresses (Optional)
Enter the primary name server addresses to sync the zone from. When unspecified, the SOA Primary Name Server will be resolved and used.
Zone Transfer Protocol
XFR-over-TCP (default)
XFR-over-TLS
XFR-over-QUIC
TSIG Key Name (Optional)
Zone Validation
Use ZONEMD to Validate Zone
When enabled, the secondary zone will be validated using the ZONEMD record after every zone transfer. The zone will get disabled if the validation fails. The zone must be DNSSEC signed for the validation to work.
Query Access
Deny
Denies everyone from querying the zone by refusing the request.
Allow (default)
Allows everyone to query the zone.
Allow Only Private Networks
Allows only private networks to query the zone. Any request from a public network will be refused.
Allow Only Name Servers In Zone
Allows only the name servers with an NS record in the zone to query the zone.
Use Specified Network Access Control List (ACL)
Uses the specified network access control list to allow/deny to query the zone.
Allow Zone Name Servers And Use Specified Network Access Control List (ACL)
Allows zone's name servers and uses specified network access control list to allow/deny to query the zone.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Note! The zone can always be queried from loopback IP addresses and internally by the DNS server irrespective of the Query Access configuration.
Zone Transfer
Deny
Denies everyone from performing a zone transfer.
Allow
Allows everyone to perform a zone transfer.
Allow Only Name Servers In Zone
Allows only the name servers with an NS record in the zone to perform a zone transfer.
Use Specified Network Access Control List (ACL)
Uses the specified network access control list to allow/deny to perform a zone transfer.
Allow Zone Name Servers And Use Specified Network Access Control List (ACL)
Allows zone's name servers and uses specified network access control list to allow/deny to perform a zone transfer.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Note! Zone transfer should be allowed only for trusted name servers to sync their secondary zone.
Zone Transfer TSIG Key Names
Quick Add
Note! TSIG key names must be configured from the Settings before using them here. Entering one or more TSIG key names above will cause the DNS server to authenticate all zone transfer requests. A secondary zone must be configured with one of the above keys to be able to perform a zone transfer.
Notify
None
Does not notify any name server when the zone is updated.
Name Servers In Zone
Notifies only the name servers with an NS record in the zone when the zone is updated.
Specified Name Servers
Notifies only the specified name servers when the zone is updated.
Both Zone Name Servers And Specified Name Servers
Notifies both the zone's name servers and the specified name servers when the zone is updated.
Separate Name Servers For Catalog And Member Zones
Notifies specified name servers for member zone updates and secondary catalog name servers for catalog zone updates.
Specified Name Servers
Enter only the IP addresses of the name servers above.
Secondary Catalog Name Servers
Enter only the IP addresses of the Secondary Catalog name servers above.
Notify Failed Name Servers
Note! Notification must be enabled to allow other name servers to trigger a zone transfer immediately when the zone is updated.
Dynamic Updates
Deny (default)
Denies everyone from performing dynamic updates.
Allow
Allows everyone to perform dynamic updates.
Allow Only Name Servers In Zone
Allows only the name servers with an NS record in the zone to perform dynamic updates.
Use Specified Network Access Control List (ACL)
Uses the specified network access control list to allow/deny to perform dynamic updates.
Allow Zone Name Servers And Use Specified Network Access Control List (ACL)
Allows zone's name servers and uses specified network access control list to allow/deny to perform dynamic updates.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Note! Dynamic updates should be allowed only to trusted IP addresses since they will be able to add/delete records in the zone.
Warning! If no security policy is configured in the Primary Zone then access will be provided only based on the options selected here. Thus setting up a security policy in the Primary Zone is highly recommended.

Security Policy

TSIG Key Name | Domain Name | Allowed Record Types |
--- | --- | --- | ---

Note! Configuring a security policy above will cause the DNS server to authenticate all dynamic update requests. A TSIG key can add/delete records only for the specified domain name and allowed record types. TSIG key names must be configured from the Settings before using them here. Use wildcard domain name to specify all sub domain names. Use a comma separator to specify more than one record type. Use ANY to specify all record types.

#### Sign Zone -

DNSKEY Algorithm
RSA
ECDSA (recommended)
Hash Algorithm
Key Signing Key (KSK) Size
Zone Signing Key (ZSK) Size
ECDSA Curve
Proof of Non-Existence
Next Secure (NSEC) (recommended)
With NSEC, all the records in your zone can be discovered by anyone using "zone walking" technique. NSEC is recommended if your zone does not contain any private/internal records.
Next Secure 3 (NSEC3)
NSEC3, makes it difficult to perform "zone walking" since it uses hashing with a random salt. NSEC3 should be used if your zone contains any private/internal records that you do not wish to be enumerable.
NSEC3 Iterations
(valid range 0-50, recommended 0)
The number of iterations used by NSEC3 for hashing the domain names. It is recommended to use 0 iterations since more iterations will increase computational costs for both the DNS server and resolver while not providing much value against "zone walking" [RFC 9276].
NSEC3 Salt Length
bytes (valid range 0-32, recommended 0)
The number of bytes of random salt to generate to be used with the NSEC3 hash computation. It is recommended to not use salt by setting the length to 0 [RFC 9276].
DNSKEY TTL
seconds (default 3600)
The TTL value to be used for DNSKEY records. A lower value will allow quicker addition or rollover to a new DNS Key at the cost of increased frequency of DNSKEY queries by resolvers.
ZSK Automatic Rollover
days (valid range 0-365; default 30; set 0 to disable)
The frequency at which the DNS server must automatically rollover all Zone Signing Key (ZSK) keys.

#### Unsign Zone -

WARNING! Unsigning the zone without removing all DS records from its parent zone will cause DNSSEC validating recursive resolvers to mark the zone as bogus and fail to resolve it.

WARNING! Make sure that you have removed all of the DS records from the parent zone and sufficient time has passed before unsigning this zone. You MUST wait for at least the number of seconds specified by the DS record's TTL value to elapse before unsigning the zone to ensure that all recursive resolvers would have expired the DS records from its cache. For example, if you have DS records at the parent zone with TTL value set to 86400 then you must wait for 86400 seconds (24 hours) to pass after you delete the DS records from the parent zone. Once you have ensured that you have waited for the appropriate time then you can unsign the zone safely.

NOTE! You can find out the TTL value of DS records for your zone by querying for DS records using the DNS Client tab.

WARNING! Unsigning the zone will permanently delete all of the private keys associated with it. Consider taking a backup before proceeding.

Are you sure you want to proceed to unsign the zone now?

#### View DS Info -

Use the DNS Key data given below to add DS records for your zone. Before adding the DS records, you must read and understand the following points:

- The Key State for a newly published DNS Key must be `Ready` before you can add a DS record for it. Adding DS record for a DNS Key with `Published` Key State may cause DNSSEC validation to fail for some DNS resolvers. A "ready by" timestamp is displayed to let you know when a DS record can be added for a DNS Key that is not "Ready" yet.
- You should add only one DS record for each Key Tag. That is, do not create multiple DS records for each Digest Type, instead use the Digest Type that is supported by your Domain Registrar.
- Use the provided Public Key if the Domain Registrar requires it instead of the Digest.

Key Tag | Key State | Algorithm | Digest Type | Digest
--- | --- | --- | --- | ---

#### DNSSEC Properties -

Key Tag | Key Type | Algorithm | State | State Changed | Rollover (days) |
--- | --- | --- | --- | --- | --- | ---

Key Type
Algorithm
Hash Algorithm
Key Size
ECDSA Curve
Automatic Key Rollover
days (valid range 0-365; default 30; set 0 to disable)
The frequency at which the DNS server must automatically rollover the key.
Proof of Non-Existence
Next Secure (NSEC) (recommended)
With NSEC, all the records in your zone can be discovered by anyone using "zone walking" technique. NSEC is recommended if your zone does not contain any private/internal records.
Next Secure 3 (NSEC3)
NSEC3, makes it difficult to perform "zone walking" since it uses hashing with a random salt. NSEC3 should be used if your zone contains any private/internal records that you do not wish to be enumerable.
NSEC3 Iterations
(valid range 0-50, recommended 0)
The number of iterations used by NSEC3 for hashing the domain names. It is recommended to use 0 iterations since more iterations will increase computational costs for both the DNS server and resolver while not providing much value against "zone walking" [RFC 9276].
NSEC3 Salt Length
bytes (valid range 0-32, recommended 0)
The number of bytes of random salt to generate to be used with the NSEC3 hash computation. It is recommended to not use salt by setting the length to 0 [RFC 9276].
DNSKEY TTL
seconds (default 3600)
The TTL value to be used for DNSKEY records. A lower value will allow quicker addition or rollover to a new DNS Key at the cost of increased frequency of DNSKEY queries by resolvers.
Warning! You MUST wait for at least the number of seconds specified by the the old TTL value to elapse before making any changes to the DNS keys above to ensure that all recursive resolvers would have expired the DNSKEY records from its cache. For example, if the old TTL value was 3600, then you must wait for 3600 seconds (1 hour) to pass before making any changes to the DNS keys.

#### Import Allowed Zones

Enter domain names one below other to import into Allowed Zone:

Allowed Zones

#### Import Blocked Zones

Enter domain names one below other to import into blocked zone:

Blocked Zones

#### DNS App Store

Store Apps |
--- | ---
Total Apps: 0

#### Install App

App Name
App Zip File

#### Update App

App Name
App Zip File

#### App Config -

Edit the `dnsApp.config` config file below as required by the DNS application.

Config File

Note: The app will reload the config automatically after you save it.

#### Backup Settings

The backup process will create a zip file for the items selected below:

Authentication Config File (auth.config)
DNS Settings And Certificate Files (dns.config, *.pfx, & *.p12)
Log Settings File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
DHCP Scope Files (*.scope)
DNS Apps
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)
Block List Cache Files

Note! The Web Service or Optional Protocols TLS certificate (.pfx or .p12) files will be included in the backup only if they exist within the DNS server's config folder.

Note! It may take several minutes to generate the backup zip file if log files are selected to be backed up which will depend on the size of the log files on the disk.

#### Restore Settings

Backup Zip File

The restore process will restore all the selected items from the backup zip file:

Authentication Config File (auth.config)
DNS Settings And Certificate Files (dns.config, *.pfx, & *.p12)
Log Settings File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
DHCP Scope Files (*.scope)
DNS Apps
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)
Block List Cache Files

Restore options:

Delete Existing Files For Selected Items

Warning! The restore process will overwrite existing config files on disk for above selected items and reload new settings including user accounts from the backup. The current logged in user account and current session will be added automatically.

#### Top Stats

Client | Queries |
--- | --- | ---

Domain | Hits |
--- | --- | ---

Domain | Hits |
--- | --- | ---

#### Remove Lease?

WARNING! Removing a DHCP lease from the server side will NOT remove the allocated IP address from the client side. Make sure that the client assigned this lease is not connected to the network before proceeding.

WARNING! Removing a DHCP lease may cause IP address conflict if the DHCP server assigns the same IP address to a new client while the old client is still connected to the network.

It is not recommended to remove a DHCP lease when the client is still connected or may connect back later to the network before the lease expires. Use this option only as a last resort.

Follow the recommendations below to avoid such a case that requires removing a DHCP lease:

- Use a shorter lease time such that a dynamically allocated lease expires quickly when the client exits the network.
- Use Exclusions to exclude IP address ranges from being dynamically allocated that you plan to assign manually to some of the devices on the network.
- Use Exclusions to make sure that you have unallocated addresses available in the DHCP scope to be assigned as reserved leases in future.
- Rely less on the assigned IP addresses by configuring a domain name for the DHCP scope and accessing all the devices using their domain names.

Are you sure you want to remove the DHCP lease now?

#### Add User

Display Name
Username
Password
Confirm Password

#### User Details

Display Name
Username
Disable User Account
Session Timeout
seconds (valid range 0-604800; default 1800; set 0 to disable)
Member Of
Add Group

Active Sessions

Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | ---

#### Add Group

Name
Description

#### Group Details

Name
Description
Members
Add User

#### Edit Permissions -

User Permissions

Username | View | Modify | Delete |
--- | --- | --- | --- | ---

Add User
Group Permissions

Group | View | Modify | Delete |
--- | --- | --- | --- | ---

Add Group