> ## Documentation Index > Fetch the complete documentation index at: https://docs.dnzwithazee.com/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > Every DNZ release, newest first, and what changed in it. The latest release is **v1.7.1**, released October 24, 2026. To install or upgrade to it: ```bash theme={null} docker pull terrificci/dnz:1.7.1 docker pull terrificci/dnz-proxy:1.7.1 # a server that only runs dnz-proxy curl -fsSL https://raw.githubusercontent.com/terrific-ci/dnz/main/install.sh | sh -s -- --version 1.7.1 ``` The `latest` image tag and the install script without `--version` always get this release; see [Install](https://docs.dnzwithazee.com/deploy/install.md). **v1.7.1** October 24, 2026 * dnz-proxy: one write for an answer's head and small body; log lines only when kept * Proxy benchmarks: after 1.7.0, one write per answer and fewer allocations **v1.7.0** October 24, 2026 * Proxy: on/off switch, a kind per proxy, and Caddy as a proxy * Status pages: a host served by a proxy shows a status page instead of its backend * Status pages on Caddy and Traefik, and in the topology map * Status pages: a Vue Flow-style path, Manrope, and a countdown * Status pages without panels * Memory: big inserts not kept prepared, cached answers without spare room * Blocklists and threat feeds as packed domain sets * Proxy benchmark: dnz-proxy against nginx, HAProxy, Envoy, Caddy and Traefik * Threats: few-name pairs kept small, the baseline's memory fixed * Caddy: upstream URLs split without an else-if chain **v1.6.1** October 23, 2026 * DNS over UDP: batch buffers split with as\_chunks * Overview: a skeleton while the traffic panel loads * Toasts: top right, just under the top bar * Outgoing lookups: fall back past a broken /etc/resolv.conf * DNS over UDP: answer from the address that was asked * Overview: top names and clients from hourly rollups **v1.6.0** October 23, 2026 * Public files for the docs: monitoring, benchmark harness, Swarm stack * Upstream toasts: one per poll instead of one per incident * Record form: searchable view picker * Launch config: Mintlify docs preview * Query logs: fixed statement sizes, so memory stops climbing * DNS over UDP: a socket per CPU, answered where received * Cache: a full cache no longer sweeps itself on every insert * DNS over UDP: four sockets per CPU * Overview: All queries scope for superadmins * DNS: a 2 KB future per query instead of 22 KB * DNS: a query's name is normalized once * DNS over UDP: batches with recvmmsg and sendmmsg **v1.5.0** October 23, 2026 * DNS phase 1: TCP, EDNS, SOA, CNAME chasing and zone cache * DNS phase 2: upstream cache, failover and forward DNS monitoring * Forwarding strategies and first-run setup page * Encrypted upstreams: DNS-over-TLS and DNS-over-HTTPS * Vercel-style sidebar layout and incident notification providers * Vercel-style account menu and centered collapsed sidebar * Cloudflare integration per division * Zone import and export * Find on Cmd+K and pre-filled Cloudflare token link * Server time zone setting and SPA loading screen * Conditional forwarding and audit log * Auto PTR, domain autocomplete for forwarding rules, compact layout * Sign in with Cloudflare and bulk import into local DNS * Deploy-ready build, all-queries log view, readable toasts * Blocklists per division, API tokens with ACME DNS-01, deploy guide * Dynamic DNS over DynDNS2 * Split-horizon DNS with views * Serve DNS over TLS and DNS over HTTPS * DNSSEC signing for local zones * Publish the release image to Docker Hub instead of ghcr.io * About DNZ instead of the status line in the account menu * Readable, consistent form text * Harden sign-in, sessions and HTTP headers * Redesign the Filtering page * Filtering: plain placeholder on the list URL field * Replication: zone transfers, NOTIFY, catalog zones and DNZ secondaries * Fix confirm dialogs always answering no * Redesign the Integrations page * Replication: one entry per discovered server, list manual secondary zones * Switch UI icons from Lucide to Iconify Phosphor * Replication page with network discovery * Overview: hourly query chart, top names and stat tiles * Record on/off, default TTL per zone, bulk record edits, comments and tags * Redesign the dashboard: glass top bar, section tabs, Iris theme * TOML config file and CLI-only mode * Redesign polish: record type lens filter, zone state header, solid auth forms * Records toolbar: keep search and Add record on one row on phones * CLI: record on/off, tags, comments, bulk edits and zone default TTL * Top bar health pill opens an upstream popover instead of Forwarding * Dashboard tabs: DNS, Forward DNS and a Server tab with host usage * Dashboard: Request flow tab drawn with vue-flow * Account settings in a dialog instead of a page * Spacing fixes for Find and the top bar; DD-MM-YYYY HH:mm:ss times * Forwarding by client network, with rule labels * Forward rule form: DNS servers and client networks as tag chips * Tag chips for every list field * Record controls UI and bulk add of records * CLI: dnz record add-many * Add record in a dialog, with several names as chips * Edit record in a dialog * Upstream diagnosis streamed over SSE, and dnz forwarding diagnose * Diagnose dialog for upstreams with live step progress * Forward rules in a drag-and-drop order, first match wins * Diagnose action on forwarding rules; document the upstream diagnosis * Dynamic DNS UPDATE (RFC 2136) with per-division TSIG update keys * DNS update keys in the UI and dnz update-key in the CLI * Dashboard: top clients beside top names, and dnz stats * Hourly query rollups and 24h/7d/30d/90d traffic ranges * Traffic alerts and a daily summary * HTTPS/SVCB records, CAA iodef, BADVERS and end-to-end DNS tests * Cloudflare: cache zone and record lists, explain API errors * DNS over QUIC and DoH over HTTP/3, as upstreams and served * Proxied records through Traefik * Proxy: one Traefik config, recognized by address, detected and approved * Proxy: correct the address a Traefik calls DNZ from * Proxy in the menu next to DNS, settings for turning it on and connecting * Proxy: leave empty routers and services out of Traefik's config * Proxy menu: show up without a page refresh * Proxy: pick the Traefik entry points from a list * Proxy: read Traefik's API, and a copy-paste guide to set Traefik up * Select: inner padding and item radius like the other menus * Proxy: open the edit and approve dialogs against an older server * Proxy dialog: at most 80% of the screen tall * Menus never wrap their items; short Traefik API errors * Record form: show a proxied visit step by step * Record form: the visitor's URL follows the proxy's entry points * Proxy: "uses HTTPS" decides both sides of a proxied name * Proxy: routers, services and middlewares per proxy * Proxy: records from a Traefik's own routers * Proxy: From Traefik tab and docs for records from Traefik's routers * Proxy: several upstreams per service, shared by weight * Proxy: records from routers of every Traefik provider * Record form: proxied path as a vertical step list * Proxy: the whole card opens the proxy, with a clear call to action * Proxy: add a route in one step * Proxy: Traefik API hint names the Proxy menu and links to it * Proxy: pull zones for Traefik's hostnames that no zone holds * Proxy: load-balancing strategy and sticky sessions per service * Proxy: records from Traefik's routers are proxied through the proxy * Factory reset from the web UI and the CLI * Proxy: a form for every Traefik HTTP middleware * Request flow: a Proxy tab while proxying is on * Proxy: weighted, mirroring and failover services, full load-balancer settings * Proxy: full router rules, TLS options and domains, router observability * Proxy: TLS certificates and options, servers transports, TCP and UDP * Proxy: reachability marks, certificate progress, DNS records from the proxy * dnz-proxy: workspace, node binary skeleton, nodes joining a proxy and the configuration stream * dnz-proxy: the HTTP data plane on Pingora and Traefik's HTTP middlewares * dnz-proxy: traffic analytics from the nodes' reports * Proxy: dnz-proxy's own middleware types, kept from Traefik * Settings → Proxy: pick dnz-proxy, with a copy-paste node setup guide * dnz-proxy: caching, firewall rules and the "under attack" challenge * dnz-proxy: TCP and UDP (L4) routers and services * dnz-proxy: DNZ runs a node on its own server; packaging * dnz-proxy: clippy clean-up; compress honors its encodings; transport and mirroring limits reported * Proxy: dnz-proxy nodes, entry points, cache and settings * Middlewares: dnz-proxy's cache, firewall and challenge forms * Proxy analytics: traffic, latency, cache and the request log * dnz proxy CLI: nodes, approve, ignore, drain, remove, purge; nodes that stop reporting count as disconnected * dnz-proxy: certificates over ACME, issued and renewed by DNZ * dnz-proxy UI: fixes from trying it against a running node * dnz-proxy: DNS follows what it would answer, so a node's new address reaches DNS too * dnz-proxy setup: Docker from the DNZ image, and a node on DNZ's own server * Certificates: ACME accounts, DNS credentials, resolvers and certificates * dnz-proxy: name the DNS answers type * CLI: notifications, Cloudflare, settings, audit log, sessions and a private CA * Proxied records: one record through several proxies * Proxy routers: line every cell up on one row height * Proxy routers: open the app behind each hostname * Topology map: the whole setup on one canvas * Add route: suggest hostnames from zones and records * Add route: hold back "no zone" while suggestions are open * CLI: dnz proxy hosts and dnz proxy route * CLI: dnz proxy route finds the proxy's entry points * Add route: one place picks the entry points, for the UI and the CLI * Router dialog: the same entry points as Add route and the CLI * dnz-proxy: encodedCharacters middleware * dnz-proxy: client certificates and passTLSClientCert * dnz-proxy: grpcWeb middleware * dnz-proxy: rate limits shared through Redis * dnz-proxy: 421 for client certificates on reused connections, docs * Cloudflare import: all records, or only the ones ticked * Import a zone: Raw zone file and From Cloudflare tabs * Zones: forward names they don't have to the upstreams * ALIAS records: CNAME flattening at the apex * Caddy: DNS records for the sites a Caddy serves * Caddy: Settings → Integrations, zone badges, topology and docs * Build release binaries against glibc 2.35; proxy setup uses the install script * More record types: TLSA, SSHFP, NAPTR, DS, URI, DNAME and LOC * DNSSEC: NSEC3, Ed25519 and RSA, KSK/ZSK split, automatic key rollover with CDS/CDNSKEY * Recursive resolution: DNZ resolves from the root servers itself * DNSSEC validation of forwarded and recursive answers * Recursor: concurrent identical questions share one resolution * Response rate limiting (RRL) per response, besides the per-client limit * Filtering: safe search, parental control, schedules and per-client rules * RPZ: subscribe to response policy zones and serve the blocklists as one * GeoDNS, weighted answers and health checks for plain A/AAAA records * Serve-stale (RFC 8767) and prefetch in the forwarder cache * EDNS Client Subnet (RFC 7871) towards the upstreams * DNS64 (RFC 6147) for IPv6-only networks * DNS cookies (RFC 7873, RFC 9018) and NSID (RFC 5001) * ECS: ecs\_of() for the client subnet a query carries * Forwarder: prefetch refreshes ask without CD * Database: Postgres and MySQL besides SQLite * dnz db migrate-from-sqlite, data\_dir, the backend in config check * Faster cache hits: wire-format answers in a sharded cache * Docker: dnz-proxy image of its own, published with each release * dnz-proxy on Docker Swarm: stack file and docs * Setup guide: a Docker Swarm tab for dnz-proxy * Cluster: several DNZ servers on one Postgres or MySQL database * Nodes starting together on an empty database seed it once * Cluster page: new nodes run the DNZ image, not dnz-proxy's * ExternalDNS webhook provider, Kubernetes guide * Change approval: read DNZ's 202 answer, check the request's status * Zone history and change approval: versions, diff, rollback, change requests * CLI: dnz zone history|diff|rollback, dnz change, dnz settings history * UI: zone history tab, pending changes inbox, approval policies * History: a changed value reads 'www A 192.0.2.1 → 192.0.2.2' * History after the cluster: prune on the leader only; change events in new providers' defaults * ExternalDNS webhook in Rust (dnz externaldns-webhook); drop the Go code * Kubernetes guide: where change requests are approved * Prometheus /metrics: own listen address or HTTP API with a token * Settings: Prometheus metrics card with token and scrape config * Grafana dashboard, Prometheus alert rules and a monitoring compose file * Metrics: cluster node id, leader and change-feed lag in the docs, alerts and dashboard * Metrics: query counters in 16 stripes picked by the client's port, so DNS workers rarely share a cache line * Zones in memory: no spare room per name, no copy on reload * Server: one malloc arena per CPU, trimmed every minute * Health check: install and machine checks with copy-paste fixes, a schedule on the leader that alerts, API and metrics * Onboarding: the setup wizard's state and guides (API), dnz setup asks the same questions, dnz doctor * Onboarding UI: the setup wizard page, the health check page and its header badge * Alerts: health check rules named apart from the GeoDNS health check's * DHCP and IPAM: leases from Kea, dhcpd and Windows DHCP become records; DHCID rules for DNS UPDATEs; IPAM view * CLI: dnz dhcp servers|show|add|edit|sync|leases|import|rm and dnz ipam subnets|show|conflicts|add|rm * UI: DNS → DHCP & IPAM (servers with copy-paste Kea/dhcpd/Windows setup, leases, IPAM subnets and conflicts); DHCP badge on records * API tokens may push DHCP lease files (import, sync, leases) and read IPAM * DHCP: a paused server keeps its records * Backups: archives of the whole install, targets (folder, S3, SFTP), schedules, retention, restore * Backups: fixes from a live run * Backups: Settings > Backups page, restore dialogs, restore on the setup page, topology * CLI: health\_check in dnz notify's list of events * Threats: detectors over the query stream, findings, feeds, alerts, auto-blocking, API, CLI and metrics * Threats: feeds take an Auth-Key; abuse.ch and HaGeZi as presets instead of seeded feeds * Threats page: findings per client and per domain with evidence, status, mute, allow, block; feeds, lists, settings and a self-test * Threats: tunnel counts stop at the name cap instead of counting every query; benchmark with detection on and off * Setup guides: the host's address when DNZ runs in Docker * Device address in the UI: Settings → General, the wizard and dnz settings advertise * Overview: queries per client network and an "Answered by" breakdown This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.