# Technitium DNS Server

### DNS Server

Username
Password
Forgot Password?

### DNS Server

New Version Available!
Last Hour Last Day Last Week Last Month Last Year
100
100%
Total Queries
70
0%
No Error
5
0%
Server Failure
5
0%
Name Error
10
0%
Refused
10
0%
Authoritative
10
0%
Recursive
10
0%
Cached
10
0%
Blocked
10
Clients
10
Zones
10
Allowed Zones
10
Blocked Zones
10
Block List Zones
Top Clients
[more]

Client | Queries
--- | ---
127.0.0.1 | 100
::1 | 10

Top Domains
[more]

Domain | Hits
--- | ---
example.com | 10

Top Blocked Domains
[more]

Domain | Hits
--- | ---
blocked.example.com | 10

Zone | Type | Status | Expiry |
--- | --- | --- | --- | ---
localhost | Primary | Expired | Date | Edit Disable Delete
Total Records: 1

- ← Back

### example.com

Primary Enabled Expiry: 01 Jan 2020 00:00:00

Name | Type | TTL | Data |
--- | --- | --- | --- | ---
@ | A | 3600 | 127.0.0.1 | Edit Disable Delete
Total Records: 1

technitium.com
technitium.com

technitium.com
technitium.com

technitium.com
technitium.com

Server
Domain
Type
Protocol

DNS Server Domain
The primary domain name used by this DNS Server to identify itself.
DNS Server Local End Points
Local end points are the network interface IP addresses and ports you want the DNS Server to listen for requests. The default values work for most scenarios so, do not change these defaults unless you have a requirement for the DNS server to listen on specific networks or ports.
Note! The DNS Server local end point changes will be automatically applied and so you do not need to manually restart the main service.
Web Service Local Addresses
Local addresses are the network interface IP addresses you want the web service to listen for requests. The default values work for most scenarios so, do not change these defaults unless you have a requirement for the web service to listen on specific networks.
Web Service HTTP Port
Specify the TCP port number for this web console over HTTP protocol.
HTTPS Options
Enable HTTPS
Enable HTTP to HTTPS Redirection
Web Service HTTPS Port
Specify the TCP port number for this web console over TLS protocol.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx) file path on the server. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.

Note! The web service port changes will be automatically applied and so you do not need to manually restart the main service. This web page will be automatically redirected to the new web console URL after saving settings. The HTTPS protocol will be enabled only when a TLS certificate is configured.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "private.key" -in "certificate.crt" -certfile "ca_bundle.crt"

Optional DNS Server Protocols
Enable DNS-over-HTTP `(TCP Port 8053)`
Enable this option to accept DNS-over-HTTP requests for both wire and json response formats. It must be used with a TLS terminating reverse proxy like nginx and will work only on private networks.
Enable DNS-over-TLS `(TCP Port 853)`
Enable this option to accept DNS-over-TLS requests.
Enable DNS-over-HTTPS `(TCP Port 80 & 443)`
Enable this option to accept DNS-over-HTTPS requests for both wire and json response formats.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx) file path on the server. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.

Note! These optional DNS server protocol changes will be automatically applied and so you do not need to manually restart the main service. The DNS-over-TLS and DNS-over-HTTPS protocols will be enabled only when a TLS certificate is configured.

These optional DNS server protocols are used to host these as a service. You do not need to enable these optional protocols to use them with Forwarders or Conditional Forwarder Zones.

For DNS-over-HTTP, use `http://localhost:8053/dns-query` with a TLS terminating reverse proxy like nginx. For DNS-over-TLS, use `tls-certificate-domain:853` and for DNS-over-HTTPS use `https://tls-certificate-domain/dns-query` to configure supported DNS clients.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "private.key" -in "certificate.crt" -certfile "ca_bundle.crt"

Help: How To Host Your Own DNS-over-HTTPS And DNS-over-TLS Services
IPv6 Support
Prefer IPv6
DNS Server will use IPv6 for querying whenever possible with this option enabled.
Use this option only if this DNS server has native IPv6 Internet access otherwise it will affect performance.
Logging
Enable Logging
Enable this option to log error and audit logs into the log file.
Log All Queries
Enable this option to log every query received by this DNS Server and the corresponding response answers into the log file.
Use Local Time
Enable this option to use local time instead of UTC for logging.
Log Folder Path
The folder path on the server where the log files should be saved. The path can be relative to the DNS server config folder.
Max Log File Days
days (recommended 365, set 0 to disable auto delete)
Max number of days to keep the log files. Log files older than the specified number of days will be deleted automatically.
Warning! Enabling query logging will significantly increase the log file size and use up disk space.
Recursive Resolver
Allow Recursion
Enable recursion to allow this DNS Server to resolve any domain name.
Allow Recursion Only For Private Networks
Enable this option if you want to support recursion only on private networks. Any recursive request from public network will be refused.
Randomize Name
Enables QNAME randomization when using UDP as the transport protocol.
Disable recursion if you wish this server to act only as authoritative name server for the configured zones.
DNS Cache
Serve Stale
Enable the serve stale feature to improve resiliency by using expired or stale records in cache when the DNS server is unable to reach the upstream or authoritative name servers.
Serve Stale TTL
(recommended 259200 seconds i.e. 3 days)
The TTL value in seconds which should be used for cached records that are expired. When the serve stale TTL too expires for a stale record, it gets removed from the cache. Recommended value is between 1-3 days and maximum supported value is 7 days.
Prefetch Eligibility
(recommended 2)
The minimum initial TTL value of a record needed to be eligible for prefetching.
Prefetch Trigger
(recommended 9; set 0 to disable prefetching & auto prefetching)
A record with TTL value less than trigger value will initiate prefetch operation immediately for itself.
Auto Prefetch Sampling
minutes (valid range 1-60; default 5)
The interval to sample eligible domain names from last hour stats for auto prefetch.
Auto Prefetch Eligibility
hits/hour (default 30)
Minimum required hits per hour for a domain name to be eligible for auto prefetch.
The DNS Server cache auto prefetch option can keep eligible domain names from last hour stats "hot" in cache. Auto prefetch eligibility value can be decided by keeping an eye on the hits shown for last hour on the dashboard. Experiment with auto prefetch sampling interval and eligibility to get best results.
Block List URLs
Quick Add
Enter block list URL one below another in the above text field or use the Quick Add list to add known block list URLs.
Block List Update Interval
hours (default 24, valid range 1-168)
The interval in hours to automatically download and update the block lists.
Block List Next Update On
Click the 'Update Now' button to reset the next update schedule and force download and update of the block lists.
DNS Server will use the data returned by the block list URLs to update the block list zone automatically. The expected file format is standard `hosts` file format or plain text file containing list of domains to block.
Help: Blocking Internet Ads Using DNS Sinkhole
Network Proxy
No Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Address
Proxy Port
Username
Password
Proxy Bypass List
Enter IP addresses, network addresses or domain names to never proxy.
When proxy server is configured, DNS Server will use it for all outbound network requests.
Forwarders
Quick Select
Enter forwarder DNS Server IP addresses or URLs one below another in above text field or use the Quick Select list to select desired forwarder.
Forwarder Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-HTTPS (JSON)
Select a protocol that this DNS server must use to query the forwarders specified above.
Forwarders are DNS servers which this DNS Server should use to resolve recursive queries. If no forwarders are configured then this DNS server will use preconfigured ROOT SERVERS to perform recursive resolution.
Help: Configuring DNS Server For Privacy & Security

Scope | MAC Address | IP Address |  | Host Name | Lease Obtained | Lease Expires
--- | --- | --- | --- | --- | --- | ---
Default | 00-00-00-00-00-00 | 192.168.10.2 | Dynamic | user-pc.local | 6/14/2019 3:39 PM | 6/15/2019 3:39 PM
Total Leases: 1

Name | Scope Range/Subnet Mask | Network/Broadcast | Interface |
--- | --- | --- | --- | ---
Default | 192.168.10.1 - 192.168.10.100 | 192.168.10.0 192.168.10.255 | 192.168.10.1 | Edit Delete
Total Leases: 1

#### Edit Scope

Name
Starting Address
Ending Address
Subnet Mask
Lease Time
Days Hours Minutes
The duration for which the clients should be leased the IP address.
Offer Delay Time
(milli seconds)
The time duration that the DHCP server delays sending an DHCPOFFER message.
Domain Name
The domain name for this network to allow updating DNS forward and reverse records for all clients. Use a domain name that you own or that is not in common use like 'local' so that you don't block out an existing domain name.
DNS TTL
(seconds)
The TTL value of the DNS records updated for the above provided domain name.
Router Address
The default gateway IP address to be used by the clients.
DNS Servers
Use This DNS Server
Enable this option to automatically use this DNS Server.
The DNS server IP addresses to be used by the clients.
WINS Servers
The NBNS/WINS server IP addresses to be used by the clients.
NTP Servers
The Network Time Protocol (NTP) server IP addresses to be used by the clients.
Static Routes

Destination | Subnet Mask | Router |
--- | --- | --- | ---

The static routes to be used by the clients for accessing specified destination networks.
Bootstrap Server Address
The bootstrap TFTP server IP address to be used by the clients. If not specified, the DHCP server's IP address is used.
Bootstrap Server Host Name
The optional bootstrap TFTP server host name to be used by the clients to identify the TFTP server.
Boot File Name
The boot file name stored on the bootstrap TFTP server to be used by the clients.
Vendor Specific Information

Vendor Class Identifier | Vendor Specific Information |
--- | --- | ---

The vendor specific information option (43) to be sent to the clients that match the vendor class identifier option (60) in the request. The vendor class identifier can be empty string to match any identifier, or matched exactly, or match a substring, for example `substring(vendor-class-identifier,0,9)=="PXEClient"`. The vendor specific information must be a colon (:) separated hex string, for example `06:01:03:0A:04:00:50:58:45:09:14:00:00:11:52:61:73:70:62:65:72:72:79:20:50:69:20:42:6F:6F:74:FF`.
Exclusions

Starting Address | Ending Address |
--- | --- | ---

The IP address range that must be excluded or not assigned dynamically to any client by the DHCP server.
Reserved Leases
Allow Only Reserved Lease Allocations
Enable this option to stop dynamic IP address allocation and allocate only reserved IP addresses.

Host Name | MAC Address | IP Address | Comments |
--- | --- | --- | --- | ---

The reserved IP addresses to be assigned to specific clients based on their MAC address.
20171012
20171012

# Technitium DNS Server

Version

Copyright (C) 2021 Shreyas Zare (shreyas@technitium.com)
This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions.

Source code available under GNU General Public License v3.0 on GitHub

### What's New?

Read the change log to know whats new in this release.

### API Documentation

The DNS server HTTP API allows any 3rd party app or script to configure the DNS server. The HTTP API is used by this web console and thus all the actions that this web console does can be performed via the API. Read the HTTP API documentation for complete details.

### Help Topics

Read the latest online help topics which contains the DNS Server user manual and covers frequently asked questions.

### Support

For support, send an email to support@technitium.com.

Follow @technitium on Twitter.
Checkout Technitium Blog.

### Become A Patron

Make contribution to Technitium by becoming a Patron and help making new software, updates, and features possible.

Become A Patron Now!

#### Change Password

Username
New Password
Confirm Password

#### Forgot Password?

Follow these steps to reset 'admin' password:

1. Find the DNS Server config folder and locate the dns.config file. The config folder will be found where the DNS Server is installed.
2. Rename the dns.config file as reset.config
3. Restart the DNS Server to complete the password reset process.
4. Just refresh this web page in the web browser to auto login with default credentials and quickly change the password.

Note: To reset 'admin' password, you will need file system access on the server running this DNS Server.

#### Add Zone

Zone
Type
Primary Zone (default)
Secondary Zone
Stub Zone
Conditional Forwarder Zone
Primary Name Server Addresses (Optional)
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-HTTPS (JSON)
Forwarder
Use This DNS Server

#### Add Edit Record

Name
.example.com
Type
TTL
Value
Add reverse (PTR) record
Create reverse zone for PTR record
Name Server
Glue Addresses
Primary Name Server
Responsible Person
Serial
Refresh
Retry
Expire
Minimum
Primary Name Server Addresses
Preference
Exchange
Priority
Weight
Port
Target
Flags
Tag
Authority
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-HTTPS (JSON)
Forwarder
Use This DNS Server

#### Import Allowed Zones

Enter domain names one below other to import into Allowed Zone:

Allowed Zones

#### Import Blocked Zones

Enter domain names one below other to import into blocked zone:

Blocked Zones

#### Backup Settings

The backup process will create a zip file for the items selected below:

DNS Settings File (dns.config)
Log Settings File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
DHCP Scope Files (*.scope)
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)
Block List Cache Files

Note! It may take several minutes to generate the backup zip file if log files are selected to be backed up which will depend on the size of the log files on the disk.

#### Restore Settings

Backup Zip File

The restore process will restore all the selected items from the backup zip file:

DNS Settings File (dns.config)
Log Settings File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
DHCP Scope Files (*.scope)
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)
Block List Cache Files

Warning! The restore process will delete the existing files on disk for above selected items and reload new settings including passwords. If you do not remember the password used while creating the backup, you should reset the admin password immediately after restoring the backup. Failing to do so will require you to follow the password reset process.

#### Top Stats

Client | Queries
--- | ---
127.0.0.1 | 100
::1 | 10

Domain | Hits
--- | ---
example.com | 10

Domain | Hits
--- | ---
blocked.example.com | 10