Enter IP addresses or network addresses one below another that are allowed to perform zone transfer for all zones without any TSIG authentication.
+
Enter IP addresses or network addresses one below another that are allowed to perform zone transfer for all zones without any TSIG authentication.
@@ -1020,7 +1022,7 @@
-
Enter IP addresses or network addresses one below another that are allowed to Notify all Secondary Zones.
+
Enter IP addresses or network addresses one below another that are allowed to Notify all Secondary Zones.
@@ -1190,11 +1192,11 @@
-
Enter IP addresses or network addresses one below another that are allowed to bypass the QPM limit.
+
Enter IP addresses or network addresses one below another that are allowed to bypass the QPM limit.
-
Note! Queries Per Minute (QPM) feature will limit requests from a client subnet based on its IP address and the specified subnet prefix lengths. The QPM limit configured will be compared with the average count from the sample size which means a client may exceed the QPM limit for a given minute but won't exceed for the given sample size in minutes. Rate limited clients will be listed in orange color on the dashboard top clients table.
+
Note! Queries Per Minute (QPM) feature will limit requests from a client subnet based on its IP address and the specified subnet prefix lengths except for loopback IP addresses. The QPM limit configured will be compared with the average count from the sample size which means a client may exceed the QPM limit for a given minute but won't exceed for the given sample size in minutes. Rate limited clients will be listed in orange color on the dashboard top clients table.
@@ -1331,6 +1333,7 @@
Note! The web service port changes will be automatically applied and so you do not need to manually restart the main service. The TLS certificate too will be automatically reloaded when the certificate file's date modified property on disk changes. This web page will be automatically redirected to the new web console URL after saving settings. The HTTPS protocol will be enabled only when a TLS certificate is configured.
When using a reverse proxy with the Web Service, you need to add X-Real-IP header to the proxy request with the IP address of the client to allow the Web server to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add proxy_set_header X-Real-IP $remote_addr; to make it work.
The web service uses Kestral web server which supports both HTTP/2 and HTTP/3 protocols when TLS certificate is configured. HTTP/3 protocol support is not available on all platforms. On Windows, it is available only on Windows 11 (build 22000 or later) and Windows Server 2022. On Linux, it requires libmsquic to be installed.
+
Note! The web service will always bind to [::] local address for HTTP/3 protocol since this is how the libmsquic library is designed to work.
Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:
Enable this option to accept DNS-over-HTTPS requests.
+
+
+
+
Enable this option to accept DNS-over-HTTP/3 requests.
+
@@ -1525,18 +1536,16 @@
-
Select this option to specify which networks (in CIDR form) must be allowed or denied. Denied networks are always matched first.
+
Select this option to specify networks that must be allowed or denied recursion.
-
-
-
-
-
+
+
+
Enter IP addresses or network addresses one below another to allow access. Add ! character at the start to deny access, e.g. !0.0.0.0/0 will deny all. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all except loopback.
@@ -1590,6 +1599,15 @@
The amount of time the recursive resolver must wait between retries.
+
+
+
+
+ (valid range 1-4; default 2)
+
+
The number of concurrent requests that should be sent by the recursive resolver to the name servers.
+
+
@@ -1795,7 +1813,7 @@
-
Enter IP addresses or network addresses one below another that are allowed to bypass blocking.
+
Enter IP addresses or network addresses one below another that are allowed to bypass blocking.
@@ -2052,7 +2070,7 @@
-
Enter forwarder DNS Server IP addresses or URLs one below another in above text field or use the Quick Select list to select desired forwarder.
+
Enter forwarder DNS Server IP addresses or URLs one below another in above text field or use the Quick Select list to select desired forwarder.
@@ -2090,12 +2108,33 @@
-
Select a protocol that this DNS server must use to query the forwarders specified above.
+
Select a protocol that this DNS server must use to query the forwarders specified above.
-
Forwarders are upstream DNS servers which this DNS Server should use to resolve recursive queries. When more than one forwarders are configured, the DNS server will randomly select one or more forwarders (as per forwarder concurrency) to query and use the fastest response it receives from anyone of them. If none of the randomly selected forwarders respond in time then the ones left are tried before giving up. If no forwarders are configured then the DNS server will use preconfigured ROOT SERVERS to perform recursive resolution.
-
Note! To force DNS-over-HTTPS/3, use h3 URL scheme instead of https.
+
+
+
+
+
+
+
Enable this option to allow querying two or more forwarders concurrently instead of sequentially querying them in their given order. The DNS server will automatically select forwarders (based on their average latency) to query and use the fastest response it receives from any of them. If none of the selected forwarders respond in time, the DNS server will similarly select forwarders from the remaining ones and queries them till all are tried before giving up.
+
+
+
+
+
+
+
+ (valid range 1-10; default 2)
+
+
The number of concurrent requests that must be sent when Concurrent Forwarding is enabled for resolving a domain name.
+
+
+
Note! Forwarders are upstream DNS servers which this DNS Server must use to resolve domain names. If no forwarders are configured then the DNS server will use preconfigured ROOT HINTS to perform recursive resolution to resolve domain names.
+
Note! The https URL scheme will attempt to make DNS-over-HTTPS/3 request and will fallback to DNS-over-HTTPS/2 (and later to DNS-over-HTTPS/1.1) if it fails to connect. To force DNS-over-HTTPS/3, use h3 URL scheme instead of https but note that there wont be any protocol fallback if the connection attempt fails.
The amount of time the forwarder or conditional forwarder resolver must wait between retries.
-
-
-
-
-
- (valid range 1-10; default 2)
-
-
The number of concurrent requests that the forwarder or conditional forwarder resolver must send when resolving a domain name.
-
@@ -3280,7 +3310,7 @@
If you are an administrator, follow these steps to reset the 'admin' user's password:
Stop the DNS server.
-
Find the DNS Server config folder and locate the auth.config file. The config folder will be found where the DNS Server is installed.
+
Find the DNS Server config folder and locate the auth.config file. The config folder will be found where the DNS Server is installed on Windows or /etc/dns/ folder on Linux.
Rename the auth.config file as resetadmin.config
Start the DNS Server to complete the password reset process.
Just refresh this web page in the web browser to auto login with default credentials and quickly change the password.
@@ -3356,22 +3386,49 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Select a Catalog zone to register as its member zone.
@@ -3389,13 +3446,14 @@
-
+
+
Enter the primary name server addresses to sync the zone from. When unspecified, the SOA Primary Name Server will be resolved and used.
When enabled, the secondary zone will be validated using the ZONEMD record after every zone transfer. The zone will get disabled if the validation fails. The zone must be DNSSEC signed for the validation to work.
Note: Enter either a hash value that you have independently generated, OR enter the certificate in PEM format to automatically generate the association data based on the Selector and Matching Type values.
+
Enter either a hash value that you have independently generated, OR enter the certificate in PEM format to automatically generate the association data based on the Selector and Matching Type values.
@@ -4165,6 +4190,17 @@ MII...
+
+
+
+
+ (valid range 0-255; default 0)
+
+
+ Forwarders with high priority (lower value) will be queried before trying for low priority forwarders. Forwarders with the same priority will be concurrently queried.
+
+
+
@@ -4261,6 +4297,7 @@ MII...
+
@@ -4278,6 +4315,15 @@ MII...
+
+
+
+
+ seconds (set 0 to disable)
+
+
Set to automatically delete the record when the value in seconds elapses since the record’s last modified time.