# DNZ

> Self-hosted authoritative DNS server and forwarder with a web dashboard, a CLI and an API.

- [Introduction](https://docs.dnzwithazee.com/index.md): DNZ is a self-hosted authoritative DNS server and forwarder, managed from a web dashboard, a CLI and an API.
- [Quickstart](https://docs.dnzwithazee.com/get-started/quickstart.md): Run DNZ, finish the setup page, add a zone and answer your first query.
- [First run](https://docs.dnzwithazee.com/get-started/first-run.md): Create the first admin with the setup page, the dnz setup command, or environment variables, then let the setup wizard point your network or registrar at DNZ.
- [Concepts](https://docs.dnzwithazee.com/get-started/concepts.md): How DNZ answers a query, and how divisions, roles and superadmins fit together.
- [Install](https://docs.dnzwithazee.com/deploy/install.md): Get DNZ as a Docker image or as a Linux binary.
- [Docker](https://docs.dnzwithazee.com/deploy/docker.md): Run DNZ with Docker Compose: ports, the data volume and environment settings.
- [systemd](https://docs.dnzwithazee.com/deploy/systemd.md): Run the dnz binary as a sandboxed systemd service on Linux.
- [Database](https://docs.dnzwithazee.com/deploy/database.md): Keep DNZ's data in SQLite, Postgres or MySQL, and move an existing install from SQLite.
- [Cluster](https://docs.dnzwithazee.com/deploy/cluster.md): Run two or more DNZ servers on one Postgres or MySQL database, behind NS records or anycast.
- [Port 53 and systemd-resolved](https://docs.dnzwithazee.com/deploy/port-53.md): Free port 53 when systemd-resolved or another DNS server already uses it.
- [HTTPS and reverse proxies](https://docs.dnzwithazee.com/deploy/https.md): Reach the dashboard securely from the network, behind Caddy or nginx or with DNZ's own HTTPS.
- [Configuration](https://docs.dnzwithazee.com/deploy/configuration.md): Every setting, as a config file key, an environment variable and a flag.
- [Security and firewall](https://docs.dnzwithazee.com/deploy/security.md): Sign-in protection, sessions, security headers, and which ports to open.
- [Pointing clients at DNZ](https://docs.dnzwithazee.com/deploy/clients.md): Make devices on your network use DNZ as their DNS server.
- [Backups and updates](https://docs.dnzwithazee.com/deploy/backups.md): Back up DNZ, with its own scheduled backups or the database's tools, and update DNZ.
- [Troubleshooting](https://docs.dnzwithazee.com/deploy/troubleshooting.md): Common problems when deploying DNZ and how to fix them.
- [Benchmarks](https://docs.dnzwithazee.com/deploy/benchmarks.md): How fast DNZ answers compared with 18 other DNS servers, from Knot DNS, NSD, BIND 9 and PowerDNS to Technitium, AdGuard Home and Pi-hole, which features each one has built in, how much memory DNZ uses, and how to measure it yourself.
- [Dashboard tour](https://docs.dnzwithazee.com/dashboard/tour.md): Find your way around the DNZ dashboard: the top bar, the menu, Find and Create New.
- [Monitoring](https://docs.dnzwithazee.com/dashboard/monitoring.md): Upstream health, incidents, traffic alerts and the daily summary.
- [Prometheus and Grafana](https://docs.dnzwithazee.com/dashboard/prometheus.md): Scrape DNZ's /metrics with Prometheus, import the Grafana dashboard and load the alert rules.
- [Topology map](https://docs.dnzwithazee.com/dashboard/topology.md): Your whole DNS setup on one interactive canvas, with live health drawn on it.
- [Zones and records](https://docs.dnzwithazee.com/dns/zones.md): Create local zones, add and edit records, and control how DNZ answers for names a zone does not have.
- [GeoDNS and health checks](https://docs.dnzwithazee.com/dns/geodns.md): Answer plain A and AAAA records by the client's country or continent, by weight, and only while a health check of the address passes.
- [Import and export](https://docs.dnzwithazee.com/dns/import-export.md): Move zones in and out of DNZ as BIND zone files, and copy records to and from Cloudflare, with a preview before anything changes.
- [History and change approval](https://docs.dnzwithazee.com/dns/history.md): Every change to a zone kept as a version you can compare and roll back to, and edits that wait for someone else's approval.
- [Forwarding](https://docs.dnzwithazee.com/dns/forwarding.md): Send names outside your zones to upstream resolvers over plain or encrypted DNS, choose how DNZ picks between them, and route some domains or networks elsewhere.
- [Recursive resolution](https://docs.dnzwithazee.com/dns/recursive.md): Let DNZ resolve names itself from the root servers, like Unbound, instead of forwarding them to a public resolver.
- [Resolver options](https://docs.dnzwithazee.com/dns/resolver-options.md): Serve stale answers while upstreams are down, refresh busy names early, pass the client's subnet to CDNs, DNS64 for IPv6-only networks, DNS cookies and NSID.
- [Query logs](https://docs.dnzwithazee.com/dns/query-logs.md): See which names clients ask for, who answered them, and how long the logs and traffic counts are kept.
- [Filtering](https://docs.dnzwithazee.com/dns/filtering.md): Block ads, trackers, malware or specific sites in DNS with blocklists and your own rules, server-wide or per division, with safe search, parental control, schedules and per-client rules.
- [Response policy zones](https://docs.dnzwithazee.com/dns/rpz.md): Subscribe to RPZ threat feeds by zone transfer or URL, and serve DNZ's own blocklists as an RPZ zone for BIND, Unbound and PowerDNS.
- [Threat detection](https://docs.dnzwithazee.com/dns/threats.md): Spot malware and data theft in your DNS traffic: generated domains, DNS tunnels, known-bad domains from threat feeds, unusual clients and newly seen domains, with alerts and optional blocking.
- [Views (split horizon)](https://docs.dnzwithazee.com/dns/views.md): Answer the same name differently depending on where the client asks from, such as a private address inside the office and a public one outside.
- [DNSSEC](https://docs.dnzwithazee.com/dns/dnssec.md): Sign a local zone with DNSSEC so validating resolvers can verify that DNZ's answers are genuine.
- [DNSSEC validation](https://docs.dnzwithazee.com/dns/dnssec-validation.md): Check the signatures of the domains DNZ resolves, reject forged answers, and exempt domains whose signatures are broken.
- [Encrypted DNS](https://docs.dnzwithazee.com/dns/encrypted-dns.md): Serve DNS over TLS, HTTPS, QUIC and HTTP/3 to your devices, so the network in between can't read or change their queries.
- [Rate limiting](https://docs.dnzwithazee.com/dns/rate-limiting.md): A per-client query limit and response rate limiting (RRL) against floods and DNS amplification attacks over UDP.
- [Replication](https://docs.dnzwithazee.com/dns/replication.md): Run more than one nameserver for your zones: DNZ as primary, secondary or both, with AXFR/IXFR, TSIG, NOTIFY and a catalog zone.
- [Dynamic updates (RFC 2136)](https://docs.dnzwithazee.com/dns/dynamic-updates.md): Let DHCP servers, ExternalDNS, certbot and nsupdate change records with standard DNS UPDATE messages signed with a TSIG key.
- [Proxied records](https://docs.dnzwithazee.com/proxy/overview.md): Put a name behind one or more reverse proxies, so DNS answers with the proxies' addresses and your servers stay hidden.
- [Connecting Traefik](https://docs.dnzwithazee.com/proxy/traefik.md): Point Traefik's HTTP provider at DNZ, so each Traefik serves the routers, services and middlewares set up for it.
- [Connecting Caddy](https://docs.dnzwithazee.com/proxy/caddy.md): Let DNZ configure a Caddy through its HTTP config loader, so it serves the routers, services and middlewares set up for it.
- [Routers, services and middlewares](https://docs.dnzwithazee.com/proxy/routing.md): Set up what a proxy serves: the hostnames it takes, where visits go, and what happens to them on the way.
- [Records from Traefik's routers](https://docs.dnzwithazee.com/proxy/traefik-records.md): Give the hostnames of Traefik's Docker, Swarm, Kubernetes and other routers DNS records automatically.
- [dnz-proxy](https://docs.dnzwithazee.com/proxy/dnz-proxy.md): Run DNZ's own Pingora-based reverse proxy on any number of servers, with certificates, caching, a firewall and analytics.
- [Certificates for dnz-proxy](https://docs.dnzwithazee.com/proxy/certificates.md): Let DNZ get TLS certificates over ACME and hand them to every dnz-proxy node, or upload your own.
- [Status pages](https://docs.dnzwithazee.com/proxy/status-pages.md): Switch a proxied host to maintenance, blocked, moved and more, so every proxy serving it shows visitors a styled page instead of the backend.
- [Proxy benchmarks](https://docs.dnzwithazee.com/proxy/benchmarks.md): How fast dnz-proxy forwards requests compared with nginx, HAProxy, Envoy, Caddy and Traefik on one CPU, how much memory each holds, and how to measure it yourself.
- [Cloudflare](https://docs.dnzwithazee.com/integrations/cloudflare.md): Manage a division's Cloudflare zones from DNZ, and copy records between Cloudflare and local DNS.
- [Caddy sites in DNS](https://docs.dnzwithazee.com/integrations/caddy.md): DNS records for the sites a Caddy serves, kept up to date as the Caddyfile changes.
- [DHCP and IPAM](https://docs.dnzwithazee.com/integrations/dhcp.md): Names for the machines your DHCP servers hand addresses to, and a view of the address space: Kea, ISC dhcpd and Windows DHCP.
- [Notifications](https://docs.dnzwithazee.com/integrations/notifications.md): Send outages, traffic alerts, certificate problems and a daily summary to Telegram, e-mail or webhooks.
- [ACME DNS-01 certificates](https://docs.dnzwithazee.com/integrations/acme.md): Get Let's Encrypt certificates, including wildcards, with DNS-01 challenges answered by DNZ.
- [Dynamic DNS (DynDNS2)](https://docs.dnzwithazee.com/integrations/dynamic-dns.md): Keep a hostname pointed at a changing IP address from routers, ddclient or inadyn.
- [Terraform](https://docs.dnzwithazee.com/integrations/terraform.md): Manage DNZ records from Terraform with a generic REST provider.
- [Kubernetes (ExternalDNS)](https://docs.dnzwithazee.com/integrations/kubernetes.md): Publish a cluster's Services and Ingresses into DNZ with ExternalDNS, over DNZ's API with an API token.
- [Users, divisions and roles](https://docs.dnzwithazee.com/admin/access.md): Give people access to the divisions they work in, with only the permissions they need.
- [Audit log](https://docs.dnzwithazee.com/admin/audit-log.md): Who changed what, when, and from which IP address.
- [Backups and restore](https://docs.dnzwithazee.com/admin/backups.md): Scheduled, encrypted backups of the whole install to a folder, S3-compatible storage or SFTP, and restores onto any database, of everything or one zone.
- [Server settings](https://docs.dnzwithazee.com/admin/settings.md): Time zone, automatic PTR, the device address, response rate limiting, the GeoIP database, zone history retention, Prometheus metrics, encrypted DNS status and factory reset under Settings → General.
- [Health check](https://docs.dnzwithazee.com/admin/health-check.md): Find the usual mistakes of a DNS install, each with the evidence and a copy-paste fix: port 53, zone delegations, DS records, secondaries, certificates, the clock and weak settings.
- [Command line](https://docs.dnzwithazee.com/cli/overview.md): Manage a DNZ server from the terminal with the same dnz binary that runs it.
- [Authentication](https://docs.dnzwithazee.com/cli/authentication.md): Sign in from the CLI, use API tokens in scripts, trust a private CA and manage your sessions.
- [Zones and records](https://docs.dnzwithazee.com/cli/zones-records.md): Create and change zones, records, traffic steering (GeoDNS, weights, health checks) and split-horizon views from the terminal.
- [History and changes](https://docs.dnzwithazee.com/cli/changes.md): Zone history, diffs and rollbacks, change requests waiting for approval, and approval policies from the terminal.
- [Access](https://docs.dnzwithazee.com/cli/access.md): Manage divisions, users, roles, API tokens and dynamic update keys from the terminal.
- [Forwarding](https://docs.dnzwithazee.com/cli/forwarding.md): Manage upstreams, the forwarding strategy and conditional forwarding rules, and diagnose upstreams from the terminal.
- [Filtering](https://docs.dnzwithazee.com/cli/filtering.md): Manage blocklists, allow and block rules, client networks and groups, schedules, safe search, parental control and response policy zones from the terminal.
- [Threats](https://docs.dnzwithazee.com/cli/threats.md): Threat detection findings, mute rules, the allow list, threat feeds, blocks and settings from the command line.
- [Replication](https://docs.dnzwithazee.com/cli/replication.md): Set up primaries, secondaries and join requests from the terminal.
- [Cluster](https://docs.dnzwithazee.com/cli/cluster.md): See the DNZ servers that share a database: nodes, leader and the change feed.
- [Proxy](https://docs.dnzwithazee.com/cli/proxy.md): Turn proxying on or off, add proxies and routes, and manage dnz-proxy nodes from the terminal.
- [Status pages](https://docs.dnzwithazee.com/cli/status-pages.md): Switch a proxied host to maintenance, blocked, moved and more from the terminal, with schedules and allowed addresses.
- [Cloudflare](https://docs.dnzwithazee.com/cli/cloudflare.md): Connect a division to Cloudflare, copy zones in both directions and set up Sign in with Cloudflare from the terminal.
- [Caddy](https://docs.dnzwithazee.com/cli/caddy.md): Connect a Caddy, preview its records and keep them in sync from the terminal.
- [DHCP and IPAM](https://docs.dnzwithazee.com/cli/dhcp.md): Connect DHCP servers, push lease files and look at the address space from the terminal.
- [Notifications](https://docs.dnzwithazee.com/cli/notifications.md): Manage notification providers, alert thresholds and upstream incidents from the terminal.
- [Backups](https://docs.dnzwithazee.com/cli/backups.md): Backup targets and schedules, backups now, archives and restores from the command line.
- [Monitoring](https://docs.dnzwithazee.com/cli/monitoring.md): Read the query log, traffic stats, audit log and topology, and change server-wide settings from the terminal.
- [Maintenance](https://docs.dnzwithazee.com/cli/maintenance.md): Write and check the configuration, run health checks, print the version and factory-reset a server.
- [API overview](https://docs.dnzwithazee.com/api/overview.md): DNZ's HTTP API, API tokens for automation, authentication and errors.
- [Zones](https://docs.dnzwithazee.com/api/zones.md): API endpoints for zones, zone files, secondary refresh, the query log and token info.
- [Records](https://docs.dnzwithazee.com/api/records.md): API endpoints for records: the record format, filtering, proxied records, traffic steering and bulk changes.
- [History and changes](https://docs.dnzwithazee.com/api/changes.md): API endpoints for zone history, diffs and rollbacks, and for change requests: the 202 answer of an edit that waits for approval.
- [Filtering](https://docs.dnzwithazee.com/api/filtering.md): API endpoints for blocklists, rules, client groups, schedules, safe search and response policy zones.
- [Threats](https://docs.dnzwithazee.com/api/threats.md): API endpoints for threat detection: findings, their status, mute rules, the allow list, threat feeds, blocks and settings.
- [Settings](https://docs.dnzwithazee.com/api/settings.md): API endpoints for server settings: response rate limiting (RRL), the GeoIP database and the cluster.
- [Caddy API](https://docs.dnzwithazee.com/api/caddy.md): Endpoints for connecting Caddies and syncing the DNS records of their sites.
- [DHCP and IPAM API](https://docs.dnzwithazee.com/api/dhcp.md): Endpoints for DHCP servers, lease files, leases and the IPAM view.
- [ACME and Dynamic DNS endpoints](https://docs.dnzwithazee.com/api/acme-ddns.md): Reference for the httpreq ACME DNS-01 endpoints and the DynDNS2 update endpoint.
- [Proxy API](https://docs.dnzwithazee.com/api/proxy.md): Endpoints for proxying settings, proxies, routers, services, middlewares, the Traefik provider and Caddy's config loader.
- [dnz-proxy API](https://docs.dnzwithazee.com/api/dnz-proxy.md): Endpoints for dnz-proxy nodes, entry points, cache purges and analytics.
- [Status pages API](https://docs.dnzwithazee.com/api/status-pages.md): Endpoints for setting, scheduling and lifting the status pages of proxied hosts.
- [Certificates API](https://docs.dnzwithazee.com/api/certificates.md): Endpoints for the ACME accounts, DNS credentials, resolvers and certificates DNZ uses for dnz-proxy.
- [Backups](https://docs.dnzwithazee.com/api/backups.md): API endpoints for backup targets, runs, archives, restores and the zip of every zone's BIND file.
- [Changelog](https://docs.dnzwithazee.com/changelog.md): Every DNZ release, newest first, and what changed in it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.