Skip to main content
DNZ is one binary that answers DNS for your own zones, forwards everything else to upstream resolvers, filters ads and malware, replicates zones to other nameservers and can put your sites behind a reverse proxy. You manage it from a dashboard with a Cloudflare-like record editor, from the dnz command line, or over its HTTP API. It is built for IT teams that run DNS for internal networks: a hospital, a campus, an office with several departments. Each department is a division with its own zones, members and permissions.

Quickstart

Run DNZ, answer your first query and add a record in a few minutes.

Deploy to a server

Docker or systemd, port 53, HTTPS and backups.

Command line

Everything the dashboard does, from the terminal.

API

API tokens for scripts, Terraform and ACME certificates.

​
What DNZ does

UDP and TCP with EDNS(0). Zones live in the database and are kept in memory: A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, HTTPS/SVCB, PTR, TLSA, SSHFP, NAPTR, DS, URI, DNAME, LOC and wildcards, with an automatic SOA, CNAME chasing and negative answers. A local zone can also override just a few names of a public domain and forward the rest. See Zones and records.
Names outside your zones go to upstreams over plain DNS, DoT, DoH, DoQ or DoH3, with a cache, five load-balancing strategies, conditional forwarding per domain or client network, latency monitoring and a step-by-step diagnosis when an upstream fails. See Forwarding.
Server-wide and per-division blocklists (hosts, AdGuard and domain-list formats), your own allow and block rules, and a tester that tells you why a domain is blocked. Safe search, parental control, schedules, rules for some clients only, and response policy zones (RPZ). See Filtering and Response policy zones.
Answer plain A and AAAA records by the client’s country or continent, by weight, and only while an HTTP, HTTPS or TCP health check passes. See GeoDNS and health checks.
Answer one name differently inside and outside, sign zones with DNSSEC, and serve DoT, DoH, DoQ and DoH3 to your devices, with response rate limiting (RRL) against amplification. See Views, DNSSEC, Encrypted DNS and Rate limiting.
DNZ as primary and/or secondary with AXFR/IXFR, TSIG, NOTIFY and a catalog zone. DNZ servers find each other on the LAN and join with a 6-digit code. See Replication.
Like Cloudflare’s orange cloud: DNS answers with a proxy’s address and the origin stays hidden. Use Traefik, or DNZ’s own Pingora-based dnz-proxy with certificates, caching, a firewall and analytics. See Proxy.
API tokens, ACME DNS-01 for lego, Traefik and certbot, DynDNS2 for routers, RFC 2136 dynamic updates for Kea and ExternalDNS, Cloudflare sync, and notifications to Telegram, e-mail and webhooks.
Divisions, roles with fine-grained permissions, superadmins, and an audit log of every change. See Users, divisions and roles.

​
One program

DNZ is a single program with the dashboard built in. It keeps all of its data in one SQLite file, so a backup is one file, or in Postgres or MySQL for large installations. It runs on Linux (amd64 and arm64), as a Docker image or a systemd service. The optional reverse proxy, dnz-proxy, comes with it.