> ## Documentation Index
> Fetch the complete documentation index at: https://dnzwithazee.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Every DNZ release, newest first, and what changed in it.

The latest release is **v1.3.0**, released October 22, 2026. To install or upgrade to it:

```bash theme={null}
docker pull terrificci/dnz:1.3.0
docker pull terrificci/dnz-proxy:1.3.0   # a server that only runs dnz-proxy
curl -fsSL https://raw.githubusercontent.com/terrific-ci/dnz/main/install.sh | sh -s -- --version 1.3.0
```

The `latest` image tag and the install script without `--version` always get this release; see
[Install](/deploy/install).

**v1.3.0**

* first commit (alfianlensundev)
* DNS phase 1: TCP, EDNS, SOA, CNAME chasing and zone cache (alfianlensundev)
* DNS phase 2: upstream cache, failover and forward DNS monitoring (alfianlensundev)
* Forwarding strategies and first-run setup page (alfianlensundev)
* Encrypted upstreams: DNS-over-TLS and DNS-over-HTTPS (alfianlensundev)
* Vercel-style sidebar layout and incident notification providers (alfianlensundev)
* Vercel-style account menu and centered collapsed sidebar (alfianlensundev)
* Cloudflare integration per division (alfianlensundev)
* Zone import and export (alfianlensundev)
* Find on Cmd+K and pre-filled Cloudflare token link (alfianlensundev)
* Server time zone setting and SPA loading screen (alfianlensundev)
* Conditional forwarding and audit log (alfianlensundev)
* Auto PTR, domain autocomplete for forwarding rules, compact layout (alfianlensundev)
* Sign in with Cloudflare and bulk import into local DNS (alfianlensundev)
* Deploy-ready build, all-queries log view, readable toasts (alfianlensundev)
* Blocklists per division, API tokens with ACME DNS-01, deploy guide (alfianlensundev)
* CI and tagged releases on GitHub Actions (alfianlensundev)
* Dynamic DNS over DynDNS2 (alfianlensundev)
* Split-horizon DNS with views (alfianlensundev)
* Serve DNS over TLS and DNS over HTTPS (alfianlensundev)
* DNSSEC signing for local zones (alfianlensundev)
* release.sh for cutting releases (alfianlensundev)
* Roadmap: tick DoT/DoH serving and CI, done earlier (alfianlensundev)
* Publish the release image to Docker Hub instead of ghcr.io (alfianlensundev)
* About DNZ instead of the status line in the account menu (alfianlensundev)
* Readable, consistent form text (alfianlensundev)
* Roadmap: topology map with vue-flow as the last phase (alfianlensundev)
* Harden sign-in, sessions and HTTP headers (alfianlensundev)
* Redesign the Filtering page (alfianlensundev)
* Filtering: plain placeholder on the list URL field (alfianlensundev)
* Use bun for the web UI instead of pnpm (alfianlensundev)
* Run the Nuxt dev server on port 3111 (alfianlensundev)
* Replication: zone transfers, NOTIFY, catalog zones and DNZ secondaries (alfianlensundev)
* Fix confirm dialogs always answering no (alfianlensundev)
* Redesign the Integrations page (alfianlensundev)
* Replication: one entry per discovered server, list manual secondary zones (alfianlensundev)
* Switch UI icons from Lucide to Iconify Phosphor (alfianlensundev)
* Replication page with network discovery (alfianlensundev)
* Docs: replication (alfianlensundev)
* Docs in English (alfianlensundev)
* Overview: hourly query chart, top names and stat tiles (alfianlensundev)
* Record on/off, default TTL per zone, bulk record edits, comments and tags (alfianlensundev)
* Redesign the dashboard: glass top bar, section tabs, Iris theme (alfianlensundev)
* TOML config file and CLI-only mode (alfianlensundev)
* Redesign polish: record type lens filter, zone state header, solid auth forms (alfianlensundev)
* Records toolbar: keep search and Add record on one row on phones (alfianlensundev)
* CLI: record on/off, tags, comments, bulk edits and zone default TTL (alfianlensundev)
* Document the design system in DESIGN.md; fix the toast gray token (alfianlensundev)
* Top bar health pill opens an upstream popover instead of Forwarding (alfianlensundev)
* Dashboard tabs: DNS, Forward DNS and a Server tab with host usage (alfianlensundev)
* Dashboard: Request flow tab drawn with vue-flow (alfianlensundev)
* Account settings in a dialog instead of a page (alfianlensundev)
* Spacing fixes for Find and the top bar; DD-MM-YYYY HH:mm:ss times (alfianlensundev)
* Forwarding by client network, with rule labels (alfianlensundev)
* Forward rule form: DNS servers and client networks as tag chips (alfianlensundev)
* Tag chips for every list field (alfianlensundev)
* Record controls UI and bulk add of records (alfianlensundev)
* CLI: dnz record add-many (alfianlensundev)
* Add record in a dialog, with several names as chips (alfianlensundev)
* Edit record in a dialog (alfianlensundev)
* Upstream diagnosis streamed over SSE, and dnz forwarding diagnose (alfianlensundev)
* Diagnose dialog for upstreams with live step progress (alfianlensundev)
* Forward rules in a drag-and-drop order, first match wins (alfianlensundev)
* Diagnose action on forwarding rules; document the upstream diagnosis (alfianlensundev)
* Dynamic DNS UPDATE (RFC 2136) with per-division TSIG update keys (alfianlensundev)
* DNS update keys in the UI and dnz update-key in the CLI (alfianlensundev)
* Document dynamic DNS updates (RFC 2136) (alfianlensundev)
* Ignore Impeccable review screenshots and mocks (alfianlensundev)
* Dashboard: top clients beside top names, and dnz stats (alfianlensundev)
* Hourly query rollups and 24h/7d/30d/90d traffic ranges (alfianlensundev)
* Roadmap: group finished Phase 2 items, mark Phase 4 done (alfianlensundev)
* Traffic alerts and a daily summary (alfianlensundev)
* Clippy: then\_some for the load average (alfianlensundev)
* HTTPS/SVCB records, CAA iodef, BADVERS and end-to-end DNS tests (alfianlensundev)
* Cloudflare: cache zone and record lists, explain API errors (alfianlensundev)
* Roadmap: proxy is a built-in feature, off by default (alfianlensundev)
* Roadmap: proxy backend is Pingora (built in) or Traefik (HTTP provider API) (alfianlensundev)
* DNS over QUIC and DoH over HTTP/3, as upstreams and served (alfianlensundev)
* Proxied records through Traefik (alfianlensundev)
* Proxy: one Traefik config, recognized by address, detected and approved (alfianlensundev)
* Proxy: correct the address a Traefik calls DNZ from (alfianlensundev)
* Proxy in the menu next to DNS, settings for turning it on and connecting (alfianlensundev)
* Traefik v3.7 compose for testing proxied records (alfianlensundev)
* Traefik test compose: settings in traefik.yml instead of .env (alfianlensundev)
* Traefik test compose: drop the whoami origins (alfianlensundev)
* Proxy: leave empty routers and services out of Traefik's config (alfianlensundev)
* Proxy menu: show up without a page refresh (alfianlensundev)
* Proxy: pick the Traefik entry points from a list (alfianlensundev)
* Proxy: read Traefik's API, and a copy-paste guide to set Traefik up (alfianlensundev)
* Select: inner padding and item radius like the other menus (alfianlensundev)
* Proxy: open the edit and approve dialogs against an older server (alfianlensundev)
* Proxy dialog: at most 80% of the screen tall (alfianlensundev)
* Menus never wrap their items; short Traefik API errors (alfianlensundev)
* Record form: show a proxied visit step by step (alfianlensundev)
* Record form: the visitor's URL follows the proxy's entry points (alfianlensundev)
* Proxy: "uses HTTPS" decides both sides of a proxied name (alfianlensundev)
* Dev servers listen on every interface (alfianlensundev)
* Dev server: DNS on port 53 (alfianlensundev)
* Dev server: DNS on port 5300 (alfianlensundev)
* Dev server: DNS back on port 53 (alfianlensundev)
* Proxy: routers, services and middlewares per proxy (alfianlensundev)
* Proxy: records from a Traefik's own routers (alfianlensundev)
* Proxy: From Traefik tab and docs for records from Traefik's routers (alfianlensundev)
* Proxy: several upstreams per service, shared by weight (alfianlensundev)
* Proxy: records from routers of every Traefik provider (alfianlensundev)
* Traefik test compose: routers from container labels (alfianlensundev)
* Record form: proxied path as a vertical step list (alfianlensundev)
* Proxy: the whole card opens the proxy, with a clear call to action (alfianlensundev)
* Proxy: add a route in one step (alfianlensundev)
* Proxy: Traefik API hint names the Proxy menu and links to it (alfianlensundev)
* Proxy: pull zones for Traefik's hostnames that no zone holds (alfianlensundev)
* Proxy: load-balancing strategy and sticky sessions per service (alfianlensundev)
* Proxy: records from Traefik's routers are proxied through the proxy (alfianlensundev)
* Drop links to the source repository from the app (alfianlensundev)
* Factory reset from the web UI and the CLI (alfianlensundev)
* Proxy: a form for every Traefik HTTP middleware (alfianlensundev)
* Request flow: a Proxy tab while proxying is on (alfianlensundev)
* Proxy: weighted, mirroring and failover services, full load-balancer settings (alfianlensundev)
* Proxy: full router rules, TLS options and domains, router observability (alfianlensundev)
* Proxy: TLS certificates and options, servers transports, TCP and UDP (alfianlensundev)
* Proxy: reachability marks, certificate progress, DNS records from the proxy (alfianlensundev)
* dnz-proxy: design and build plan (alfianlensundev)
* dnz-proxy: workspace, node binary skeleton, nodes joining a proxy and the configuration stream (alfianlensundev)
* dnz-proxy: the HTTP data plane on Pingora and Traefik's HTTP middlewares (alfianlensundev)
* dnz-proxy: traffic analytics from the nodes' reports (alfianlensundev)
* Proxy: dnz-proxy's own middleware types, kept from Traefik (alfianlensundev)
* Settings → Proxy: pick dnz-proxy, with a copy-paste node setup guide (alfianlensundev)
* dnz-proxy: caching, firewall rules and the "under attack" challenge (alfianlensundev)
* dnz-proxy: TCP and UDP (L4) routers and services (alfianlensundev)
* dnz-proxy: DNZ runs a node on its own server; packaging (alfianlensundev)
* dnz-proxy: clippy clean-up; compress honors its encodings; transport and mirroring limits reported (alfianlensundev)
* Proxy: dnz-proxy nodes, entry points, cache and settings (alfianlensundev)
* Docs: dnz-proxy (nodes, entry points, routing, its middlewares, analytics, API); roadmap and README (alfianlensundev)
* Middlewares: dnz-proxy's cache, firewall and challenge forms (alfianlensundev)
* dnz-proxy: Docker build needs CMake (Pingora's zlib-ng); CI checks the whole workspace; a two-node docker compose to try it (alfianlensundev)
* Proxy analytics: traffic, latency, cache and the request log (alfianlensundev)
* dnz proxy CLI: nodes, approve, ignore, drain, remove, purge; nodes that stop reporting count as disconnected (alfianlensundev)
* Docs: dnz proxy commands (alfianlensundev)
* dnz-proxy: certificates over ACME, issued and renewed by DNZ (alfianlensundev)
* dnz-proxy UI: fixes from trying it against a running node (alfianlensundev)
* dnz-proxy: DNS follows what it would answer, so a node's new address reaches DNS too (alfianlensundev)
* README: DNZ\_ACME\_CA\_ROOTS (alfianlensundev)
* Docs: dnz-proxy wording matches the UI (alfianlensundev)
* dnz-proxy setup: Docker from the DNZ image, and a node on DNZ's own server (alfianlensundev)
* Certificates: ACME accounts, DNS credentials, resolvers and certificates (alfianlensundev)
* dnz-proxy: name the DNS answers type (alfianlensundev)
* CLI: notifications, Cloudflare, settings, audit log, sessions and a private CA (alfianlensundev)
* Proxied records: one record through several proxies (alfianlensundev)
* Proxy routers: line every cell up on one row height (alfianlensundev)
* Proxy routers: open the app behind each hostname (alfianlensundev)
* Topology map: the whole setup on one canvas (alfianlensundev)
* Add route: suggest hostnames from zones and records (alfianlensundev)
* Add route: hold back "no zone" while suggestions are open (alfianlensundev)
* Ignore the local /testing folder (alfianlensundev)
* CLI: dnz proxy hosts and dnz proxy route (alfianlensundev)
* CLI: dnz proxy route finds the proxy's entry points (alfianlensundev)
* Add route: one place picks the entry points, for the UI and the CLI (alfianlensundev)
* Test importing a hand-kept BIND file (alfianlensundev)
* Router dialog: the same entry points as Add route and the CLI (alfianlensundev)
* dnz-proxy: encodedCharacters middleware (alfianlensundev)
* dnz-proxy: client certificates and passTLSClientCert (alfianlensundev)
* dnz-proxy: grpcWeb middleware (alfianlensundev)
* dnz-proxy: rate limits shared through Redis (alfianlensundev)
* dnz-proxy: 421 for client certificates on reused connections, docs (alfianlensundev)
* Cloudflare import: all records, or only the ones ticked (alfianlensundev)
* Import a zone: Raw zone file and From Cloudflare tabs (alfianlensundev)
* Zones: forward names they don't have to the upstreams (alfianlensundev)
* Roadmap: Phase 8, gaps with other DNS servers (alfianlensundev)
* Roadmap: Phase 9, DNS records for the sites a Caddy serves (alfianlensundev)
* traefiktest (alfianlensundev)
* Docs: Mintlify documentation site (alfianlensundev)
* Docs site: link to github.com/terrific-ci/dnz (alfianlensundev)
* Move the documentation site to its own repository (alfianlensundev)
* ALIAS records: CNAME flattening at the apex (alfianlensundev)
* Caddy: DNS records for the sites a Caddy serves (alfianlensundev)
* Caddy: Settings → Integrations, zone badges, topology and docs (alfianlensundev)
* Build release binaries against glibc 2.35; proxy setup uses the install script (alfianlensundev)
* More record types: TLSA, SSHFP, NAPTR, DS, URI, DNAME and LOC (alfianlensundev)
* DNSSEC: NSEC3, Ed25519 and RSA, KSK/ZSK split, automatic key rollover with CDS/CDNSKEY (alfianlensundev)
* Recursive resolution: DNZ resolves from the root servers itself (alfianlensundev)
* DNSSEC validation of forwarded and recursive answers (alfianlensundev)
* Recursor: concurrent identical questions share one resolution (alfianlensundev)
* Benchmarks: DNZ against Knot DNS, Knot Resolver, Unbound and CoreDNS (alfianlensundev)
* Response rate limiting (RRL) per response, besides the per-client limit (alfianlensundev)
* Filtering: safe search, parental control, schedules and per-client rules (alfianlensundev)
* RPZ: subscribe to response policy zones and serve the blocklists as one (alfianlensundev)
* GeoDNS, weighted answers and health checks for plain A/AAAA records (alfianlensundev)
* Serve-stale (RFC 8767) and prefetch in the forwarder cache (alfianlensundev)
* EDNS Client Subnet (RFC 7871) towards the upstreams (alfianlensundev)
* DNS64 (RFC 6147) for IPv6-only networks (alfianlensundev)
* DNS cookies (RFC 7873, RFC 9018) and NSID (RFC 5001) (alfianlensundev)
* ECS: ecs\_of() for the client subnet a query carries (alfianlensundev)
* Forwarder: prefetch refreshes ask without CD (alfianlensundev)
* Database: Postgres and MySQL besides SQLite (alfianlensundev)
* dnz db migrate-from-sqlite, data\_dir, the backend in config check (alfianlensundev)
* Docs: choosing a database, moving from SQLite; Postgres compose file (alfianlensundev)
* Faster cache hits: wire-format answers in a sharded cache (alfianlensundev)
* Benchmarks: cache hits before and after the sharded wire-format cache (alfianlensundev)
* Roadmap: Phase 10, cluster, metrics, DNZ as code, change review (alfianlensundev)
* Docker: dnz-proxy image of its own, published with each release (alfianlensundev)
* dnz-proxy on Docker Swarm: stack file and docs (alfianlensundev)
* Setup guide: a Docker Swarm tab for dnz-proxy (alfianlensundev)
* Docs: the setup guide's Docker Swarm tab (alfianlensundev)
* Cluster: several DNZ servers on one Postgres or MySQL database (alfianlensundev)
* Nodes starting together on an empty database seed it once (alfianlensundev)
* Docs: running a DNZ cluster (NS records or anycast), dnz cluster (alfianlensundev)
* Cluster page: new nodes run the DNZ image, not dnz-proxy's (alfianlensundev)
* Terraform provider: zones, records, forwarding, filtering, API tokens (alfianlensundev)
* ExternalDNS webhook provider, Kubernetes guide (alfianlensundev)
* Change approval: read DNZ's 202 answer, check the request's status (alfianlensundev)
* Terraform: read records from DNZ 1.1 servers too (alfianlensundev)
* Zone history and change approval: versions, diff, rollback, change requests (alfianlensundev)
* CLI: dnz zone history|diff|rollback, dnz change, dnz settings history (alfianlensundev)
* UI: zone history tab, pending changes inbox, approval policies (alfianlensundev)
* History: a changed value reads 'www A 192.0.2.1 → 192.0.2.2' (alfianlensundev)
* Docs: zone history and change approval (docs/history.md, API, CLI, README, roadmap) (alfianlensundev)
* History after the cluster: prune on the leader only; change events in new providers' defaults (alfianlensundev)
* ExternalDNS webhook in Rust (dnz externaldns-webhook); drop the Go code (alfianlensundev)
* Kubernetes guide: where change requests are approved (alfianlensundev)
* History docs: ExternalDNS instead of Terraform in the examples (alfianlensundev)
* Prometheus /metrics: own listen address or HTTP API with a token (alfianlensundev)
* Settings: Prometheus metrics card with token and scrape config (alfianlensundev)
* Grafana dashboard, Prometheus alert rules and a monitoring compose file (alfianlensundev)
* Docs: metrics.md, dnz settings metrics; tick the Phase 10 metrics items (alfianlensundev)
* Metrics: cluster node id, leader and change-feed lag in the docs, alerts and dashboard (alfianlensundev)
* Metrics: query counters in 16 stripes picked by the client's port, so DNS workers rarely share a cache line (alfianlensundev)
* Metrics: API tests for the settings, the token and the scrape (alfianlensundev)
* Docs: what counting queries costs (alfianlensundev)
* Roadmap: Phase 11, backups, DHCP and IPAM, threat detection, onboarding (alfianlensundev)
* Zones in memory: no spare room per name, no copy on reload (alfianlensundev)
* Web server: route with regex-lite instead of regex (alfianlensundev)
* Server: one malloc arena per CPU, trimmed every minute (alfianlensundev)
* Benchmarks: memory through a day's work, before and after (alfianlensundev)
* Health check: install and machine checks with copy-paste fixes, a schedule on the leader that alerts, API and metrics (alfianlensundev)
* Onboarding: the setup wizard's state and guides (API), dnz setup asks the same questions, dnz doctor (alfianlensundev)
* Onboarding UI: the setup wizard page, the health check page and its header badge (alfianlensundev)
* Docs: health check, the setup wizard, dnz doctor and dnz setup's questions; alert rules; Phase 11 onboarding ticked (alfianlensundev)
* Alerts: health check rules named apart from the GeoDNS health check's (alfianlensundev)
* DHCP and IPAM: leases from Kea, dhcpd and Windows DHCP become records; DHCID rules for DNS UPDATEs; IPAM view (alfianlensundev)
* CLI: dnz dhcp servers|show|add|edit|sync|leases|import|rm and dnz ipam subnets|show|conflicts|add|rm (alfianlensundev)
* UI: DNS → DHCP & IPAM (servers with copy-paste Kea/dhcpd/Windows setup, leases, IPAM subnets and conflicts); DHCP badge on records (alfianlensundev)
* Docs: docs/dhcp.md (Kea, dhcpd, Windows DHCP, the DHCID rules, IPAM), CLI, API, metrics; README; ROADMAP Phase 11 DHCP and IPAM done (alfianlensundev)
* API tokens may push DHCP lease files (import, sync, leases) and read IPAM (alfianlensundev)
* Docs: dnz dhcp leases lists every lease unless --live (alfianlensundev)
* DHCP: a paused server keeps its records (alfianlensundev)
* Backups: archives of the whole install, targets (folder, S3, SFTP), schedules, retention, restore (alfianlensundev)
* Backups: fixes from a live run (alfianlensundev)
* Backups: Settings > Backups page, restore dialogs, restore on the setup page, topology (alfianlensundev)
* Docs: backups and disaster recovery (alfianlensundev)
* CLI: health\_check in dnz notify's list of events (alfianlensundev)
* Threats: detectors over the query stream, findings, feeds, alerts, auto-blocking, API, CLI and metrics (alfianlensundev)
* Threats: feeds take an Auth-Key; abuse.ch and HaGeZi as presets instead of seeded feeds (alfianlensundev)
* Threats page: findings per client and per domain with evidence, status, mute, allow, block; feeds, lists, settings and a self-test (alfianlensundev)
* Threats: e2e test with real queries over UDP (tunnel, DGA, new domains, auto-blocking) (alfianlensundev)
* Docs: threat detection (docs/threats.md), dnz threats in docs/cli.md, README; tick Phase 11 threat detection (alfianlensundev)
* Threats e2e test: wait for filtering to load the block before asking (alfianlensundev)
* Threats: tunnel counts stop at the name cap instead of counting every query; benchmark with detection on and off (alfianlensundev)
* DHCP e2e test: Shared has a threats field now (alfianlensundev)
* Release notes: every commit since the previous tag with its author (alfianlensundev)
* Release title is just the tag (v1.2.0), not DNZ v1.2.0 (alfianlensundev)
* release.sh --prune: delete releases, their tags and Docker Hub images (alfianlensundev)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.