Changelog

The latest release is v1.7.1, released October 24, 2026. To install or upgrade to it:

docker pull terrificci/dnz:1.7.1
docker pull terrificci/dnz-proxy:1.7.1   # a server that only runs dnz-proxy
curl -fsSL https://raw.githubusercontent.com/terrific-ci/dnz/main/install.sh | sh -s -- --version 1.7.1

The latest image tag and the install script without --version always get this release; see Install.

Latest

October 24, 2026

dnz-proxy: one write for an answer’s head and small body; log lines only when kept
Proxy benchmarks: after 1.7.0, one write per answer and fewer allocations

October 24, 2026

Proxy: on/off switch, a kind per proxy, and Caddy as a proxy
Status pages: a host served by a proxy shows a status page instead of its backend
Status pages on Caddy and Traefik, and in the topology map
Status pages: a Vue Flow-style path, Manrope, and a countdown
Status pages without panels
Memory: big inserts not kept prepared, cached answers without spare room
Blocklists and threat feeds as packed domain sets
Proxy benchmark: dnz-proxy against nginx, HAProxy, Envoy, Caddy and Traefik
Threats: few-name pairs kept small, the baseline’s memory fixed
Caddy: upstream URLs split without an else-if chain

October 23, 2026

DNS over UDP: batch buffers split with as_chunks
Overview: a skeleton while the traffic panel loads
Toasts: top right, just under the top bar
Outgoing lookups: fall back past a broken /etc/resolv.conf
DNS over UDP: answer from the address that was asked
Overview: top names and clients from hourly rollups

October 23, 2026

Public files for the docs: monitoring, benchmark harness, Swarm stack
Upstream toasts: one per poll instead of one per incident
Record form: searchable view picker
Launch config: Mintlify docs preview
Query logs: fixed statement sizes, so memory stops climbing
DNS over UDP: a socket per CPU, answered where received
Cache: a full cache no longer sweeps itself on every insert
DNS over UDP: four sockets per CPU
Overview: All queries scope for superadmins
DNS: a 2 KB future per query instead of 22 KB
DNS: a query’s name is normalized once
DNS over UDP: batches with recvmmsg and sendmmsg

October 23, 2026

DNS phase 1: TCP, EDNS, SOA, CNAME chasing and zone cache
DNS phase 2: upstream cache, failover and forward DNS monitoring
Forwarding strategies and first-run setup page
Encrypted upstreams: DNS-over-TLS and DNS-over-HTTPS
Vercel-style sidebar layout and incident notification providers
Vercel-style account menu and centered collapsed sidebar
Cloudflare integration per division
Zone import and export
Find on Cmd+K and pre-filled Cloudflare token link
Server time zone setting and SPA loading screen
Conditional forwarding and audit log
Auto PTR, domain autocomplete for forwarding rules, compact layout
Sign in with Cloudflare and bulk import into local DNS
Deploy-ready build, all-queries log view, readable toasts
Blocklists per division, API tokens with ACME DNS-01, deploy guide
Dynamic DNS over DynDNS2
Split-horizon DNS with views
Serve DNS over TLS and DNS over HTTPS
DNSSEC signing for local zones
Publish the release image to Docker Hub instead of ghcr.io
About DNZ instead of the status line in the account menu
Readable, consistent form text
Harden sign-in, sessions and HTTP headers
Redesign the Filtering page
Filtering: plain placeholder on the list URL field
Replication: zone transfers, NOTIFY, catalog zones and DNZ secondaries
Fix confirm dialogs always answering no
Redesign the Integrations page
Replication: one entry per discovered server, list manual secondary zones
Switch UI icons from Lucide to Iconify Phosphor
Replication page with network discovery
Overview: hourly query chart, top names and stat tiles
Record on/off, default TTL per zone, bulk record edits, comments and tags
Redesign the dashboard: glass top bar, section tabs, Iris theme
TOML config file and CLI-only mode
Redesign polish: record type lens filter, zone state header, solid auth forms
Records toolbar: keep search and Add record on one row on phones
CLI: record on/off, tags, comments, bulk edits and zone default TTL
Top bar health pill opens an upstream popover instead of Forwarding
Dashboard tabs: DNS, Forward DNS and a Server tab with host usage
Dashboard: Request flow tab drawn with vue-flow
Account settings in a dialog instead of a page
Spacing fixes for Find and the top bar; DD-MM-YYYY HH:mm:ss times
Forwarding by client network, with rule labels
Forward rule form: DNS servers and client networks as tag chips
Tag chips for every list field
Record controls UI and bulk add of records
CLI: dnz record add-many
Add record in a dialog, with several names as chips
Edit record in a dialog
Upstream diagnosis streamed over SSE, and dnz forwarding diagnose
Diagnose dialog for upstreams with live step progress
Forward rules in a drag-and-drop order, first match wins
Diagnose action on forwarding rules; document the upstream diagnosis
Dynamic DNS UPDATE (RFC 2136) with per-division TSIG update keys
DNS update keys in the UI and dnz update-key in the CLI
Dashboard: top clients beside top names, and dnz stats
Hourly query rollups and 24h/7d/30d/90d traffic ranges
Traffic alerts and a daily summary
HTTPS/SVCB records, CAA iodef, BADVERS and end-to-end DNS tests
Cloudflare: cache zone and record lists, explain API errors
DNS over QUIC and DoH over HTTP/3, as upstreams and served
Proxied records through Traefik
Proxy: one Traefik config, recognized by address, detected and approved
Proxy: correct the address a Traefik calls DNZ from
Proxy in the menu next to DNS, settings for turning it on and connecting
Proxy: leave empty routers and services out of Traefik’s config
Proxy menu: show up without a page refresh
Proxy: pick the Traefik entry points from a list
Proxy: read Traefik’s API, and a copy-paste guide to set Traefik up
Select: inner padding and item radius like the other menus
Proxy: open the edit and approve dialogs against an older server
Proxy dialog: at most 80% of the screen tall
Menus never wrap their items; short Traefik API errors
Record form: show a proxied visit step by step
Record form: the visitor’s URL follows the proxy’s entry points
Proxy: “uses HTTPS” decides both sides of a proxied name
Proxy: routers, services and middlewares per proxy
Proxy: records from a Traefik’s own routers
Proxy: From Traefik tab and docs for records from Traefik’s routers
Proxy: several upstreams per service, shared by weight
Proxy: records from routers of every Traefik provider
Record form: proxied path as a vertical step list
Proxy: the whole card opens the proxy, with a clear call to action
Proxy: add a route in one step
Proxy: Traefik API hint names the Proxy menu and links to it
Proxy: pull zones for Traefik’s hostnames that no zone holds
Proxy: load-balancing strategy and sticky sessions per service
Proxy: records from Traefik’s routers are proxied through the proxy
Factory reset from the web UI and the CLI
Proxy: a form for every Traefik HTTP middleware
Request flow: a Proxy tab while proxying is on
Proxy: weighted, mirroring and failover services, full load-balancer settings
Proxy: full router rules, TLS options and domains, router observability
Proxy: TLS certificates and options, servers transports, TCP and UDP
Proxy: reachability marks, certificate progress, DNS records from the proxy
dnz-proxy: workspace, node binary skeleton, nodes joining a proxy and the configuration stream
dnz-proxy: the HTTP data plane on Pingora and Traefik’s HTTP middlewares
dnz-proxy: traffic analytics from the nodes’ reports
Proxy: dnz-proxy’s own middleware types, kept from Traefik
Settings → Proxy: pick dnz-proxy, with a copy-paste node setup guide
dnz-proxy: caching, firewall rules and the “under attack” challenge
dnz-proxy: TCP and UDP (L4) routers and services
dnz-proxy: DNZ runs a node on its own server; packaging
dnz-proxy: clippy clean-up; compress honors its encodings; transport and mirroring limits reported
Proxy: dnz-proxy nodes, entry points, cache and settings
Middlewares: dnz-proxy’s cache, firewall and challenge forms
Proxy analytics: traffic, latency, cache and the request log
dnz proxy CLI: nodes, approve, ignore, drain, remove, purge; nodes that stop reporting count as disconnected
dnz-proxy: certificates over ACME, issued and renewed by DNZ
dnz-proxy UI: fixes from trying it against a running node
dnz-proxy: DNS follows what it would answer, so a node’s new address reaches DNS too
dnz-proxy setup: Docker from the DNZ image, and a node on DNZ’s own server
Certificates: ACME accounts, DNS credentials, resolvers and certificates
dnz-proxy: name the DNS answers type
CLI: notifications, Cloudflare, settings, audit log, sessions and a private CA
Proxied records: one record through several proxies
Proxy routers: line every cell up on one row height
Proxy routers: open the app behind each hostname
Topology map: the whole setup on one canvas
Add route: suggest hostnames from zones and records
Add route: hold back “no zone” while suggestions are open
CLI: dnz proxy hosts and dnz proxy route
CLI: dnz proxy route finds the proxy’s entry points
Add route: one place picks the entry points, for the UI and the CLI
Router dialog: the same entry points as Add route and the CLI
dnz-proxy: encodedCharacters middleware
dnz-proxy: client certificates and passTLSClientCert
dnz-proxy: grpcWeb middleware
dnz-proxy: rate limits shared through Redis
dnz-proxy: 421 for client certificates on reused connections, docs
Cloudflare import: all records, or only the ones ticked
Import a zone: Raw zone file and From Cloudflare tabs
Zones: forward names they don’t have to the upstreams
ALIAS records: CNAME flattening at the apex
Caddy: DNS records for the sites a Caddy serves
Caddy: Settings → Integrations, zone badges, topology and docs
Build release binaries against glibc 2.35; proxy setup uses the install script
More record types: TLSA, SSHFP, NAPTR, DS, URI, DNAME and LOC
DNSSEC: NSEC3, Ed25519 and RSA, KSK/ZSK split, automatic key rollover with CDS/CDNSKEY
Recursive resolution: DNZ resolves from the root servers itself
DNSSEC validation of forwarded and recursive answers
Recursor: concurrent identical questions share one resolution
Response rate limiting (RRL) per response, besides the per-client limit
Filtering: safe search, parental control, schedules and per-client rules
RPZ: subscribe to response policy zones and serve the blocklists as one
GeoDNS, weighted answers and health checks for plain A/AAAA records
Serve-stale (RFC 8767) and prefetch in the forwarder cache
EDNS Client Subnet (RFC 7871) towards the upstreams
DNS64 (RFC 6147) for IPv6-only networks
DNS cookies (RFC 7873, RFC 9018) and NSID (RFC 5001)
ECS: ecs_of() for the client subnet a query carries
Forwarder: prefetch refreshes ask without CD
Database: Postgres and MySQL besides SQLite
dnz db migrate-from-sqlite, data_dir, the backend in config check
Faster cache hits: wire-format answers in a sharded cache
Docker: dnz-proxy image of its own, published with each release
dnz-proxy on Docker Swarm: stack file and docs
Setup guide: a Docker Swarm tab for dnz-proxy
Cluster: several DNZ servers on one Postgres or MySQL database
Nodes starting together on an empty database seed it once
Cluster page: new nodes run the DNZ image, not dnz-proxy’s
ExternalDNS webhook provider, Kubernetes guide
Change approval: read DNZ’s 202 answer, check the request’s status
Zone history and change approval: versions, diff, rollback, change requests
CLI: dnz zone history|diff|rollback, dnz change, dnz settings history
UI: zone history tab, pending changes inbox, approval policies
History: a changed value reads ‘www A 192.0.2.1 → 192.0.2.2’
History after the cluster: prune on the leader only; change events in new providers’ defaults
ExternalDNS webhook in Rust (dnz externaldns-webhook); drop the Go code
Kubernetes guide: where change requests are approved
Prometheus /metrics: own listen address or HTTP API with a token
Settings: Prometheus metrics card with token and scrape config
Grafana dashboard, Prometheus alert rules and a monitoring compose file
Metrics: cluster node id, leader and change-feed lag in the docs, alerts and dashboard
Metrics: query counters in 16 stripes picked by the client’s port, so DNS workers rarely share a cache line
Zones in memory: no spare room per name, no copy on reload
Server: one malloc arena per CPU, trimmed every minute
Health check: install and machine checks with copy-paste fixes, a schedule on the leader that alerts, API and metrics
Onboarding: the setup wizard’s state and guides (API), dnz setup asks the same questions, dnz doctor
Onboarding UI: the setup wizard page, the health check page and its header badge
Alerts: health check rules named apart from the GeoDNS health check’s
DHCP and IPAM: leases from Kea, dhcpd and Windows DHCP become records; DHCID rules for DNS UPDATEs; IPAM view
CLI: dnz dhcp servers|show|add|edit|sync|leases|import|rm and dnz ipam subnets|show|conflicts|add|rm
UI: DNS → DHCP & IPAM (servers with copy-paste Kea/dhcpd/Windows setup, leases, IPAM subnets and conflicts); DHCP badge on records
API tokens may push DHCP lease files (import, sync, leases) and read IPAM
DHCP: a paused server keeps its records
Backups: archives of the whole install, targets (folder, S3, SFTP), schedules, retention, restore
Backups: fixes from a live run
Backups: Settings > Backups page, restore dialogs, restore on the setup page, topology
CLI: health_check in dnz notify’s list of events
Threats: detectors over the query stream, findings, feeds, alerts, auto-blocking, API, CLI and metrics
Threats: feeds take an Auth-Key; abuse.ch and HaGeZi as presets instead of seeded feeds
Threats page: findings per client and per domain with evidence, status, mute, allow, block; feeds, lists, settings and a self-test
Threats: tunnel counts stop at the name cap instead of counting every query; benchmark with detection on and off
Setup guides: the host’s address when DNZ runs in Docker
Device address in the UI: Settings → General, the wizard and dnz settings advertise
Overview: queries per client network and an “Answered by” breakdown