### DNS Server

Username
Password
Forgot Password?

### DNS Server

New Update Available!
Last Hour Last Day Last Week Last Month Last Year Custom
Start End
100
100%
Total Queries
70
0%
No Error
5
0%
Server Failure
5
0%
NX Domain
10
0%
Refused
10
0%
Authoritative
10
0%
Recursive
10
0%
Cached
10
0%
Blocked
10
Clients
10
Hosted Zones
10
Cached Entries
10
Allowed Zones
10
Blocked Zones
10
Block List Zones
Top Clients
[more]

Client | Queries
--- | ---

Top Domains
[more]

Domain | Hits |
--- | --- | ---

Top Blocked Domains
[more]

Domain | Hits |
--- | --- | ---

Zone | Type | DNSSEC | Status | Expiry |
--- | --- | --- | --- | --- | ---
Total Records: 0

- ← Back

### example.com

Primary DNSSEC Enabled Expiry: 01 Jan 2020 00:00:00

Name | Type | TTL | Data |
--- | --- | --- | --- | ---
Total Records: 0

technitium.com

technitium.com

technitium.com

Installed Apps |
--- | ---
Total Apps: 0

Server
Domain
Type
DNS-over-
Enable DNSSEC Validation

DNS Server Domain
The primary fully qualified domain name used by this DNS Server to identify itself.
DNS Server Local End Points
Local end points are the network interface IP addresses and ports you want the DNS Server to listen for requests. The default values work for Windows but on Linux when you have multiple network adapters, you must explicitly specify the network adapter IP addresses here as the local end points.
Note! The DNS Server local end point changes will be automatically applied and so you do not need to manually restart the main service.
Default Record TTL
seconds (default 3600)
The default TTL value to use if not specified when adding or updating records in a Zone.
DNS Apps
Enable Automatic Update
DNS server will check for DNS Apps update every day and will automatically download and install the updates.
IPv6 Support
Prefer IPv6
DNS Server will use IPv6 for querying whenever possible with this option enabled.
Warning! Use this option only if this DNS server has native IPv6 Internet access otherwise it will affect performance.
EDNS UDP Payload Size
bytes (valid range 512-4096; default 1232)
The maximum UDP payload size that can be used to avoid IP fragmentation.
DNSSEC
Enable DNSSEC Validation
DNS Server will validate all responses from name servers or forwarders when this option is enabled.

Warning! Devices that do not have a real-time clock and rely on NTP when booting (e.g. Raspberry Pi), enabling DNSSEC validation will cause failure to resolve the NTP server domain name thus causing the DNS server to fail to validate all other domain names too due to invalid system date/time. To fix this issue, just create a Conditional Forwarder zone for the NTP server domain name (e.g. ntp.org) with forwarder set to `this-server` and Enable DNSSEC Validation option unchecked. This conditional forwarder zone will disable DNSSEC validation for the NTP server domain name and allow the device to update its system data/time on boot.

Warning! When forwarders are configured, DNSSEC validation will work only if the forwarders are security aware i.e. can respond to DNSSEC requests correctly.

Note! Enabling DNSSEC may increase delays in resolving domain names when the cache is initially empty. As the cache fills up, the performance will be normal as expected.

EDNS Client Subnet (ECS)
Enable EDNS Client Subnet
DNS Server will use the public IP address of the request with a prefix length, or the existing Client Subnet option from the request.
ECS IPv4 Prefix Length
(valid range 0-32; default 24)
The IPv4 prefix length to define the client subnet.
ECS IPv6 Prefix Length
(valid range 0-64; default 56)
The IPv6 prefix length to define the client subnet.

Warning! EDNS Client Subnet (ECS) option when enabled will compromises user's privacy since the DNS server will send the user's public IP network subnet to name servers or forwarders when resolving requests. When not using encrypted DNS protocols, this information can also be read passively by anyone on the network.

Note! EDNS Client Subnet (ECS) option allows passing the user's client subnet information to name servers or forwarders so that the response may contain IP addresses of servers closer to the user's geographic region. EDNS Client Subnet (ECS) option thus is only useful when the DNS server is hosted in a geographically different region compared to the users that are configured to use it.

Note! Enabling EDNS Client Subnet (ECS) option will significantly increase the DNS server's memory usage since the server will have to cache data for each client subnet separately. It will also increase cache misses since DNS server will have to resolve requests and cache them for each client subnet separately.

Queries Per Minute (QPM) Limit (Requests)
(set 0 to disable)
The maximum queries a client subnet can make per minute on average based on the sample size.
Queries Per Minute (QPM) Limit (Errors)
(set 0 to disable)
The maximum queries that generate an error response a client subnet can make per minute on average based on the sample size. Responses with RCODE as `FormatError`, `ServerFailure`, or `Refused` are considered as error responses.
QPM Sample Size
minutes (valid range 1-60; default 5)
The sample size in minutes to be used for limiting queries per client.
QPM Limit IPv4 Prefix Length
(valid range 0-32; default 24)
The IPv4 prefix length to define the client subnet.
QPM Limit IPv6 Prefix Length
(valid range 0-64; default 56)
The IPv6 prefix length to define the client subnet.
Note! Queries Per Minute (QPM) feature will limit requests from a client subnet based on its IP address and the specified subnet prefix lengths. The QPM limit configured will be compared with the average count from the sample size which means a client may exceed the QPM limit for a given minute but won't exceed for the given sample size in minutes.
Client Timeout
milliseconds (valid range 1000-10000; default 4000)
The amount of time the DNS server must wait before responding with a `ServerFailure` response to a client request when no answer is available.
TCP Send Timeout
milliseconds (valid range 1000-90000; default 10000)
The amount of time a TCP socket must wait for an `ACK` before closing the connection. This option will apply for DNS requests being received by the DNS Server over TCP, TLS, or HTTPS transports.
TCP Receive Timeout
milliseconds (valid range 1000-90000; default 10000)
The amount of time a TCP socket must wait for data before closing the connection. This option will apply for DNS requests being received by the DNS Server over TCP, TLS, or HTTPS transports.
Web Service Local Addresses
Local addresses are the network interface IP addresses you want the web service to listen for requests. The default values work for most scenarios so, do not change these defaults unless you have a requirement for the web service to listen on specific networks.
Web Service HTTP Port
Specify the TCP port number for this web console over HTTP protocol.
HTTPS Options
Enable HTTPS
Enable HTTP to HTTPS Redirection
Use A Self Signed TLS Certificate When TLS Certificate File Path Is Unspecified
Web Service HTTPS Port
Specify the TCP port number for this web console over TLS protocol.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx) file path on the server. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.

Note! The web service port changes will be automatically applied and so you do not need to manually restart the main service. This web page will be automatically redirected to the new web console URL after saving settings. The HTTPS protocol will be enabled only when a TLS certificate is configured.

When using a reverse proxy with the Web Service, you need to add `X-Real-IP` header to the proxy request with the IP address of the client to allow the Web server to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add `proxy_set_header X-Real-IP $remote_addr;` to make it work.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "privkey.pem" -in "cert.pem" -certfile "chain.pem"

Optional DNS Server Protocols
Enable DNS-over-HTTP `(TCP Port 8053)`
Enable this option to accept DNS-over-HTTP requests. It must be used with a TLS terminating reverse proxy like nginx and will work only on private networks.
Enable DNS-over-TLS `(TCP Port 853)`
Enable this option to accept DNS-over-TLS requests.
Enable DNS-over-HTTPS `(TCP Port 80 & 443)`
Enable this option to accept DNS-over-HTTPS requests.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx) file path on the server. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.

Note! These optional DNS server protocol changes will be automatically applied and so you do not need to manually restart the main service. The DNS-over-TLS and DNS-over-HTTPS protocols will be enabled only when a TLS certificate is configured.

These optional DNS server protocols are used to host these as a service. You do not need to enable these optional protocols to use them with Forwarders or Conditional Forwarder Zones.

For DNS-over-HTTP, use `http://localhost:8053/dns-query` with a TLS terminating reverse proxy like nginx. For DNS-over-TLS, use `tls-certificate-domain:853` and for DNS-over-HTTPS use `https://tls-certificate-domain/dns-query` to configure supported DNS clients.

When using a reverse proxy with the DNS-over-HTTP service, you need to add `X-Real-IP` header to the proxy request with the IP address of the client to allow the DNS server to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add `proxy_set_header X-Real-IP $remote_addr;` to make it work.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "privkey.pem" -in "cert.pem" -certfile "chain.pem"

Help: How To Host Your Own DNS-over-HTTPS And DNS-over-TLS Services
TSIG Keys

Key Name | Shared Secret | Algorithm |
--- | --- | --- | ---

The shared secret can be a base64 string or a literal string. Keep the shared secret empty if you want to auto generate a strong key.
Note! You will need to configure these TSIG keys names for zone transfer in the zone options and in the secondary zone SOA record options separately.
Recursion
Deny Recursion
Disables recursion so that this DNS Server works as authoritative only.
Allow Recursion
Enables recursion to allow this DNS Server to resolve any domain name.
Allow Recursion Only For Private Networks (default)
Select this option if you want to support recursion only on private networks. Any recursive request from a public network will be refused.
Allow/Deny Recursion For Specified Networks
Select this option to specify which networks (in CIDR form) must be allowed or denied. Denied networks are always matched first.
Denied Networks (CIDR) Allowed Networks (CIDR)
Note! Disable recursion if you wish this server to act only as authoritative name server for the configured zones.
Recursive Resolver
Randomize Name
Enables QNAME randomization when using UDP as the transport protocol to improve security.
QNAME Minimization
Enables QNAME minimization for recursive resolution to improve privacy.
NS Revalidation
Enables Delegation Revalidation for recursive resolution.
Resolver Retries
(valid range 1-10; default 2)
The total number of retries the recursive resolver must do per name server.
Resolver Timeout
milliseconds (valid range 1000-10000; default 2000)
The amount of time the recursive resolver must wait between retries.
Resolver Max Stack Count
(valid range 10-30; default 16)
The maximum stack count the recursive resolver must use for resolving a domain name.
Serve Stale
Enable Serve Stale
Enable the Serve Stale feature to improve resiliency by using expired or stale records in cache when the DNS server is unable to reach the upstream or authoritative name servers.
Serve Stale TTL
seconds (recommended 259200 i.e. 3 days)
The TTL value in seconds which should be used for cached records that are expired. When the serve stale TTL too expires for a stale record, it gets removed from the cache. Recommended value is between 1-3 days and maximum supported value is 7 days.
Cache Maximum Entries
(default 10000; set 0 to disable)
The maximum number of entries that the cache can store. A relevant value should be configured by monitoring the Cached Entries value on Dashboard and the server's memory usage to limit the amount of RAM used by the DNS server. A cache entry is a complete Resource Record Set (RR Set) which is a group of records with the same type for a given domain name. When a value is configured, the DNS server will trigger a clean up operation every few minutes and remove least recently used entries to maintain the maximum allowed entries in cache.
Cache Minimum TTL
seconds (recommended 10)
The minimum TTL value that a record can have in the cache. Set a value to make sure that the records with TTL value less than that stays in cache for a minimum duration.
Cache Maximum TTL
seconds (default 604800)
The maximum TTL value that a record can have in the cache. Set a lower value to allow the records to expire early.
Cache Negative TTL
seconds (recommended 300)
The negative TTL value to use when there is no SOA MINIMUM value available.
Cache Failure TTL
seconds (recommended 60)
The failure TTL value to be used for caching failure responses. This allows storing failure record in cache and prevent frequent recursive resolution requests to the name servers that are responding with `ServerFailure`.
Prefetch Eligibility
seconds (recommended 2)
The minimum initial TTL value of a record needed to be eligible for prefetching.
Prefetch Trigger
seconds (recommended 9; set 0 to disable prefetching & auto prefetching)
A record with TTL value less than trigger value will initiate prefetch operation immediately for itself.
Auto Prefetch Sampling
minutes (valid range 1-60; default 5)
The interval to sample eligible domain names from last hour stats for auto prefetch.
Auto Prefetch Eligibility
hits/hour (default 30)
Minimum required hits per hour for a domain name to be eligible for auto prefetch.
The DNS Server cache auto prefetch option can keep eligible domain names from last hour stats "hot" in cache. Auto prefetch eligibility value can be decided by keeping an eye on the hits shown for last hour on the dashboard. Experiment with auto prefetch sampling interval and eligibility to get best results.
Blocking
Enable Blocking
Sets the DNS server to block domain names using Blocked Zone and Block List Zone.
Allow TXT Blocking Report
Specifies if the DNS Server should respond with TXT records containing a blocked domain report for TXT type requests.
Blocking Temporarily Disabled Till
minutes
Blocking Type
Any Address (default)
Uses `0.0.0.0` and `::` IP addresses for blocked domain names.
NX Domain
Uses `NX Domain` response for blocked domain names.
Custom Address
Uses custom IP addresses provided below for blocked domain names.
Custom Blocking Addresses (IP Address)
Allow / Block List URLs
Quick Add

Enter block list URL one below another in the above text field or use the Quick Add list to add known block list URLs.

Add `!` character at the start of an URL to make it an allow list URL. Domain names in such an allow list URL are prevented from being added to the block list zone.

Block List Update Interval
hours (valid range 0-168; default 24; set 0 to disable)
The interval in hours to automatically download and update the block lists.
Block List Next Update On
Click the 'Update Now' button to reset the next update schedule and force download and update of the block lists.
DNS Server will use the data returned by the block list URLs to update the block list zone automatically. The expected file format is standard `hosts` file format or plain text file containing list of domains to block.
Help: Blocking Internet Ads Using DNS Sinkhole
Network Proxy
No Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Username
Password
Proxy Bypass List
Enter IP addresses, network addresses or domain names to never proxy.
When proxy server is configured, DNS Server will use it for all outbound network requests.
Forwarders
Quick Select
Enter forwarder DNS Server IP addresses or URLs one below another in above text field or use the Quick Select list to select desired forwarder.
Forwarder Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
Select a protocol that this DNS server must use to query the forwarders specified above.
Forwarders are DNS servers which this DNS Server should use to resolve recursive queries. If no forwarders are configured then this DNS server will use preconfigured ROOT SERVERS to perform recursive resolution.
Help: Configuring DNS Server For Privacy & Security
Forwarder Retries
(valid range 1-10; default 3)
The total number of retries the forwarder or conditional forwarder resolver must do per upstream DNS server.
Forwarder Timeout
milliseconds (valid range 1000-10000; default 2000)
The amount of time the forwarder or conditional forwarder resolver must wait between retries.
Forwarder Concurrency
(valid range 1-10; default 2)
The number of concurrent requests that the forwarder or conditional forwarder resolver must send when resolving a domain name.
Logging
Enable Logging
Enable this option to log error and audit logs into the log file.
Log All Queries
Enable this option to log every query received by this DNS Server and the corresponding response answers into the log file.
Use Local Time
Enable this option to use local time instead of UTC for logging.
Log Folder Path
The folder path on the server where the log files should be saved. The path can be relative to the DNS server config folder.
Max Log File Days
days (default 365, set 0 to disable auto delete)
Max number of days to keep the log files. Log files older than the specified number of days will be deleted automatically.
Max Stat File Days
days (default 365, set 0 to disable auto delete)
Max number of days to keep the dashboard stats. Stat files older than the specified number of days will be deleted automatically.
Warning! Enabling query logging will significantly increase the log file size and use up disk space.

Scope | MAC Address | IP Address |  | Host Name | Lease Obtained | Lease Expires |
--- | --- | --- | --- | --- | --- | --- | ---
Total Leases: 0

Name | Scope Range/Subnet Mask | Network/Broadcast | Interface |
--- | --- | --- | --- | ---
Total Leases: 0

#### Edit Scope

Name
Starting Address
Ending Address
Subnet Mask
Lease Time
Days Hours Minutes
The duration for which the clients should be leased the IP address.
Offer Delay Time
milliseconds
The time duration that the DHCP server delays sending an DHCPOFFER message.
Ping Check
Enable Ping Check
Enable this option to allow DHCP server to find out if an IP address is already in use to prevent IP address conflict when some of the devices on the network have manually configured IP addresses.
Ping Check Timeout
milliseconds (default 1000)
The timeout interval to wait for an ping reply.
Ping Check Retries
(default 2)
The maximum number of ping requests to try.
Warning! Ping check would work as expected only when you make sure that all the client devices with manually configured IP addresses on the network respond to a ping request. Devices running Microsoft Windows by default drop ping requests at host firewall and will cause this ping check to fail to detect in use IP addresses. It is recommended to not rely on this option and instead make sure that you exclude a range of addresses using Exclusions and manually assign IP addresses to your devices only in the excluded range.
Domain Name
The domain name for this network to allow assigning a fully qualified domain name to clients. Use a domain name that you own or that is not in common use like 'home' or 'lan' so that you don't block out an existing domain name. (Option 15)
Domain Search List
The list of domain names that the clients can use as a suffix when searching a domain name. (Option 119)
DNS Updates
Enable DNS Updates
Enable this option to allow the DHCP server to automatically update forward and reverse DNS entries for clients.
DNS TTL
seconds (default 900)
The TTL value of the DNS records updated for the above provided domain name.
Router Address
The default gateway IP address to be used by the clients. (Option 3)
DNS Servers
Use This DNS Server
Enable this option to automatically use this DNS Server.
The DNS server IP addresses to be used by the clients. (Option 6)
WINS Servers
The NBNS/WINS server IP addresses to be used by the clients. (Option 44)
NTP Servers
The Network Time Protocol (NTP) server IP addresses to be used by the clients. (Option 42)
NTP Server Domain Names
Enter NTP server domain names (e.g. pool.ntp.org) above that the DHCP server should automatically resolve and pass the resolved IP addresses to clients as NTP server option. (Option 42)
Static Routes

Destination | Subnet Mask | Router |
--- | --- | --- | ---

The static routes to be used by the clients for accessing specified destination networks. (Option 121)
Bootstrap Server Address
The IP address of next server (TFTP) to use in bootstrap by the clients. If not specified, the DHCP server's IP address is used. (siaddr)
Bootstrap Server Host Name
The optional bootstrap server host name to be used by the clients to identify the TFTP server. (sname/Option 66)
Boot File Name
The boot file name stored on the bootstrap TFTP server to be used by the clients. (file/Option 67)
Vendor Specific Information

Vendor Class Identifier | Vendor Specific Information |
--- | --- | ---

The Vendor Specific Information (option 43) to be sent to the clients that match the Vendor Class Identifier (option 60) in the request. The Cendor Class Identifier can be empty string to match any identifier, or matched exactly, or match a substring, for example `substring(vendor-class-identifier,0,9)=="PXEClient"`. The Vendor Specific Information must be either a colon (:) separated hex string or a normal hex string, for example `06:01:03:0A:04:00:50:58:45:09:14:00:00:11:52:61:73:70:62:65:72:72:79:20:50:69:20:42:6F:6F:74:FF` OR `0601030A0400505845091400001152617370626572727920506920426F6F74FF`.
CAPWAP Access Controller Addresses
The Control And Provisioning of Wireless Access Points (CAPWAP) Access Controller IP addresses to be used by Wireless Termination Points to discover the Access Controllers to which it is to connect. (Option 138)
TFTP Server Addresses
The TFTP Server Address or the VoIP Configuration Server Address. (Option 150)
Generic DHCP Options

Code | Hex Value |
--- | --- | ---

This feature allows you to define DHCP options that are not yet directly supported. To add an option, use the DHCP option code defined for it and enter the value in either a colon (:) separated hex string or a normal hex string format, for example `C0:A8:01:01` OR `C0A80101`.
Exclusions

Starting Address | Ending Address |
--- | --- | ---

The IP address range that must be excluded or not assigned dynamically to any client by the DHCP server.
Note! Make sure to exclude address ranges if you plan to manually assign IP addresses to some of the devices or to assign reserved leases so that these IP addresses are not dynamically allocated in the first place.
Advanced Options
Allow Only Reserved Lease Allocations
Enable this option to stop dynamic IP address allocation and allocate only reserved IP addresses.
Block Locally Administered MAC Addresses
Enable this option to stop dynamic IP address allocation for clients with locally administered MAC addresses. MAC address with 0x02 bit set in the first octet indicate a locally administered MAC address which usually means that the device is not using its original MAC address.
Reserved Leases

Host Name | MAC Address | IP Address | Comments |
--- | --- | --- | --- | ---

The reserved IP addresses to be assigned to specific clients based on their MAC address. Set a hostname to override the client's hostname.

Username | Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | --- | ---

Username | Display Name | Status | Previous Login | Recent Login |
--- | --- | --- | --- | --- | ---

Name | Description |
--- | --- | ---

Section | User Permissions | Group Permissions |
--- | --- | --- | ---

20171012

App Name
Class Path
Page Number
Logs Per Page
Order
From
To
Client IP Address
Protocol
Response Type
RCODE
Domain
Type
Class
Found: 0 logs

# | Timestamp | Client IP Address | Protocol | Response Type | RCODE | Domain | Type | Class | Answer
--- | --- | --- | --- | --- | --- | --- | --- | --- | ---
Found: 0 logs

# Technitium DNS Server

Version

Copyright (C) 2022 Shreyas Zare (shreyas@technitium.com)
This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions.

Source code available under GNU General Public License v3.0 on GitHub

### What's New?

Read the change log to know whats new in this release.

### API Documentation

The DNS server HTTP API allows any 3rd party app or script to configure the DNS server. The HTTP API is used by this web console and thus all the actions that this web console does can be performed via the API. Read the HTTP API documentation for complete details.

### Help Topics

Read the latest online help topics which contains the DNS Server user manual and covers frequently asked questions.

### Support

For support, send an email to support@technitium.com.

Follow @technitium@mastodon.social on Mastodon.
Checkout Technitium Blog.

Join /r/technitium on Reddit.

### Donate

Make a contribution to Technitium by becoming a Patron and help making new software, updates, and features possible.

Become A Patron Now!

#### My Profile

Display Name
Username
Session Timeout
seconds (valid range 0-604800; default 1800; set 0 to disable)
Member Of

Group

Active Sessions

Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | ---

#### Create API Token

Username
Password
Token Name
WARNING! The token allows access to API calls with the same privileges as that of the user account. Thus its recommended to create a separate user account with limited permissions as required by the specific task that the token will be used for. The token cannot be used to change the user's password, or update the user profile details.
Username
Token Name
Token
WARNING! The token value above will not be displayed later. You must copy the token value immediately and save it for later use.

#### Change Password

Username
New Password
Confirm Password

#### Forgot Password?

To reset your password, you need to contact the DNS server administrator.

If you are an administrator, follow these steps to reset the 'admin' user's password:

1. Stop the DNS server.
2. Find the DNS Server config folder and locate the auth.config file. The config folder will be found where the DNS Server is installed.
3. Rename the auth.config file as resetadmin.config
4. Start the DNS Server to complete the password reset process.
5. Just refresh this web page in the web browser to auto login with default credentials and quickly change the password.

Note: To reset 'admin' password, you will need file system access on the server running this DNS Server. If the 'admin' user does not exists then it will be created automatically.

#### New Update Available

Download Now! Update Instructions
Update Version:
Current Version:
Read Change Logs
Note! It is highly recommended to Backup Settings before installing the update.

#### Add Zone

Zone
Type
Primary Zone (default)
Secondary Zone
Stub Zone
Conditional Forwarder Zone
Primary Name Server Addresses (Optional)
Zone Transfer Protocol
XFR-over-TCP (default)
XFR-over-TLS
TSIG Key Name (Optional)
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
Forwarder
Use "This Server"
When using "This Server", if a record does not exists in the zone then the request is forwarded to the DNS server's resolver internally. This allows you to override any record for the forwarded domain name or control its DNSSEC validation.
DNSSEC
Enable DNSSEC Validation
Network Proxy
No Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Proxy Server Username
Proxy Server Password

#### Add Edit Record

Name
.example.com
Type
TTL
Value
Add reverse (PTR) record
Create reverse zone for PTR record
Name Server
Glue Addresses
Primary Name Server
Responsible Person
Serial
Refresh
Retry
Expire
Minimum
Primary Name Server Addresses
Zone Transfer Protocol
XFR-over-TCP (default)
XFR-over-TLS
TSIG Key Name
Preference
Exchange
Priority
Weight
Port
Target
Key Tag
DNSSEC Algorithm
Digest Type
Digest
Algorithm
Fingerprint Type
Fingerprint
Certificate Usage
Selector
Matching Type
Certificate Association Data
Note: Enter either a hash value that you have independently generated, OR enter the certificate in PEM format to automatically generate the association data based on the Selector and Matching Type values.
Flags
Tag
Authority
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
Forwarder
Use "This Server"
When using "This Server", if a record does not exists in the zone then the request is forwarded to the DNS server's resolver internally. This allows you to override any record for the forwarded domain name or control its DNSSEC validation.
DNSSEC
Enable DNSSEC Validation
Network Proxy
No Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Proxy Server Username
Proxy Server Password
App Name
Class Path
Record Data (if any)
Overwrite existing records
Comments

#### Zone Options -

Zone Transfer
Deny
Denies everyone from performing a zone transfer.
Allow
Allows everyone to perform a zone transfer.
Allow Only Name Servers In Zone (default)
Allows only the name servers with an NS record in the zone to perform a zone transfer.
Allow Only Specified Name Servers
Allows only the specified name servers to perform a zone transfer.
Allow Both Zone Name Servers And Specified Name Servers
Allows both the zone's name servers and the specified name servers to perform a zone transfer.
Specified Name Servers
Note: Enter only the IP addresses of the name servers above.
Note! Zone transfer should be allowed only for trusted name servers to sync their secondary zone.
Zone Transfer TSIG Key Names
Quick Add
Note! TSIG key names must be configured from the Settings before using them here. Entering one or more TSIG key names above will cause the DNS server to authenticate all zone transfer requests. A secondary zone must be configured with one of the above keys to be able to perform a zone transfer.
Notify
None
Does not notify any name server when the zone is updated.
Name Servers In Zone (default)
Notifies only the name servers with an NS record in the zone when the zone is updated.
Specified Name Servers
Notifies only the specified name servers when the zone is updated.
Both Zone Name Servers And Specified Name Servers
Notifies both the zone's name servers and the specified name servers when the zone is updated.
Specified Name Servers
Note: Enter only the IP addresses of the name servers above.
Note! Notification must be enabled to allow other name servers to trigger a zone transfer immediately when the zone is updated.
Dynamic Updates
Deny (default)
Denies everyone from performing dynamic updates.
Allow
Allows everyone to perform dynamic updates.
Allow Only Name Servers In Zone
Allows only the name servers with an NS record in the zone to perform dynamic updates. Those name servers may have to be configured separately for accepting dynamic update requests for the zone.
Allow Only Specified IP Addresses
Allows only the specified IP addresses to perform dynamic updates.
Allow Both Zone Name Servers And Specified IP addresses
Allows both the zone's name servers and the specified IP addresses to perform dynamic updates.
Specified IP Addresses
Note! Dynamic updates should be allowed only to trusted IP addresses since they will be able to add/delete records in the zone. Setting up a security policy below is highly recommended.

Security Policy

TSIG Key Name | Domain Name | Allowed Record Types |
--- | --- | --- | ---

Note! Configuring a security policy above will cause the DNS server to authenticate all dynamic update requests. A TSIG key can add/delete records only for the specified domain name and allowed record types. TSIG key names must be configured from the Settings before using them here. Use wildcard domain name to specify all sub domain names. Use a comma separator to specify more than one record type. Use ANY to specify all record types.

#### Sign Zone -

DNSKEY Algorithm
RSA
ECDSA (recommended)
Hash Algorithm
Key Signing Key (KSK) Size
Zone Signing Key (ZSK) Size
ECDSA Curve
Proof of Non-Existence
Next Secure (NSEC) (recommended)
With NSEC, all the records in your zone can be discovered by anyone using "zone walking" technique. NSEC is recommended if your zone does not contain any private/internal records.
Next Secure 3 (NSEC3)
NSEC3, makes it difficult to perform "zone walking" since it uses hashing with a random salt. NSEC3 should be used if your zone contains any private/internal records that you do not wish to be enumerable.
NSEC3 Iterations
(valid range 0-50, recommended 0)
The number of iterations used by NSEC3 for hashing the domain names. It is recommended to use 0 iterations since more iterations will increase computational costs for both the DNS server and resolver while not providing much value against "zone walking" [RFC 9276].
NSEC3 Salt Length
(valid range 0-32, recommended 0)
The number of bytes of random salt to generate to be used with the NSEC3 hash computation. It is recommended to not use salt by setting the length to 0 [RFC 9276].
DNSKEY TTL
(default 3600)
The TTL value to be used for DNSKEY records. A lower value will allow quicker addition or rollover to a new DNS Key at the cost of increased frequency of DNSKEY queries by resolvers.
ZSK Automatic Rollover
days (valid range 0-365; default 90; set 0 to disable)
The frequency at which the DNS server must automatically rollover all Zone Signing Key (ZSK) keys.

#### Unsign Zone -

WARNING! Unsigning the zone without removing all DS records from its parent zone will cause DNSSEC validating recursive resolvers to mark the zone as bogus and fail to resolve it.

WARNING! Make sure that you have removed all of the DS records from the parent zone and sufficient time has passed before unsigning this zone. You MUST wait for at least the number of seconds specified by the DS record's TTL value to elapse before unsigning the zone to ensure that all recursive resolvers would have expired the DS records from its cache. For example, if you have DS records at the parent zone with TTL value set to 86400 then you must wait for 86400 seconds (24 hours) to pass after you delete the DS records from the parent zone. Once you have ensured that you have waited for the appropriate time then you can unsign the zone safely.

NOTE! You can find out the TTL value of DS records for your zone by querying for DS records using the DNS Client tab.

WARNING! Unsigning the zone will permanently delete all of the private keys associated with it. Consider taking a backup before proceeding.

Are you sure you want to proceed to unsign the zone now?

#### DNSSEC Properties -

Key Tag | Key Type | Algorithm | State | State Changed | Rollover |
--- | --- | --- | --- | --- | --- | ---

Key Type
Algorithm
Hash Algorithm
Key Size
ECDSA Curve
Automatic Key Rollover
days (valid range 0-365; default 90; set 0 to disable)
The frequency at which the DNS server must automatically rollover the key.
Proof of Non-Existence
Next Secure (NSEC) (recommended)
With NSEC, all the records in your zone can be discovered by anyone using "zone walking" technique. NSEC is recommended if your zone does not contain any private/internal records.
Next Secure 3 (NSEC3)
NSEC3, makes it difficult to perform "zone walking" since it uses hashing with a random salt. NSEC3 should be used if your zone contains any private/internal records that you do not wish to be enumerable.
NSEC3 Iterations
(valid range 0-50, recommended 0)
The number of iterations used by NSEC3 for hashing the domain names. It is recommended to use 0 iterations since more iterations will increase computational costs for both the DNS server and resolver while not providing much value against "zone walking" [RFC 9276].
NSEC3 Salt Length
(valid range 0-32, recommended 0)
The number of bytes of random salt to generate to be used with the NSEC3 hash computation. It is recommended to not use salt by setting the length to 0 [RFC 9276].
DNSKEY TTL
(default 3600)
The TTL value to be used for DNSKEY records. A lower value will allow quicker addition or rollover to a new DNS Key at the cost of increased frequency of DNSKEY queries by resolvers.
Warning! You MUST wait for at least the number of seconds specified by the the old TTL value to elapse before making any changes to the DNS keys above to ensure that all recursive resolvers would have expired the DNSKEY records from its cache. For example, if the old TTL value was 3600, then you must wait for 3600 seconds (1 hour) to pass before making any changes to the DNS keys.

#### Import Allowed Zones

Enter domain names one below other to import into Allowed Zone:

Allowed Zones

#### Import Blocked Zones

Enter domain names one below other to import into blocked zone:

Blocked Zones

#### DNS App Store

Store Apps |
--- | ---
Total Apps: 0

#### Install App

App Name
App Zip File

#### Update App

App Name
App Zip File

#### App Config

Edit the `dnsApp.config` config file below as required by the DNS application:

Config File

Note: The app will reload the config automatically after you save it.

#### Backup Settings

The backup process will create a zip file for the items selected below:

Authentication Config File (auth.config)
DNS Settings File (dns.config)
Log Settings File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
DHCP Scope Files (*.scope)
DNS Apps
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)
Block List Cache Files

Note! It may take several minutes to generate the backup zip file if log files are selected to be backed up which will depend on the size of the log files on the disk.

#### Restore Settings

Backup Zip File

The restore process will restore all the selected items from the backup zip file:

Authentication Config File (auth.config)
DNS Settings File (dns.config)
Log Settings File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
DHCP Scope Files (*.scope)
DNS Apps
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)
Block List Cache Files

Restore options:

Delete Existing Files For Selected Items

Warning! The restore process will overwrite existing config files on disk for above selected items and reload new settings including user accounts from the backup. The current logged in user account and current session will be added automatically.

#### Top Stats

Client | Queries
--- | ---

Domain | Hits |
--- | --- | ---

Domain | Hits |
--- | --- | ---

#### Remove Lease?

WARNING! Removing a DHCP lease from the server side will NOT remove the allocated IP address from the client side. Make sure that the client assigned this lease is not connected to the network before proceeding.

WARNING! Removing a DHCP lease may cause IP address conflict if the DHCP server assigns the same IP address to a new client while the old client is still connected to the network.

It is not recommended to remove a DHCP lease when the client is still connected or may connect back later to the network before the lease expires. Use this option only as a last resort.

Follow the recommendations below to avoid such a case that requires removing a DHCP lease:

- Use a shorter lease time such that a dynamically allocated lease expires quickly when the client exits the network.
- Use Exclusions to exclude IP address ranges from being dynamically allocated that you plan to assign manually to some of the devices on the network.
- Use Exclusions to make sure that you have unallocated addresses available in the DHCP scope to be assigned as reserved leases in future.
- Rely less on the assigned IP addresses by configuring a domain name for the DHCP scope and accessing all the devices using their domain names.

Are you sure you want to remove the DHCP lease now?

#### Add User

Display Name
Username
Password
Confirm Password

#### User Details

Display Name
Username
Disable User Account
Session Timeout
seconds (valid range 0-604800; default 1800; set 0 to disable)
Member Of
Add Group

Active Sessions

Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | ---

#### Add Group

Name
Description

#### Group Details

Name
Description
Members
Add User

#### Edit Permissions -

User Permissions

Username | View | Modify | Delete |
--- | --- | --- | --- | ---

Add User
Group Permissions

Group | View | Modify | Delete |
--- | --- | --- | --- | ---

Add Group