Skip to main content
Settings → General holds the settings that apply to the whole server. Only superadmins can open it.

​
Time zone

Every time shown in DNZ and in notifications uses the server’s time zone, detected automatically (from TZ or the system). Pick another one here. Data is stored in UTC, so you can change it at any time. It also sets when the daily summary is sent.

​
Automatic PTR

With Automatic PTR (reverse DNS) on, reverse lookups (in-addr.arpa, ip6.arpa) are answered from your A and AAAA records, with no reverse zone needed. If www.lab.internal points at 10.0.0.5, a PTR query for 5.0.0.10.in-addr.arpa returns www.lab.internal. Nothing is written to your zones.
  • PTR records you add in a reverse zone always win.
  • When several names share an address, all are returned, shortest first.
  • Wildcard records (*) are skipped, since they don’t name one host.
  • Views are followed: a client in a view gets names from its view’s records.
  • Proxied names are skipped.

​
Device address

The Device address card sets the address devices and DHCP servers use to reach this server’s DNS. The setup guides name it, and so does the Cluster page. Left empty, DNZ works it out from the network interfaces. In a Docker container those are the container’s own (172.x.x.x), so DNZ uses the address you opened the UI at, and warns when it can’t tell. Set it when DNZ runs in a container or behind NAT. Separate several addresses with commas. Each server of a cluster keeps its own address. DNZ_ADVERTISE (or advertise in the config file) beats what is saved here; the card then only shows it.

​
Response rate limiting (RRL)

The Response rate limiting (RRL) card limits identical answers to one client network over UDP, like BIND’s RRL, against DNS amplification attacks. It is off by default. The card shows the counters since the server started: dropped, truncated and would be limited. Changes take effect right away.
The per-client query limit (DNZ_RATE_LIMIT) is a config setting instead. See Rate limiting for how both work and how to choose rates.

​
GeoIP database

GeoDNS answers by the client’s country or continent, with a country database in MaxMind’s .mmdb format. DNZ doesn’t ship one: the GeoIP database card downloads it.
  • Download (Update now once a database is loaded) fetches it now. By default it comes from DB-IP’s IP to Country Lite: IP Geolocation by DB-IP, free under CC BY 4.0.
  • Update monthly downloads the new file each month.
  • Download from: any other country .mmdb or .mmdb.gz URL works instead, such as a MaxMind GeoLite2 Country permalink with your license key. {year} and {month} in the URL are filled in.
  • Look up shows where an address is, as GeoDNS sees it.
The file is kept next to the database (geoip-country.mmdb). Without it, GeoDNS records answer every client with their defaults; weights and health checks work either way.

​
DNS64, DNS cookies and NSID

DNS64 answers AAAA queries for IPv6-only clients behind a NAT64 gateway with addresses made from A records. DNS cookies (on by default) let clients prove their address so the UDP rate limit leaves them alone. NSID tells clients that ask which server answered. Each has its card here; see Resolver options.

​
Zone history

How long zone history is kept: versions older than Days (default 365), and beyond the newest Versions per zone (default 1000), are dropped every hour. 0 means no limit. Decided change requests follow the days limit.

​
Prometheus metrics

The Prometheus metrics card turns on /metrics for Prometheus: on a listen address of its own, on the HTTP API with a token, or both. It makes the token and shows a scrape config to paste into Prometheus. See Prometheus and Grafana.

​
Encrypted DNS

Shows whether DNS over TLS, HTTPS, QUIC and HTTP/3 are on, the hostname and the certificate’s names and expiry, and any error from reloading the certificate. DoT, DoH, DoQ and DoH3 are turned on with a certificate in the configuration. See Encrypted DNS.

​
Factory reset

Erases everything on the server: zones and records, users and divisions, API tokens and update keys, proxies, replication, filtering, notifications, settings and logs. The server goes back to first-run setup.
This can’t be undone. Back up the database first.
You’re asked to type RESET to confirm. The config file and the environment stay; with DNZ_ADMIN_PASSWORD set, that admin is created again.
Your saved CLI session for that server is forgotten.

​
Other settings pages

Server settings that can’t change while DNZ runs (addresses, database, TLS files) are in the configuration.