Technitium DNS Server

### DNS Server

Username
Password
Enter OTP
Enter the 6-digit code you see in your authenticator app.
Forgot Password?
or login with

### DNS Server

New Update Available!
Last Hour Last Day Last Week Last Month Last Year Custom
Start End
100
100%
Total Queries
70
0%
No Error
5
0%
Server Failure
5
0%
NX Domain
10
0%
Refused
10
0%
Authoritative
10
0%
Recursive
10
0%
Cached
10
0%
Blocked
5
0%
Dropped
10
Clients
10
Zones
10
Cache
10
Allowed
10
Blocked
10
Allow List
10
Block List
Top Clients

Client | Queries |
--- | --- | ---

Top Domains

Domain | Hits |
--- | --- | ---

Top Blocked Domains

Domain | Hits |
--- | --- | ---

Page Number
Zones Per Page
0 zones

# | Zone | Type | DNSSEC | Status | Serial | Expiry | Last Modified |
--- | --- | --- | --- | --- | --- | --- | --- | ---
0 zones

- ← Back

### example.com

Primary DNSSEC Enabled catalog
Expiry: 01 Jan 2020 00:00:00
Name
Type
Page Number
Records Per Page
0 records

# | Name | Type | TTL | Data |
--- | --- | --- | --- | --- | ---
0 records

technitium.com

technitium.com

technitium.com

Installed Apps |
--- | ---
Total Apps: 0

Server
Domain
Type
DNS-over-
EDNS Client Subnet
Enable DNSSEC Validation

#### Response

#### Raw Responses ()

DNS Server Domain
The primary fully qualified domain name used by this DNS Server to identify itself.
DNS Server Local End Points
Local End Points are the network interface IP addresses and ports you want the DNS Server to listen for requests.
DNS Server IPv4 Source Addresses
The IPv4 source addresses that the DNS Server must use for making all outbound DNS requests when the server is connected to two or more networks. Network addresses are also accepted.
DNS Server IPv6 Source Addresses
The IPv6 source addresses that the DNS Server must use for making all outbound DNS requests when the server is connected to two or more networks. Network addresses are also accepted. Note that this option will be used only when `Prefer IPv6` option is enabled.

Note! The DNS Server local end point changes will be automatically applied and so you do not need to manually restart the main service.

Note! The source adddresses configured above must be the IP addresses that are configured on the local system's network interface. When using source addresses option, its also necessary to ensure that the system has a default route or a specific route for the source address to be able to reach the destination network. When source addresses are not configured, the IP address of the interface with a default route will be used as the source address.

Default Record TTL
seconds (default 3600/1h)
The default TTL value to use if not specified when adding or updating records in a Zone.
Default NS Record TTL
seconds (default 14400/4h)
The default TTL value to use if not specified when adding or updating NS records in a Primary Zone.
Default SOA Record TTL
seconds (default 900/15m)
The default TTL value to use if not specified when adding or updating SOA records in a Primary Zone.
Default Responsible Person
The default SOA Responsible Person email address to use when adding a Primary Zone.
Zone Defaults
Use SOA Serial Date Scheme
The default SOA Serial option to use if not specified when adding a Primary Zone.
Minimum SOA Refresh
seconds (default 300/5m)
The minimum Refresh interval to be used by Secondary, Stub, Secondary Forwarder, and Secondary Catalog zones. This minimum value will be used if a zone's SOA Refresh value is less than it.
Minimum SOA Retry
seconds (default 300/5m)
The minimum Retry interval to be used by Secondary, Stub, Secondary Forwarder, and Secondary Catalog zones zones. This minimum value will be used if a zone's SOA Retry value is less than it.
Zone Transfer Allowed Networks
Enter IP addresses or network addresses one below another that are allowed to perform zone transfer for all zones without any TSIG authentication.
Notify Allowed Networks
Enter IP addresses or network addresses one below another that are allowed to Notify all Secondary Zones.
DNS Apps
Enable Automatic Update
The DNS Server will check for DNS Apps update every day and will automatically download and install the updates.
IPv6 Support
Disable IPv6
Disables IPv6 support such that the DNS Server uses only IPv4 for all outbound DNS and HTTP(s) requests.
Enable IPv6
Enables IPv6 support such that the DNS Server uses both IPv6 (whenever possible) and IPv4 with equal weightage for all outbound DNS and HTTP(s) requests.
Prefer IPv6
Enables IPv6 support such that the DNS Server prefers using IPv6 (whenever possible) for all outbound DNS and HTTP(s) requests and will use IPv4 only after exhausting all IPv6 attempts.
Warning! Enable IPv6 support only if this DNS Server has native IPv6 Internet access otherwise it will affect performance. There are many name servers on the Internet that do not respond over IPv6 and thus using Prefer IPv6 option when you are running DNS Server in recursive resolver mode (i.e. without any forwarders) may cause frequent operational issues with resolution that may result increase in Server Failure responses.
UDP Socket Pool
Enable UDP Socket Pool
The DNS Server will use UDP socket pool for all outbound DNS-over-UDP requests when enabled.
UDP Socket Pool Excluded Ports
Enter port numbers one below other to be excluded from being used by the UDP socket pool.
Note! Enabling UDP socket pool provides port randomization for all outbound DNS-over-UDP requests to mitigate spoofing attacks. It is recommended to enable UDP socket pool on Windows platform. On Linux, ports are fairly random and thus socket pool may be enabled if more randomization is desired. The DNS Server can detect DNS spoofing attack attempts based on ID mismatch and switch to TCP protocol automatically.
EDNS UDP Payload Size
bytes (valid range 512-4096; default 1232)
The maximum UDP payload size that can be used to avoid IP fragmentation.
DNSSEC
Enable DNSSEC Validation
The DNS Server will validate all responses from name servers or forwarders when this option is enabled.

Warning! Devices that do not have a real-time clock and rely on NTP when booting (e.g. Raspberry Pi), enabling DNSSEC validation will cause failure to resolve the NTP server domain name thus causing the DNS Server to fail to validate all other domain names too due to invalid system date/time. To fix this issue, just create a Conditional Forwarder zone for the NTP server domain name (e.g. ntp.org) with forwarder set to `this-server` and Enable DNSSEC Validation option unchecked. This conditional forwarder zone will disable DNSSEC validation for the NTP server domain name and allow the device to update its system data/time on boot.

Warning! When forwarders are configured, DNSSEC validation will work only if the forwarders are security aware i.e. can respond to DNSSEC requests correctly.

Note! Enabling DNSSEC may increase delays in resolving domain names when the cache is initially empty. As the cache fills up, the performance will be normal as expected.

EDNS Client Subnet (ECS)
Enable EDNS Client Subnet
The DNS Server will use the public IP address of the request with a prefix length, or the existing Client Subnet option from the request.
ECS IPv4 Prefix Length
(valid range 0-32; default 24)
The IPv4 prefix length to define the client subnet.
ECS IPv6 Prefix Length
(valid range 0-64; default 56)
The IPv6 prefix length to define the client subnet.
ECS IPv4 Override
The IPv4 network address that must be used as ECS for all outbound requests overriding client's actual subnet.
ECS IPv6 Override
The IPv6 network address that must be used as ECS for all outbound requests overriding client's actual subnet.

Warning! EDNS Client Subnet (ECS) option when enabled will compromises user's privacy since the DNS Server will send the user's public IP network subnet to name servers or forwarders when resolving requests. When not using encrypted DNS protocols, this information can also be read passively by anyone on the network.

Note! EDNS Client Subnet (ECS) option allows passing the user's client subnet information to name servers or forwarders so that the response may contain IP addresses of servers closer to the user's geographic region. EDNS Client Subnet (ECS) option thus is only useful when the DNS Server is hosted in a geographically different region compared to the users that are configured to use it.

Note! Enabling EDNS Client Subnet (ECS) option will significantly increase the DNS Server's memory usage since the server will have to cache data for each client subnet separately. It will also increase cache misses since DNS Server will have to resolve requests and cache them for each client subnet separately.

Queries Per Minute (QPM) Limits (IPv4)

IPv4 Prefix | UDP Limit | TCP Limit |
--- | --- | --- | ---

The maximum queries an IPv4 client subnet can make to DNS-over-UDP and DNS-over-TCP protocol services per minute on average based on the sample size. Set limit value to `0` to allow unlimited queries for a specific protocol in an entry or delete the entry altogether to remove rate limiting for the prefix.
Queries Per Minute (QPM) Limits (IPv6)

IPv6 Prefix | UDP Limit | TCP Limit |
--- | --- | --- | ---

The maximum queries an IPv6 client subnet can make to DNS-over-UDP and DNS-over-TCP protocol services per minute on average based on the sample size. Set limit value to `0` to allow unlimited queries for a specific protocol in an entry or delete the entry altogether to remove rate limiting for the prefix.
QPM Sample Size
minutes (valid range 1-60; default 5)
The sample size in minutes to sample latest data from Last Hour stats for limiting queries per client.
QPM Limit UDP Truncation
% (valid range 0-100; default 50)
The percentage of requests that are responded with a truncation (TC) response when QPM limit exceeds for DNS-over-UDP protocol service while the rest of the requests are dropped. A TC response will cause a real client to retry to DNS-over-TCP protocol service.
QPM Limit Bypass List
Enter IP addresses or network addresses one below another that are allowed to bypass the QPM limit.

Note! Queries Per Minute (QPM) feature will limit requests from a client subnet based on its IP address and the specified subnet prefix lengths except for loopback IP addresses. The QPM limit configured will be compared with the average count from the sample size which means a client may exceed the QPM limit for a given minute but won't exceed for the given sample size in minutes. Rate limited clients will be listed in orange color on the dashboard top clients table.

Note! The configured TCP limits apply to the DNS-over-TCP protocol service as well as to the DNS-over-TLS, DNS-over-HTTPS and DNS-over-QUIC optional protocol services.

Client Timeout
milliseconds (valid range 1000-10000; default 2000)
The amount of time the DNS Server must wait before responding with a `ServerFailure` response to a client request when no answer is available.
TCP Send Timeout
milliseconds (valid range 1000-90000; default 10000)
The maximum amount of time the DNS Server will wait for the response to be sent. This option will apply for DNS requests being received by the DNS Server over TCP, TLS, TcpProxy, or HTTPS transports.
TCP Receive Timeout
milliseconds (valid range 1000-90000; default 10000)
The maximum amount of time the DNS Server will wait for receiving data. This option will apply for DNS requests being received by the DNS Server over TCP, TLS, TcpProxy, or HTTPS transports.
QUIC Idle Timeout
milliseconds (valid range 1000-90000; default 60000)
The time interval after which an idle QUIC connection will be closed. This option applies only to QUIC transport protocol.
QUIC Max Inbound Streams
(valid range 1-1000; default 100)
The max number of inbound bidirectional streams that can be accepted per QUIC connection. This option applies only to QUIC transport protocol.
Listen Backlog
(default 100)
The maximum number of pending inbound connections. This option applies to TCP, TLS, TcpProxy, and QUIC transport protocols.
UDP Send Buffer Size
KB (valid range 8-65536; default 2048)
The UDP listener socket send buffer size. This option applies to UDP and UdpProxy transport protocols.
UDP Receive Buffer Size
KB (valid range 8-65536; default 2048)
The UDP listener socket receive buffer size. This option applies to UDP and UdpProxy transport protocols.
Max Concurrent Resolutions
per CPU core (default 100)
The maximum number of concurrent async outbound resolutions that should be done per CPU core.
Web Service Local Addresses
Local addresses are the network interface IP addresses you want the Web Service to listen for requests. ANY addresses (0.0.0.0 & [::]) cannot be used together with unicast IP addresses. The web server uses dual-mode sockets by default so the IPv6 ANY address ([::]) works for IPv4 too. The default values work for most scenarios so, do not change these defaults unless you have a requirement for the Web Service to listen on specific networks. Configured unicast IP addresses will be included as Subject Alternative Name (SAN) in the self signed TLS certificate.
Web Service HTTP Port
(default 5380)
Specify the TCP port number for this web console over HTTP protocol.
HTTPS Options
Enable HTTPS
Enable HTTP/3
Enable HTTP to HTTPS Redirection
Use A Self Signed TLS Certificate When TLS Certificate File Path Is Unspecified
Web Service HTTPS Port
(default 53443)
Specify the TCP port number for this web console over TLS protocol.
Reverse Proxy Addresses
Configure the ACL above to define allowed reverse proxy servers such that client IP address from requests coming from these servers is read using the Real IP Header configured below. Enter IP addresses or network addresses one below another to allow. Add `!` character at the start to deny, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Real IP Header
The HTTP header that must be used to read client's actual IP address when the request comes from a reverse proxy whose IP address is allowed in Reverse Proxy Addresses ACL above.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx or .p12) file path on the server. The path can be relative to the DNS Server's config folder. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.

Note! The Web Service port changes will be automatically applied and so you do not need to manually restart the main service. The TLS certificate too will be automatically reloaded when the certificate file's date modified property on disk changes. This web page will be automatically redirected to the new web console URL after saving settings. The HTTPS protocol will be enabled only when a TLS certificate is configured.

Note! When using a reverse proxy with the Web Service, you need to add `X-Real-IP` header to the proxy request with the IP address of the client to allow the Web Service to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add `proxy_set_header X-Real-IP $remote_addr;` to make it work.

Note! The Web Service uses Kestrel web server which supports both HTTP/2 and HTTP/3 protocols when TLS certificate is configured. HTTP/3 protocol support is not available on all platforms. On Windows, it is available only on Windows 11 (build 22000 and later) and Windows Server 2022 (and later). On Linux, it requires `libmsquic` to be installed. It also requires IPv6 support on the system to work.

Note! The Web Service will always bind to `[::]` local address for HTTP/3 protocol since this is how the `libmsquic` library is designed to work.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "privkey.pem" -in "cert.pem" -certfile "chain.pem"

Help: Configuring DNS-over-QUIC and HTTPS/3 For Technitium DNS Server
Optional DNS Server Protocols
Enable EDNS Client Subnet (ECS) Source Address
Enable this option to read the client's source IP address from the EDNS Client Subnet (ECS) option in the DNS requests coming via DNS-over-UDP or DNS-over-TCP protocols. This option allows a DNS proxy to pass the client's source IP address via ECS option to the DNS Server. It is mandatory to configure Reverse Proxy Network ACL below to allow requests coming from your DNS proxy server to work with this option.
Enable DNS-over-UDP-PROXY
Enable this option to accept DNS-over-UDP-PROXY requests. It implements the PROXY Protocol for both version 1 & 2 over UDP datagram. It is mandatory to configure Reverse Proxy Network ACL below to allow requests coming from your reverse proxy server.
Enable DNS-over-TCP-PROXY
Enable this option to accept DNS-over-TCP-PROXY requests. It implements the PROXY Protocol for both version 1 & 2 over TCP connection. It is mandatory to configure Reverse Proxy Network ACL below to allow requests coming from your reverse proxy server.
Enable DNS-over-HTTP
Enable this option to accept DNS-over-HTTP requests. It must be used with a TLS terminating reverse proxy like nginx. It is mandatory to configure Reverse Proxy Network ACL below to allow requests coming from your reverse proxy server. Enabling this option also allows automatic TLS certificate renewal with HTTP challenge (webroot) for DNS-over-HTTPS service when DNS-over-HTTP port is set to 80.
Enable DNS-over-TLS
Enable this option to accept DNS-over-TLS requests.
Enable DNS-over-HTTPS
Enable this option to accept DNS-over-HTTPS requests.
Enable DNS-over-HTTP/3
Enable this option to accept DNS-over-HTTP/3 requests.
Enable DNS-over-QUIC
Enable this option to accept DNS-over-QUIC requests.
DNS-over-UDP-PROXY Port
(default 538)
Specify the UDP port number for DNS-over-UDP-PROXY protocol.
DNS-over-TCP-PROXY Port
(default 538)
Specify the TCP port number for DNS-over-TCP-PROXY protocol.
DNS-over-HTTP Port
(default 80)
Specify the TCP port number for DNS-over-HTTP protocol.
DNS-over-TLS Port
(default 853)
Specify the TCP port number for DNS-over-TLS protocol.
DNS-over-HTTPS Port
(default 443)
Specify the TCP port number for DNS-over-HTTPS protocol.
DNS-over-QUIC Port
(default 853)
Specify the UDP port number for DNS-over-QUIC protocol.
Reverse Proxy Network ACL
Configure the ACL above to allow requests coming from your reverse proxy server for DNS-over-UDP-PROXY, DNS-over-TCP-PROXY, and DNS-over-HTTP protocols. Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Real IP Header
The HTTP header that must be used to read client's actual IP address when the request comes from a reverse proxy. The specified header will be read only when the request IP address is allowed by the Reverse Proxy Network ACL.
TLS Certificate File Path
Specify a PKCS #12 certificate (.pfx or .p12) file path on the server. The path can be relative to the DNS Server's config folder. The certificate must contain private key.
TLS Certificate Password
Enter the certificate (.pfx) password, if any.

Note! These optional DNS Server protocol changes will be automatically applied and so you do not need to manually restart the main service. The TLS certificate too will be automatically reloaded when the certificate file's date modified property on disk changes. The DNS-over-TLS, DNS-over-QUIC, and DNS-over-HTTPS protocols will be enabled only when a TLS certificate is configured.

These optional DNS Server protocols are used to host these as a service. You do not need to enable these optional protocols to use them with Forwarders or Conditional Forwarder Zones.

For DNS-over-HTTP, use `http://localhost:8053/dns-query` with a TLS terminating reverse proxy like nginx. For DNS-over-TLS, use `tls-certificate-domain:853`, for DNS-over-QUIC, use `tls-certificate-domain:853`, and for DNS-over-HTTPS use `https://tls-certificate-domain/dns-query` to configure supported DNS clients.

When using a reverse proxy with the DNS-over-HTTP service, you need to add `X-Real-IP` header to the proxy request with the IP address of the client to allow the DNS Server to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add `proxy_set_header X-Real-IP $remote_addr;` to make it work.

DNS-over-QUIC protocol support is not available on all platforms. On Windows, it is available only on Windows 11 (build 22000 and later) and Windows Server 2022 (and later). On Linux, it requires `libmsquic` to be installed. It also requires IPv6 support on the system to work.

Note! The DNS-over-HTTP/3 protocol will always bind to `[::]` local address since this is how the `libmsquic` library is designed to work.

Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:

    openssl pkcs12 -export -out "example.com.pfx" -inkey "privkey.pem" -in "cert.pem" -certfile "chain.pem"

Help: How To Host Your Own DNS-over-HTTPS, DNS-over-TLS, And DNS-over-QUIC Services
Help: Configuring DNS-over-QUIC and HTTPS/3 For Technitium DNS Server
TSIG Keys

Key Name | Shared Secret | Algorithm |
--- | --- | --- | ---

The shared secret can be a base64 string or a literal string. Keep the shared secret empty if you want to auto generate a strong key.
Note! You will need to configure these TSIG keys names for zone transfer in the zone options and in the secondary zone SOA record options separately.
Recursion
Deny Recursion
Disables recursion so that this DNS Server works as authoritative only.
Allow Recursion
Enables recursion to allow this DNS Server to resolve any domain name.
Allow Recursion Only For Private Networks (default)
Select this option if you want to support recursion only on private networks. Any recursive request from a public network will be refused.
Use Specified Network Access Control List (ACL)
Select this option to specify networks that must be allowed or denied recursion.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all except loopback.
Note! Disable recursion if you wish this server to act only as authoritative name server for the configured zones.
Note! You need to have the above recursion option enabled even when you have configured Forwarders in Settings and do not want the DNS Server to do recursive resolution. This option is not about recursive resolution itself but about the Recursion Desired (RD) flag in the incoming DNS requests.
Recursive Resolver
Randomize Name
Enables QNAME case randomization when using UDP as the transport protocol to improve security.
QNAME Minimization
Enables QNAME minimization for recursive resolution to improve privacy.
Warning! Enabling the Randomize Name option may cause some domain names to fail to resolve due to their name servers dropping the requests or sending the QNAME in response with a different case causing mismatch. The DNS Server can already detect DNS spoofing attack attempts and switch to TCP protocol automatically so its safe to not use this feature.
Resolver Retries
(valid range 1-10; default 2)
The total number of retries the recursive resolver must do per name server.
Resolver Timeout
milliseconds (valid range 1000-10000; default 1500)
The amount of time the recursive resolver must wait between retries.
Resolver Concurrency
(valid range 1-4; default 2)
The number of concurrent requests that should be sent by the recursive resolver to the name servers.
Resolver Max Stack Count
(valid range 10-30; default 16)
The maximum stack count the recursive resolver must use for resolving a domain name.
Note! The DNS Server supports EDNS and thus all outbound recursive resolution requests will have an OPT record for it in the additional section. If a name server does not respond to a request containing OPT record, the recursive resolver will retry again without the OPT record when possible. This means that the number of retries attempted per name server can be Resolver Retries value multiplied by two for certain cases.
Note! The DNS Server uses Epsilon-Greedy machine learning algorithm and will automatically learn which of the name servers are answering faster without errors and will use those name servers most of the time. Since each domain name has a different set of name servers, it may take a while before the algorithm learns about them.
DNS Cache
Save Cache To Disk
Enable this option to save DNS cache on disk when the DNS Server stops. The saved cache will be loaded next time the DNS Server starts.
Note! The DNS Server will attempt to save cache to disk when it stops which may take time depending on the cache size. If the DNS Server takes a lot of time to stop then it may lead to the OS killing the DNS Server process causing an incomplete cache to be stored on disk.
Serve Stale
Enable Serve Stale
Enable the Serve Stale feature to improve resiliency by using expired or stale records in cache to respond when the DNS Server is unable to reach the upstream or authoritative name servers to refresh the expired records before the Max Wait Time configured below.
Serve Stale TTL
seconds (recommended 259200/3d)
The TTL value in seconds which should be used for cached records that are expired. When the serve stale TTL too expires for a stale record, it gets removed from the cache. Recommended value is between 1-3 days and maximum supported value is 7 days.
Serve Stale Answer TTL
seconds (valid range 0-300/5m; recommended 30)
The TTL value in seconds which should be used for the records in a stale response. This is the TTL value that the client will be using to cache the stale records.
Serve Stale Reset TTL
seconds (valid range 10-900/15m; recommended 30)
The TTL value in seconds which should be used to reset the stale record's TTL value in the cache when the resolver fails to refresh the data. The TTL reset causes the stale records to become valid again so that they can be used to serve requests normally. This reset effectively prevents the resolver from attempting to frequently update the stale records.
Serve Stale Max Wait Time
milliseconds (valid range 0-1800; default 1800)
The time in milliseconds that the DNS Server must wait for the resolver before serving stale records from the cache. Lower value will ensure faster response at the expense of not getting updated data from the upstream. Setting value to 0 will instantly return stale answer without waiting for the resolver to fetch updates from the upstream.
Cache Maximum Entries
(default 10000; set 0 for unlimited entries)
The maximum number of entries that the cache can store. A relevant value should be configured by monitoring the Cache entries value on Dashboard and the server's memory usage to limit the amount of RAM used by the DNS Server. A cache entry is a complete Resource Record Set (RR Set) which is a group of records with the same type for a given domain name. When a value is configured, the DNS Server will trigger a clean up operation every few minutes and remove least recently used entries to maintain the maximum allowed entries in cache.
Cache Minimum TTL
seconds (recommended 10)
The minimum TTL value that a record can have in the cache. Set a value to make sure that the records with TTL value less than that stays in cache for a minimum duration.
Cache Maximum TTL
seconds (default 604800/1w)
The maximum TTL value that a record can have in the cache. Set a lower value to allow the records to expire early.
Cache Negative TTL
seconds (recommended 300/5m)
The negative TTL value to use when there is no SOA MINIMUM value available. Negative caching stores records in cache for `NXDOMAIN` and `NODATA` responses.
Cache Failure TTL
seconds (recommended 10)
The failure TTL value to be used for caching failure responses. This allows storing failure record in cache and prevent frequent recursive resolution requests to the name servers that are responding with `ServerFailure` or failing to respond.
Prefetch Eligibility
seconds (recommended 2)
The minimum initial TTL value of a record needed to be eligible for prefetching.
Prefetch Trigger
seconds (recommended 9; set 0 to disable prefetching & auto prefetching)
A record with TTL value less than trigger value will initiate prefetch operation immediately for itself.
Auto Prefetch Sampling
minutes (valid range 1-60; default 5)
The interval to sample eligible domain names from last hour stats for auto prefetch.
Auto Prefetch Eligibility
hits/hour (default 30)
Minimum required hits per hour for a domain name to be eligible for auto prefetch.
The DNS Server cache auto prefetch option can keep eligible domain names from last hour stats "hot" in cache. Auto prefetch eligibility value can be decided by keeping an eye on the hits shown for last hour on the dashboard. Experiment with auto prefetch sampling interval and eligibility to get best results.
Blocking
Enable Blocking
Sets the DNS Server to block domain names using Blocked Zone and Block List Zone.
Allow TXT Blocking Report
Specifies if the DNS Server should respond with TXT records containing a blocked domain report for TXT type requests. This option also enables Extended DNS Error blocked domain report in response for requests that support EDNS.
Blocking Temporarily Disabled Till
minutes
Blocking Bypass List
Enter IP addresses or network addresses one below another that are allowed to bypass blocking.
Blocking Type
ANY Address
Uses `0.0.0.0` and `::` IP addresses for blocked domain names.
NX Domain (recommended)
Uses `NX Domain` response for blocked domain names.
Custom Address
Uses custom IP addresses provided below for blocked domain names.
Custom Blocking Addresses (IP Address)
Blocking Answer TTL
seconds (default 30)
The TTL value in seconds that must be used for the records in a blocking response. This is the TTL value that the client will use to cache the blocking response.
Allow / Block List URLs
Quick Add

Enter block list URL one below another in the above text field or use the Quick Add list to add known block list URLs.

For directly using block list files saved on this server, use the `file://` formatted URL path. For example, on Linux the URL should look like `file:///home/folder/myblocklist.txt` and on Windows it should look like `file:///c:/folder/myblocklist.txt`.

Add `!` character at the start of an URL to make it an allow list URL. This option must not be used with allow lists that use `Adblock Plus` format.

Begin a line with `#` character at the start to use it for comments.

Block List Update Interval
hours (valid range 0-168; default 24; set 0 to disable)
The interval in hours to automatically download and update the block lists.
Block List Next Update On
Click the 'Update Now' button to reset the next update schedule and force download and update of the block lists.
Note! The DNS Server will use the data returned by the block list URLs to update the block list zone automatically. The expected file format is standard `hosts` file format, plain text file containing list of domains to block, wildcard block list file format, or `Adblock Plus` file format.
Warning! The DNS Server loads all block lists in memory and thus it is expected that the server is provisioned with sufficient amount of memory to avoid out of memory issues. On average, 1 million domain names in block list take about 300 MB of memory. The block list update process requires additional memory to load the newly downloaded block lists before it replaces the previously loaded block lists in memory.
Note! To customize the Quick Add drop down list, read the instructions given in the `www/json/readme.txt` file found in the installation folder.
Help: Blocking Internet Ads Using DNS Sinkhole
Network Proxy
No Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Username
Password
Proxy Bypass List
Enter IP addresses, network addresses or domain names to never proxy.
Note! When proxy server is configured, DNS Server will use it for all outbound network requests.
Forwarders
Quick Select
Enter forwarder DNS Server IP addresses or URLs one below another in above text field or use the Quick Select list to select desired forwarder.
Forwarder Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-QUIC
Select a protocol that this DNS Server must use to query the forwarders specified above.
Concurrent Forwarding
Enable Concurrent Forwarding
Enable this option to allow querying two or more forwarders concurrently instead of sequentially querying them in their given order. The DNS Server will automatically select forwarders (based on their average latency) to query and use the fastest response it receives from any of them. If none of the selected forwarders respond in time, the DNS Server will similarly select forwarders from the remaining ones and queries them till all are tried before giving up.
Forwarder Concurrency
(valid range 1-10; default 2)
The number of concurrent requests that must be sent when Concurrent Forwarding is enabled for resolving a domain name.
Note! Forwarders are upstream DNS servers which this DNS Server must use to resolve domain names. If no forwarders are configured then the DNS Server will use preconfigured ROOT HINTS to perform recursive resolution to resolve domain names.
Note! The `https` URL scheme supports only DNS-over-HTTPS/2 and DNS-over-HTTPS/1.1 protocols. For DNS-over-HTTPS/3, use `h3` URL scheme instead of `https` but note that there wont be any protocol fallback if the connection attempt fails.
Note! The DNS Server uses Epsilon-Greedy machine learning algorithm and will automatically learn which of the forwarders are answering faster without errors and will use those forwarders most of the time.
Note! To customize the Quick Select drop down list, read the instructions given in the `www/json/readme.txt` file found in the installation folder.
Help: Configuring DNS Server For Privacy & Security
Help: Configuring DNS-over-QUIC and HTTPS/3 For Technitium DNS Server
Forwarder Retries
(valid range 1-10; default 3)
The total number of retries the forwarder or conditional forwarder resolver must do per upstream DNS Server.
Forwarder Timeout
milliseconds (valid range 1000-10000; default 2000)
The amount of time the forwarder or conditional forwarder resolver must wait between retries.
Enable Logging To
None
Disables all logging including error logs and audit logs.
File
Enables logging errors and audit logs to the log file.
Console
Enables logging errors and audit logs to the console.
Both File And Console
Enables logging errors and audit logs to both the log file and console.
Logging Options
Ignore Resolver Error Logs
Enable this option to stop logging domain name resolution errors into the log file.
Log All Queries
Enable this option to log every query received by this DNS Server and the corresponding response answers into the log file.
Use Local Time
Enable this option to use local time instead of UTC for logging.
Log Folder Path
The folder path on the server where the log files should be saved. The path can be relative to the DNS Server's config folder.
Max Log File Days
days (default 365, set 0 to disable auto delete)
Max number of days to keep the log files. Log files older than the specified number of days will be deleted automatically.
Warning! Enabling query logging will significantly increase the log file size and use up disk space.
Stats
Enable In-Memory Stats
This option will enable in-memory stats and only Last Hour data will be available on Dashboard. No stats data will be stored on disk.
Max Stat File Days
days (default 365, set 0 to disable auto delete)
Max number of days to keep the dashboard stats. Stat files older than the specified number of days will be deleted automatically.

Scope | MAC Address | IP Address |  | Host Name | Lease Obtained | Lease Expires |
--- | --- | --- | --- | --- | --- | --- | ---
Total Leases: 0

Name | Scope Range/Subnet Mask | Network/Broadcast | Interface |
--- | --- | --- | --- | ---
Total Leases: 0

#### Edit Scope

Name
Starting Address
Ending Address
Subnet Mask
Lease Time
Days Hours Minutes
The duration for which the clients should be leased the IP address.
Offer Delay Time
milliseconds
The time duration that the DHCP server delays sending an DHCPOFFER message.
Ping Check
Enable Ping Check
Enable this option to allow DHCP server to find out if an IP address is already in use to prevent IP address conflict when some of the devices on the network have manually configured IP addresses.
Ping Check Timeout
milliseconds (default 1000)
The timeout interval to wait for an ping reply.
Ping Check Retries
(default 2)
The maximum number of ping requests to try.
Warning! Ping check would work as expected only when you make sure that all the client devices with manually configured IP addresses on the network respond to a ping request. Devices running Microsoft Windows by default drop ping requests at host firewall and will cause this ping check to fail to detect in use IP addresses. It is recommended to not rely on this option and instead make sure that you exclude a range of addresses using Exclusions and manually assign IP addresses to your devices only in the excluded range.
Domain Name
The domain name for this network to allow assigning a fully qualified domain name to clients. Use a domain name that you own or that is not in common use like 'home' or 'lan' so that you don't block out an existing domain name. (Option 15)
Domain Search List
The list of domain names that the clients can use as a suffix when searching a domain name. (Option 119)
DNS Updates
Enable DNS Updates
Enable this option to allow the DHCP server to automatically update forward and reverse DNS entries for clients.
Enable DNS Overwrite For Dynamic Lease
Enable this option to allow the DHCP server to overwrite existing DNS A record matching the client domain name for dynamic leases.
DNS TTL
seconds (default 900/15m)
The TTL value of the DNS records updated for the above provided domain name.
Router Address
The default gateway IP address to be used by the clients. (Option 3)
DNS Servers
Use This DNS Server
Enable this option to automatically use this DNS Server.
The DNS Server IP addresses to be used by the clients. (Option 6)
WINS Servers
The NBNS/WINS server IP addresses to be used by the clients. (Option 44)
NTP Servers
The Network Time Protocol (NTP) server IP addresses to be used by the clients. (Option 42)
NTP Server Domain Names
Enter NTP server domain names (e.g. pool.ntp.org) above that the DHCP server should automatically resolve and pass the resolved IP addresses to clients as NTP server option. (Option 42)
Static Routes

Destination | Subnet Mask | Router |
--- | --- | --- | ---

The static routes to be used by the clients for accessing specified destination networks. (Option 121)
Bootstrap Server Address
The IP address of next server (TFTP) to use in bootstrap by the clients. If not specified, the DHCP server's IP address is used. (siaddr)
Bootstrap Server Host Name
The optional bootstrap server host name to be used by the clients to identify the TFTP server. (sname/Option 66)
Boot File Name
The boot file name stored on the bootstrap TFTP server to be used by the clients. (file/Option 67)
Vendor Specific Information

Vendor Class Identifier | Vendor Specific Information |
--- | --- | ---

The Vendor Specific Information (option 43) to be sent to the clients that match the Vendor Class Identifier (option 60) in the request. The Vendor Class Identifier can be empty string to match any identifier, or matched exactly, or match a substring, for example `substring(vendor-class-identifier,0,9)=="PXEClient"`. The Vendor Specific Information must be either a colon (:) separated hex string or a normal hex string, for example `06:01:03:0A:04:00:50:58:45:09:14:00:00:11:52:61:73:70:62:65:72:72:79:20:50:69:20:42:6F:6F:74:FF` OR `0601030A0400505845091400001152617370626572727920506920426F6F74FF`.
CAPWAP Access Controller Addresses
The Control And Provisioning of Wireless Access Points (CAPWAP) Access Controller IP addresses to be used by Wireless Termination Points to discover the Access Controllers to which it is to connect. (Option 138)
TFTP Server Addresses
The TFTP Server Address or the VoIP Configuration Server Address. (Option 150)
Generic DHCP Options

Code | Hex Value |
--- | --- | ---

This feature allows you to define DHCP options that are not yet directly supported. To add an option, use the DHCP option code defined for it and enter the value in either a colon (:) separated hex string or a normal hex string format, for example `C0:A8:01:01` OR `C0A80101`.
Exclusions

Starting Address | Ending Address |
--- | --- | ---

The IP address range that must be excluded or not assigned dynamically to any client by the DHCP server.
Note! Make sure to exclude address ranges if you plan to manually assign IP addresses to some of the devices or to assign reserved leases so that these IP addresses are not dynamically allocated in the first place.
Advanced Options
Allow Only Reserved Lease Allocations
Enable this option to stop dynamic IP address allocation and allocate only reserved IP addresses.
Block Locally Administered MAC Addresses
Enable this option to stop dynamic IP address allocation for clients with locally administered MAC addresses. MAC address with 0x02 bit set in the first octet indicate a locally administered MAC address which usually means that the device is not using its original MAC address.
Ignore Client Identifier (Option 61)
This option when enabled will always use the client's MAC address as the identifier to allocate lease instead of the Client Identifier (Option 61) provided by the client in the request. Some Linux distros use a custom Client Identifier instead of the device's MAC Address which can cause issues when the Virtual Machine (VM) in which the OS is installed is cloned causing both the original and cloned clients to get same IP allocated. There can be issues too when the same client changes its Client Identifier and starts getting a different IP address lease. Enabling the Ignore Client Identifier option will fix such issues. Changing this option may cause the existing clients to get a different IP lease on renewal.
Reserved Leases

Host Name | MAC Address | IP Address | Comments |
--- | --- | --- | --- | ---

The reserved IP addresses to be assigned to specific clients based on their MAC address. Set a hostname to override the client's hostname.

Username | Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | --- | ---

Username | Display Name | Type | 2FA Status | Status | Recent Login | Previous Login |
--- | --- | --- | --- | --- | --- | --- | ---

Name | Description |
--- | --- | ---

Section | User Permissions | Group Permissions |
--- | --- | --- | ---

Single Sign-On (SSO)
Enable Single Sign-On (SSO)
Enable to allow Single Sign-On (SSO) with OpenID Connect (OIDC).
Authority (Issuer)
The OpenID Connect (OIDC) Authority URL.
Client ID
The OpenID Connect (OIDC) Client ID.
Client Secret
The OpenID Connect (OIDC) Client Secret.
Metadata Address (Optional)
The OpenID Connect (OIDC) metadata discovery URL to be used instead of the default one. Configure this option only if the Single Sign-On (SSO) provider uses a different discovery URL.
Scopes

Scope Name |
--- | ---

Enter the scopes to be sent to the Single Sign-On (SSO) provider. The scopes `openid` and `profile` are mandatory and will be automatically added if missing. Add the scope `email` if you want to use email address as the username for all SSO users that sign up for an account.
SSO User Sign Up
Allow New User Sign Up
Enable to allow automatically provisioning of user accounts for new users signing in via Single Sign-On (SSO). Keep this option disabled if you do not expect new SSO users to sign up.
Allow Sign Up Only For Mapped Users
Enable to allow a new user to sign up via Single Sign-On (SSO) only when the user is a member of at least one Remote Group that is mapped to a Local Group in the Group Map option below. This option allows SSO administrators to restrict SSO users to control who can sign up and get access based on their group memberships.
Group Map (Optional)

Remote Group | Local Group |
--- | --- | ---

Map Remote Groups at Single Sign-On (SSO) provider to Local Groups for both new and existing users signed up via Single Sign-On (SSO). A SSO user's group membership will be automatically synced to the mapped Local Groups each time they log in. If your SSO provider does not include group membership claim by default then you will have to add `group` or `roles` scope in the Scopes option above as required by the SSO provider.

Note! The Single Sign-On (SSO) uses `/sso/callback` as the callback path. Thus, your SSO Redirect URI for this DNS Server should be `http://localhost:5380/sso/callback` which needs to be configure with the SSO provider.

Note! Single Sign-On (SSO) will be enabled only when all of the required parameters are configured correctly. If SSO does not work for any reason, check the Logs section on the panel and search for related error logs.

Note! When a Single Sign-On (SSO) user signs up with the DNS Server, an account for the user is created which uses the email address as the username. If email address is not available, the preferred username is used instead. If you do not wish to use email address as the username, you can remove the `email` scope from the Scopes option above.

Note! The Single Sign-On (SSO) user's Display Name and Username are managed via the SSO provider and they are automatically synced each time a user logs in.

Note! When Group Map is configured, the Single Sign-On (SSO) user's group membership cannot be managed locally and any group membership changes must be configured at the SSO provider itself. SSO users need to relogin so that any group membership changes made at SSO provider are applied to their user accounts. The Group Map thus allows managing user access centrally via the SSO provider. Keep the Group Map empty if group membership management for SSO users is required to be managed via the DNS Server itself.

Note! The Web Service will be automatically restarted to apply these changes thus there is no need to restart the DNS Server manually.

Note! When using a reverse proxy with the Web Service, you need to add `X-Forwarded-Proto` and `X-Forwarded-Host` headers to proxy request to allow the Web Service to correctly form the SSO Redirect URI. If the reverse proxy is setup to use a path prefix then make sure to add the `X-Forwarded-Prefix` header to proxy request too. These headers will be read only if the reverse proxy IP address is configured to be allowed in the Reverse Proxy Addresses option in Settings > Web Service section. For example, if you are using nginx as the reverse proxy with a path prefix of `/dns`, then you should add the following headers: `proxy_set_header X-Forwarded-Proto $scheme;`, `proxy_set_header X-Forwarded-Host $host;`, `proxy_set_header X-Forwarded-Prefix /dns;`, and `proxy_redirect / /dns/;`

Warning! All URLs configured above must use `https` URL scheme for production environments. Using `http` URL scheme is not secure and should be used only for testing purposes.

Warning! Any DNS related failure may cause Single Sign-On (SSO) to fail to work making it impossible for SSO users to log in to fix the DNS issue due to circular dependency. Thus, it is recommended to maintain a local administrator user account for such scenarios.

Node Name | IP Address | URL | Type | State | Up Since | Last Seen | Last Synced |
--- | --- | --- | --- | --- | --- | --- | --- | ---

20171012

App Name
Class Path
Page Number
Logs Per Page
Order
From
To
Client IP Address
Protocol
Response Type
RCODE
Domain
Type
Class
Live Update
Found: 0 logs

# | Timestamp | Client IP Address | Protocol | Response Type | RCODE | Domain | Type | Class | Answer |
--- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---
Found: 0 logs

# Technitium DNS Server

Version

Server up since

Copyright (C) 2026 Shreyas Zare (shreyas@technitium.com)
This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions.

Source code available under GNU General Public License v3.0 on GitHub

### What's New?

Read the change log to know what's new in this release.

### API Documentation

The DNS Server HTTP API allows any 3rd party app or script to configure the DNS Server. The HTTP API is used by this web console and thus all the actions that this web console does can be performed via the API. Read the HTTP API documentation for complete details.

### Help Topics

Read the latest online help topics which contains the DNS Server user manual and covers frequently asked questions.

### Support

For support, send an email to support@technitium.com.

Follow @technitium@mastodon.social on Mastodon.
Checkout Technitium Blog.

Join /r/technitium on Reddit.

### Donate

Make a contribution to Technitium and help making new software, updates, and features possible.

Donate Now!

#### My Profile

Display Name
Username
Type
2FA Status
Session Timeout
seconds (valid range 0-604800; default 1800; set 0 to disable)
Member Of

Group

Active Sessions

Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | ---

#### Create API Token

Username
Token Name
Warning! The token allows access to API calls with the same privileges as that of the user account. Thus its recommended to create a separate user account with limited permissions as required by the specific task that the token will be used for. The token cannot be used to change the user's password, or update the user profile details.
Username
Token Name
Token
Warning! The token value above will not be displayed later. You must copy the token value immediately and save it for later use.

#### Change Password

Username
Current Password
New Password
Confirm Password
Enter OTP
Enter the 6-digit code you see in your authenticator app.

#### Configure Two-factor Authentication (2FA)

When you enable Two-factor Authentication (2FA) using Time-based One-time Password (TOTP), you will be required to enter a one-time password (OTP) in addition to your password when you login. You will need to use an authenticator app like Microsoft Authenticator or Google Authenticator to generate the OTP when you login.

Username
2FA Status
Secret Key
Scan the QR Code or manually enter the secret key (spaces don't matter) given above in your authenticator app.
Enter OTP
Enter the 6-digit code you see in your authenticator app.

#### Change Theme

Theme
Use System Theme (default)
Light Theme
Dark Theme
Amber Theme

#### Forgot Password?

To reset your password, you need to contact the DNS Server administrator.

If you are an administrator, follow these steps to reset the 'admin' user's password:

1. Stop the DNS Server.
2. Find the DNS Server config folder and locate the auth.config file. The config folder will be found where the DNS Server is installed on Windows or /etc/dns/ folder on Linux.
3. Rename the auth.config file as resetadmin.config
4. Start the DNS Server.
5. Just refresh this web page in the web browser to auto login with default credentials and quickly change the password.

On Linux, stop the DNS Server by running 'sudo systemctl stop dns' command and 'sudo systemctl start dns' command to start it.

On Windows, press Win+R to open Run, enter 'services.msc', and press enter to open Services console. Find service named 'Technitium DNS Server' and use the Action menu to start/stop it.

Note: To reset 'admin' password, you will need file system access on the server running this DNS Server. If the 'admin' user does not exists then it will be created automatically. If the 'admin' user has Two-factor Authentication (2FA) configured then it will be disabled too.

#### New Update Available

Download Now! Update Instructions
Update Version:
Current Version:
Read Change Logs
Note! It is highly recommended to Backup Settings before installing the update.
Note! You will have to refresh this web page manually after updating the DNS Server so that new UI changes are loaded.

#### Add Zone

Zone
Type
Primary Zone (default)
Secondary Zone
Stub Zone
Conditional Forwarder Zone
Secondary Conditional Forwarder Zone
Catalog Zone
Secondary Catalog Zone
Secondary ROOT Zone (RFC 8806)
Catalog Zone
Select a Catalog zone to register as its member zone.
Conditional Forwarder
Initialize Forwarder (FWD) Record
Import Zone File (Optional)
Zone Serial
Use SOA Serial Date Scheme
Primary Name Server Addresses (Optional)
Enter the primary name server addresses to sync the zone from. When unspecified, the SOA Primary Name Server will be resolved and used.
Zone Transfer Protocol
XFR-over-TCP (default)
XFR-over-TLS
XFR-over-QUIC
TSIG Key Name (Optional)
Zone Validation
Use ZONEMD to Validate Zone
When enabled, the secondary zone will be validated using the ZONEMD record after every zone transfer. The zone will get disabled if the validation fails. The zone must be DNSSEC signed for the validation to work.
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-QUIC
Forwarder
Use "This Server"
When using "This Server", if a record does not exists in the zone then the request is forwarded to the DNS Server's resolver internally. This allows you to override any record for the forwarded domain name or control its DNSSEC validation.
Enter a forwarder server address above. You can add more forwarders by adding FWD records after the zone is added.
DNSSEC
Enable DNSSEC Validation
Network Proxy
No Proxy
Default Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Proxy Server Username
Proxy Server Password

#### Add Edit Record

Name
.example.com
Type
TTL
seconds (default 3600/1h)
RR Type
Value
Add reverse (PTR) record
Create reverse zone for PTR record
Name Server
Glue Addresses
Primary Name Server
Responsible Person
Serial
Use Serial Date Scheme
Refresh
seconds
Retry
seconds
Expire
seconds
Minimum
seconds
Preference
Exchange
Text Data
Use New Line To Split Text Into Multiple Character-Strings
Mailbox
TXT Domain
Priority
Weight
Port
Target
Order
Preference
Flags
Services
Regular Expression
Replacement
Key Tag
DNSSEC Algorithm
Digest Type
Digest
Algorithm
Fingerprint Type
Fingerprint
Certificate Usage
Selector
Matching Type
Certificate Association Data
Enter either a hash value that you have independently generated, OR enter the certificate in PEM format to automatically generate the association data based on the Selector and Matching Type values.
Priority
(set 0 for alias mode)
Target Name
Params

Key | Value |
--- | --- | ---

Automatic Hints
Use Automatic IPv4 Hint
Use Automatic IPv6 Hint
Priority
Weight
URI
Flags
Tag
Authority
Protocol
DNS-over-UDP (default)
DNS-over-TCP
DNS-over-TLS
DNS-over-HTTPS
DNS-over-QUIC
Forwarder
Use "This Server"
When using "This Server", if a record does not exists in the zone then the request is forwarded to the DNS Server's resolver internally. This allows you to override any record for the forwarded domain name or control its DNSSEC validation.
Priority
(valid range 0-255; default 0)
Forwarders are sorted by priority value i.e. forwarder with low priority value will be queried before trying for forwarder with high priority value. Forwarders with the same priority value will be queried concurrently.
DNSSEC
Enable DNSSEC Validation
Network Proxy
No Proxy
Default Proxy (default)
HTTP Proxy
SOCKS5 Proxy
Proxy Server Address
Proxy Server Port
Proxy Server Username
Proxy Server Password
App Name
Class Path
Record Data (if any)
Overwrite existing records
Comments
Expiry TTL
seconds (set 0 to disable)
Set to automatically delete the record when the value in seconds elapses since the record’s last modified time.

#### Import -

Import Options
Overwrite Existing Records
Enable this option to overwrite existing records for the record types being imported.
Overwrite Zone
Enable this option to delete all existing records from the zone before importing new records.
Overwrite SOA Serial
Enable this option to overwrite existing SOA record serial with the imported SOA record serial.
Import Type
Zone File
Text Editor
Zone File
Text Editor
Enter the records to be imported above in standard zone file format.

Note! The `$ORIGIN` and `$TTL` values will be automatically set if not specified.

Warning! Overwrite SOA serial option when used to set a lower SOA serial value than the current SOA serial will cause secondary zones to fail to sync.

#### Clone Zone -

Source Zone
New Zone

#### Convert Zone -

Convert To
Primary Zone
Conditional Forwarder Zone
Catalog Zone

Note! The conversion process may take a while depending on the number of records the zone has. When converting a Secondary Catalog zone to a Catalog zone, all member zones too will be converted to either Primary or Conditional Forwarder zone depending on their existing zone type. Please be patient till the conversion process completes.

#### Zone Options -

Catalog Zone
Select a Catalog zone to register as its member zone.
Override Options
Override Query Access Option
Enable to override Query Access option in the Catalog zone.
Override Zone Transfer Option
Enable to override Zone Transfer option in the Catalog zone.
Override Notify Option
Enable to override Notify option in the Catalog zone.
Notify Failed Name Servers
Note! When a zone becomes a member of a Catalog zone, all of the Catalog zone's Options are inherited unless they are explicitly overridden using the Override Options.
Primary Name Server Addresses (Optional)
Enter the primary name server addresses to sync the zone from. When unspecified, the SOA Primary Name Server will be resolved and used.
Zone Transfer Protocol
XFR-over-TCP (default)
XFR-over-TLS
XFR-over-QUIC
TSIG Key Name (Optional)
Zone Validation
Use ZONEMD to Validate Zone
When enabled, the secondary zone will be validated using the ZONEMD record after every zone transfer. The zone will get disabled if the validation fails. The zone must be DNSSEC signed for the validation to work.
Query Access
Deny
Denies everyone from querying the zone by refusing the request.
Allow (default)
Allows everyone to query the zone.
Allow Only Private Networks
Allows only private networks to query the zone. Any request from a public network will be refused.
Allow Only Name Servers In Zone
Allows only the name servers with an NS record in the zone to query the zone.
Use Specified Network Access Control List (ACL)
Uses the specified network access control list to allow/deny to query the zone.
Allow Zone Name Servers And Use Specified Network Access Control List (ACL)
Allows zone's name servers and uses specified network access control list to allow/deny to query the zone.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Note! The zone can always be queried from loopback IP addresses and internally by the DNS Server irrespective of the Query Access configuration.
Zone Transfer
Deny
Denies everyone from performing a zone transfer.
Allow
Allows everyone to perform a zone transfer.
Allow Only Name Servers In Zone
Allows only the name servers with an NS record in the zone to perform a zone transfer.
Use Specified Network Access Control List (ACL)
Uses the specified network access control list to allow/deny to perform a zone transfer.
Allow Zone Name Servers And Use Specified Network Access Control List (ACL)
Allows zone's name servers and uses specified network access control list to allow/deny to perform a zone transfer.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Note! Zone transfer should be allowed only for trusted name servers to sync their secondary zone.
Zone Transfer TSIG Key Names
Quick Add
Note! TSIG key names must be configured from the Settings before using them here. Entering one or more TSIG key names above will cause the DNS Server to authenticate all zone transfer requests. A secondary zone must be configured with one of the above keys to be able to perform a zone transfer.
Notify
None
Does not notify any name server when the zone is updated.
Name Servers In Zone
Notifies only the name servers with an NS record in the zone when the zone is updated.
Specified Name Servers
Notifies only the specified name servers when the zone is updated.
Both Zone Name Servers And Specified Name Servers
Notifies both the zone's name servers and the specified name servers when the zone is updated.
Separate Name Servers For Catalog And Member Zones
Notifies specified name servers for member zone updates and secondary catalog name servers for catalog zone updates.
Specified Name Servers
Enter only the IP addresses of the name servers above.
Secondary Catalog Name Servers
Enter only the IP addresses of the Secondary Catalog name servers above.
Notify Failed Name Servers
Note! Notification must be enabled to allow other name servers to trigger a zone transfer immediately when the zone is updated.
Dynamic Updates
Deny (default)
Denies everyone from performing dynamic updates.
Allow
Allows everyone to perform dynamic updates.
Allow Only Name Servers In Zone
Allows only the name servers with an NS record in the zone to perform dynamic updates.
Use Specified Network Access Control List (ACL)
Uses the specified network access control list to allow/deny to perform dynamic updates.
Allow Zone Name Servers And Use Specified Network Access Control List (ACL)
Allows zone's name servers and uses specified network access control list to allow/deny to perform dynamic updates.
Network Access Control List (ACL)
Enter IP addresses or network addresses one below another to allow access. Add `!` character at the start to deny access, e.g. `!192.168.10.0/24` will deny entire subnet. The ACL is processed in the same order its listed. If no networks match, the default policy is to deny all.
Note! Dynamic updates should be allowed only to trusted IP addresses since they will be able to add/delete records in the zone.
Warning! If no security policy is configured in the Primary Zone then access will be provided only based on the options selected here. Thus setting up a security policy in the Primary Zone is highly recommended.

Security Policy

TSIG Key Name | Domain Name | Allowed Record Types |
--- | --- | --- | ---

Note! Configuring a security policy above will cause the DNS Server to authenticate all dynamic update requests. A TSIG key can add/delete records only for the specified domain name and allowed record types. TSIG key names must be configured from the Settings before using them here. Use wildcard domain name to specify all sub domain names. Use a comma separator to specify more than one record type. Use ANY to specify all record types.

#### Sign Zone -

DNSKEY Algorithm
RSA
ECDSA (recommended)
EdDSA
Hash Algorithm
ECDSA Curve
EdDSA Curve
Key Signing Key (KSK)
Automatic Private Key Generation (default)
Use Specified Private Key
KSK Size
bits (recommended 2048)
KSK Private Key
Enter a private key in PEM format.
Zone Signing Key (ZSK)
Automatic Private Key Generation (default)
Use Specified Private Key
ZSK Size
bits (default 1280)
ZSK Private Key
Enter a private key in PEM format.
Proof of Non-Existence
Next Secure (NSEC) (recommended)
With NSEC, all the records in your zone can be discovered by anyone using "zone walking" technique. NSEC is recommended if your zone does not contain any private/internal records.
Next Secure 3 (NSEC3)
NSEC3, makes it difficult to perform "zone walking" since it uses hashing with a random salt. NSEC3 should be used if your zone contains any private/internal records that you do not wish to be enumerable.
NSEC3 Iterations
(valid range 0-50, recommended 0)
The number of iterations used by NSEC3 for hashing the domain names. It is recommended to use 0 iterations since more iterations will increase computational costs for both the DNS Server and resolver while not providing much value against "zone walking" [RFC 9276].
NSEC3 Salt Length
bytes (valid range 0-32, recommended 0)
The number of bytes of random salt to generate to be used with the NSEC3 hash computation. It is recommended to not use salt by setting the length to 0 [RFC 9276].
DNSKEY TTL
seconds (default 3600/1h)
The TTL value to be used for DNSKEY records. A lower value will allow quicker addition or rollover to a new DNS Key at the cost of increased frequency of DNSKEY queries by resolvers.
ZSK Automatic Rollover
days (valid range 0-365; default 30; set 0 to disable)
The frequency at which the DNS Server must automatically rollover the Zone Signing Key (ZSK).

#### Unsign Zone -

Warning! Unsigning the zone without removing all DS records from its parent zone will cause DNSSEC validating recursive resolvers to mark the zone as bogus and fail to resolve it.

Warning! Make sure that you have removed all of the DS records from the parent zone and sufficient time has passed before unsigning this zone. You MUST wait for at least the number of seconds specified by the DS record's TTL value to elapse before unsigning the zone to ensure that all recursive resolvers would have expired the DS records from its cache. For example, if you have DS records at the parent zone with TTL value set to 86400 then you must wait for 86400 seconds (24 hours) to pass after you delete the DS records from the parent zone. Once you have ensured that you have waited for the appropriate time then you can unsign the zone safely.

Note! You can find out the TTL value of DS records for your zone by querying for DS records using the DNS Client tab.

Warning! Unsigning the zone will permanently delete all of the private keys associated with it. Consider taking a backup before proceeding.

Are you sure you want to proceed to unsign the zone now?

#### View DS Info -

Use the DNS Key data given below to add DS records for your zone. Before adding the DS records, you must read and understand the following points:

- The Key State for a newly published DNS Key must be `Ready` before you can add a DS record for it. Adding DS record for a DNS Key with `Published` Key State may cause DNSSEC validation to fail for some DNS resolvers. A "ready by" timestamp is displayed to let you know when a DS record can be added for a DNS Key that is not "Ready" yet.
- You should add only one DS record for each Key Tag. That is, do not create multiple DS records for each Digest Type, instead use the Digest Type that is supported by your Domain Registrar.
- Use the provided Public Key if the Domain Registrar requires it instead of the Digest.
- When doing a Key Signing Key (KSK) rollover, you can immediately delete the old DS record after adding the new DS record.

Key Tag | Key State | Algorithm | Digest Type | Digest
--- | --- | --- | --- | ---

#### DNSSEC Properties -

Key Tag | Key Type | Algorithm | State | State Changed | Rollover (days) |
--- | --- | --- | --- | --- | --- | ---

Key Type
Algorithm
Hash Algorithm
ECDSA Curve
EdDSA Curve
Key Generation
Automatic Private Key Generation (default)
Use Specified Private Key
Key Size
bits
Private Key
Enter a private key in PEM format.
Automatic Key Rollover
days (valid range 0-365; default 30; set 0 to disable)
The frequency at which the DNS Server must automatically rollover the key.
Note! The Key State for a newly published Key Signing Key (KSK) must be `Ready` before you can add a DS record for it. Use the View DS Info option for more details on adding DS record.
Note! The Key State for a Key Signing Key (KSK) will automatically switch from `Ready` to `Active` once you have added DS record for it and the DNS Server is able to detect it. Use the View DS Info option for more details on adding DS record. If this is a private zone, then you should manually activate the KSK so that the DNS Server stops the detection process which queries for DS records periodically.
Note! The keys with `Retired` or `Revoked` Key State will be automatically unpublished and removed when its safe to do so.
Proof of Non-Existence
Next Secure (NSEC) (recommended)
With NSEC, all the records in your zone can be discovered by anyone using "zone walking" technique. NSEC is recommended if your zone does not contain any private/internal records.
Next Secure 3 (NSEC3)
NSEC3, makes it difficult to perform "zone walking" since it uses hashing with a random salt. NSEC3 should be used if your zone contains any private/internal records that you do not wish to be enumerable.
NSEC3 Iterations
(valid range 0-50, recommended 0)
The number of iterations used by NSEC3 for hashing the domain names. It is recommended to use 0 iterations since more iterations will increase computational costs for both the DNS Server and resolver while not providing much value against "zone walking" [RFC 9276].
NSEC3 Salt Length
bytes (valid range 0-32, recommended 0)
The number of bytes of random salt to generate to be used with the NSEC3 hash computation. It is recommended to not use salt by setting the length to 0 [RFC 9276].
DNSKEY TTL
seconds (default 3600/1h)
The TTL value to be used for DNSKEY records. A lower value will allow quicker addition or rollover to a new DNS Key at the cost of increased frequency of DNSKEY queries by resolvers.
Warning! You MUST wait for at least the number of seconds specified by the the old TTL value to elapse before making any changes to the DNS keys above to ensure that all recursive resolvers would have expired the DNSKEY records from its cache. For example, if the old TTL value was 3600, then you must wait for 3600 seconds (1 hour) to pass before making any changes to the DNS keys.

#### Import Allowed Zones

Enter domain names one below other to import into Allowed Zone:

Allowed Zones

#### Import Blocked Zones

Enter domain names one below other to import into blocked zone:

Blocked Zones

#### DNS App Store

Store Apps |
--- | ---
Total Apps: 0

#### Install App

App Name
App Zip File

#### Update App

App Name
App Zip File

#### App Config -

Edit the `dnsApp.config` config file below as required by the DNS application.

Config File

Note: The app will reload the config automatically after you save it.

#### Backup Settings

The backup process will create a zip file for the items selected below:

Authentication Config File (auth.config)
Cluster Config File (cluster.config)
Web Service Config And Certificate File (webservice.config, *.pfx & *.p12)
DNS Config And Certificate File (dns.config, *.pfx & *.p12)
Log Config File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
Block List Config And Cache Files (blocklist.config)
DNS Apps
DHCP Scope Files (*.scope)
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)

Note! The Web Service or Optional Protocols TLS certificate (.pfx or .p12) files will be included in the backup only if they exist within the DNS Server's config folder.

Note! It may take several minutes to generate the backup zip file if log files are selected to be backed up which will depend on the size of the log files on the disk.

#### Restore Settings

Backup Zip File

The restore process will restore all the selected items from the backup zip file:

Authentication Config File (auth.config)
Cluster Config File (cluster.config)
Web Service Config And Certificate File (webservice.config, *.pfx & *.p12)
DNS Config And Certificate File (dns.config, *.pfx & *.p12)
Log Config File (log.config)
DNS Zone Files (*.zone)
Allowed Zones File (allowed.config)
Blocked Zones File (blocked.config)
Block List Config And Cache Files (blocklist.config)
DNS Apps
DHCP Scope Files (*.scope)
Dashboard Stats Files (*.stat, *.dstat)
Log Files (*.log)

Restore options:

Delete Existing Files For Selected Items

Warning! The restore process will overwrite existing config files on disk for above selected items and reload new settings including user accounts from the backup. The current logged in user account and current session will be added automatically.

#### Top Stats

Client | Queries |
--- | --- | ---

Domain | Hits |
--- | --- | ---

Domain | Hits |
--- | --- | ---

#### Remove Lease?

Warning! Removing a DHCP lease from the server side will NOT remove the allocated IP address from the client side. Make sure that the client assigned this lease is not connected to the network before proceeding.

Warning! Removing a DHCP lease may cause IP address conflict if the DHCP server assigns the same IP address to a new client while the old client is still connected to the network.

It is not recommended to remove a DHCP lease when the client is still connected or may connect back later to the network before the lease expires. Use this option only as a last resort.

Follow the recommendations below to avoid such a case that requires removing a DHCP lease:

- Use a shorter lease time such that a dynamically allocated lease expires quickly when the client exits the network.
- Use Exclusions to exclude IP address ranges from being dynamically allocated that you plan to assign manually to some of the devices on the network.
- Use Exclusions to make sure that you have unallocated addresses available in the DHCP scope to be assigned as reserved leases in future.
- Rely less on the assigned IP addresses by configuring a domain name for the DHCP scope and accessing all the devices using their domain names.

Are you sure you want to remove the DHCP lease now?

#### Add User

Display Name
Username
Password
Confirm Password

#### User Details

Display Name
Username
Type
2FA Status
Disable User Account
Session Timeout
seconds (valid range 0-604800; default 1800; set 0 to disable)
Member Of
Add Group

Active Sessions

Session | Last Seen | Remote Address | User Agent |
--- | --- | --- | --- | ---

#### Add Group

Name
Description

#### Group Details

Name
Description
Members
Add User

#### Edit Permissions -

User Permissions

Username | View | Modify | Delete |
--- | --- | --- | --- | ---

Add User
Group Permissions

Group | View | Modify | Delete |
--- | --- | --- | --- | ---

Add Group

#### Initialize New Cluster

The initialization of a new Cluster will make the current DNS Server its Primary node. You can add other DNS Servers to this Cluster later which will get added as Secondary nodes. No data will be lost on this DNS Server in this process.

Cluster Domain
The fully qualified domain name to be used to identify the new Cluster.
Primary Node IP Addresses
Quick Add
The static IP addresses of this DNS Server that will be accessible by all other DNS Servers to be added later as Secondary nodes.
Enter IP addresses one below another in the above text field or use the Quick Add list to add available IP addresses on the server.

Note! When the Cluster is initialized, the DNS Server Domain Name will be changed such that the current hostname is a subdomain name of the Cluster Domain name specified above. For example, if the current DNS Server Domain Name is `ns1.mydomain.tld` or just `ns1` then the new domain name will be `ns1.mycluster.tld`.

Note! If the Web Service does not have HTTPS enabled, then the initialization process will enable it automatically with a self-signed certificate. However, it is recommended to manually configure HTTPS with a valid certificate before initializing the Cluster. This certificate must include the new expected DNS Server Domain Name, as mentioned in the above note, as the Subject Common Name or Subject Alternative Name (SAN) so that it validates when a Secondary node tries to join the Cluster. Once a node joins the Cluster, it uses DANE-EE for server authentication and the domain name in the certificate is no longer required to match the DNS Server Domain Name.

Note! The initialization process will create two zones if they do not exist. The first zone will be the Cluster Primary zone named as the Cluster Domain name specified above where the Cluster will automatically manage domain name records for all the nodes. The second zone will be the Cluster Catalog zone that uses `cluster-catalog` as the subdomain name of the Cluster Domain name. Use this Cluster Catalog zone for automatic provisioning of Secondary zones on all of the Cluster Secondary nodes.

Warning! The Cluster Domain name cannot be changed later. Make sure that you enter the correct domain name before proceeding. You can update the DNS Server Domain Name later if needed from Settings but it must always be a subdomain name of the Cluster Domain name.

#### Join Cluster

Joining a Cluster will make this DNS Server its Secondary node. This process will overwrite configuration on this DNS Server for Allowed, Blocked, Apps, Settings and Administration sections. The DNS Server will automatically synchronize its configuration with the Primary node in the Cluster.

Secondary Node IP Addresses
Quick Add
The static IP addresses of this DNS Server that will be accessible by all other DNS Server nodes in the Cluster.
Enter IP addresses one below another in the above text field or use the Quick Add list to add available IP addresses on the server.
Primary Node URL
The Web Service HTTPS URL of the Primary node in the Cluster.
Primary Node IP Address (Optional)
The IP address of the Primary node in the Cluster. When unspecified, domain name in the Primary node URL will be resolved and used.
Certificate Validation
Validate Certificate With PKI and DANE (Recommended)
The Primary node Web Service TLS certificate will be validated using PKI and DANE to ensure that your connection is secure.
Ignore Certificate Validation Errors
Use this options only when you know that the Primary node Web Service is using a self-signed TLS certificate and is reachable on a private network.
Primary Node Username
The username of an administrator on the Primary node in the Cluster.
Primary Node Password
The password of the administrator user specified above.
Primary Node OTP
Enter the 6-digit code you see in your authenticator app for the administrator user specified above.

Note! The process to join the Cluster may take a while to complete depending on the amount of initial config data that needs to be synchronized from the Primary node. Please be patient till the process completes.

Note! If the Web Service does not have HTTPS enabled, then the joining process will enable it automatically with a self-signed certificate. However, its recommended to manually configure HTTPS with a valid certificate before joining the cluster. This certificate should optionally include the new expected DNS Server Domain Name, which will be a subdomain name of the Cluster Domain name, as the Subject Common Name or Subject Alternative Name (SAN).

Note! The Ignore Certificate Validation Errors option when selected is used only for the initial connection to the Primary node during the joining process. Once the DNS Server joins the Cluster, it will always use DANE-EE for authentication using the TLSA records in the Cluster Primary zone that are added for each node in the Cluster.

Warning! Joining a Cluster will cause configuration on this DNS Server to be overwritten permanently for Allowed, Blocked, Apps, Settings and Administration sections!

#### Cluster Options

Cluster Domain
The fully qualified domain name of the Cluster.
Heartbeat Refresh Interval
seconds (valid range 10-300; default 30)
The interval in seconds in which the DNS Server must refresh the state of all nodes in the Cluster.
Heartbeat Retry Interval
seconds (valid range 10-300; default 10)
The interval in seconds in which the DNS Server must retry the state refresh process for all nodes in case of a failure.
Config Refresh Interval
seconds (valid range 30-3600; default 900)
The interval in seconds in which the DNS Server must refresh the configuration from the Primary node.
Config Retry Interval
seconds (valid range 30-3600; default 60)
The interval in seconds in which the DNS Server must retry the configuration refresh process for the Primary node in case of a failure.

#### Edit Node - node1.example.com

Node IP Addresses
Quick Add
The static IP addresses of this DNS Server that will be accessible by all other DNS Server nodes in the Cluster.
Enter IP addresses one below another in the above text field or use the Quick Add list to add available IP addresses on the server.
Primary Node URL
The Web Service HTTPS URL of the Primary node in the Cluster.
Primary Node IP Addresses (Optional)
The IP addresses of the Primary node in the Cluster. When unspecified, domain name in the Primary node URL will be resolved and used.

#### Remove Node - node1.example.com

The Remove Node process will ask the selected Secondary node to leave the Cluster gracefully. The Secondary will then initiate Leave Cluster process as if the Leave Cluster action was performed on that node itself.

Force Remove Node
Enabling this option will cause the Secondary node to be deleted from the Cluster without asking the node to leave gracefully.

Are you sure you want to remove the Secondary node from the Cluster?

Note! Use the Force Remove Node option only when the Secondary node is unreachable/decommissioned and cannot leave the Cluster gracefully.

#### Promote To Primary Node -

The promote To Primary node process will resync complete configuration from the Primary node and then proceed to delete it from the Cluster followed by upgrading the selected Secondary node to become the Primary node in the Cluster. The former Primary node when deleted will cause it to delete all its own Cluster configuration leaving the Cluster without causing any other data loss.

Force Delete Current Primary Node
Enabling this option will cause the current Primary node to be deleted from the Cluster without resyncing complete configuration from it and without inform it.

Are you sure you want to promote the selected Secondary node to become the Primary node in the Cluster?

Note! Use the Force Delete Current Primary Node option only when the Primary node is unreachable/decommissioned and thus cannot be deleted from the Cluster gracefully.

Note! The process to promote to Primary node may take a while to complete depending on the size of the complete configuration being resynced and the number of local zones that need to be converted. Please be patient till the process completes.

#### Leave Cluster

The Leave Cluster process will remove all Cluster configuration from this Secondary node and leave the Cluster gracefully. There will be no data loss except for the Cluster configuration. You will need to re-join the Cluster again to use this DNS Server as a Secondary node.

Force Leave Cluster
Enabling this option will cause this Secondary node to leave the Cluster without informing the Primary node.

Are you sure you want to leave the Cluster?

Note! Use the Force Leave Cluster option only when the Primary node is unreachable/decommissioned and thus cannot leave the Cluster gracefully.

#### Delete Cluster

The Delete Cluster process will remove all Cluster configuration from this Primary node. There will be no data loss except for the Cluster configuration. You will need to re-initialize the Cluster again to use clustering features on this DNS Server.

Force Delete Cluster
Enabling this option will cause this Primary node to delete the Cluster for itself even when other Secondary nodes still exist, orphaning them.

Are you sure you want to delete the Cluster?

Note! You can delete the Cluster only when there are no Secondary nodes in the Cluster. Use the Force Delete Cluster option only when you wish this Primary node to be removed from the Cluster even when there are Secondary nodes in the Cluster. In this case, the Secondary nodes will become orphaned and you will need to promote one of them to be the new Primary node manually.