Skip to main content
A new DNZ has no users. There are three ways to create the first one, a superadmin who can do everything, including managing other users, divisions and roles.
While the database is empty, every page of the dashboard redirects to /setup:
1

Admin account

Username, name, e-mail and password. Passwords need at least 10 characters.
2

First division

Every zone belongs to a division, so name the first one (for example IT). You can add the first zone here too.
3

Forward DNS

Pick a resolver preset (Cloudflare, Google, Quad9) or enter your own upstreams, then a forwarding strategy.
You’re signed in when it’s done, and the setup wizard takes over.

​
The setup wizard

Right after the setup page (or dnz setup), four short steps get DNZ working for what you need. Skip any of them: a banner offers the rest until you’re done or dismiss it, and Settings → Health check → Open the setup wizard or dnz setup picks it up where it stopped.
1

What DNZ will be

A resolver for a network (devices ask it: local zones, filtering, forwarding), authoritative for public zones (the internet asks it for your domains), or both. It shapes the next steps.
2

Upstreams

Where names outside your zones go: a preset (Cloudflare, Google, Quad9, encrypted or plain), your own list, or recursive, resolving from the root servers without any upstream.
3

First zone

A new zone, a BIND zone file (previewed before anything is created), or a copy of a Cloudflare zone once a Cloudflare connection exists.
4

Point at DNZ

Copy-paste guides with this server’s address filled in:
  • Router and DHCP (option 6): your router, ISC dhcpd, Kea, dnsmasq (OpenWrt), MikroTik and Windows Server DHCP;
  • Devices: Windows, macOS, Linux (NetworkManager, systemd-resolved), phones;
  • Encrypted DNS: Android Private DNS, Apple profiles, Windows 11 DoH, systemd-resolved DoT and browsers, once DNZ has a certificate;
  • Registrar, for a public zone: the nameservers, their glue, the DS when DNSSEC is on, the firewall, and Check now, which runs the health check of the delegation right there.
In a Docker container DNZ may only see the container’s own address. The step then asks for the host’s LAN address (Device address).
In the terminal, dnz setup --guide windows,kea prints guides on their own (--guide all for every one, --guide registrar for the first public zone).

​
After the first sign-in

  • Add the people who work with DNS and give them a role in a division. See Users, divisions and roles.
  • Check the server’s time zone under Settings → General. Times in the UI and in notifications use it.
  • Set up notifications so you hear when an upstream goes down.
  • Point your network at DNZ. See Pointing clients at DNZ.
  • Run the health check (Settings → Health check or dnz doctor): port 53, the delegation of public zones, DNSSEC at the registrar, certificates, the clock and weak settings, each with a copy-paste fix.
To start over, Settings → General → Factory reset (or dnz --reset --all) erases everything and brings the setup page back. See Settings.