Skip to main content
Everything the dashboard does can also be done from the terminal with the same dnz binary. Without a command, dnz runs the server. Every other command manages a running server through its HTTP API. Because the CLI goes through the API:
  • it follows the same permissions as the dashboard,
  • it validates input the same way,
  • every change shows up in the audit log under your name.
Use it on a server without the web UI, over SSH, in scripts and cron jobs, or simply when typing is faster than clicking.

​
A quick example

dnz login signs you in to this machine’s server and saves the session, so the next commands need no password. See Authentication.

​
Getting help

dnz --help lists every command, and dnz <command> --help lists every option of a command:
Most command groups have a plural alias, so dnz zones list works as well as dnz zone list. Shorter aliases exist too: fwd for forwarding, repl for replication, cf for cloudflare, ls for list and delete for rm.

​
Options every command takes

​
Output

Commands print tables. Add --json to get the API’s JSON instead, for example to feed jq:
Commands that delete or replace something ask first. --yes (-y) skips the question.
Without a terminal (cron, CI), commands that delete or replace something refuse unless you pass --yes.

​
Which server a command talks to

The CLI picks the server in this order:
  1. --server
  2. DNZ_SERVER
  3. the last server you signed in to
  4. this machine’s http.addr from the config file
So on the DNZ server itself, dnz login with no options is usually all you need. From your laptop, sign in once with --server and later commands go to that server.

​
Running without the web UI

DNZ can run headless, managed only from the CLI and the API. Turn the UI off in one of three ways:
DNS and the API keep running. The API stays at http.addr (default 127.0.0.1:8080, so only this machine can reach it), and / answers that the UI is off.

​
First-run setup from the terminal

On a new server with no users yet, create the first admin with dnz setup:
It asks for the admin’s username and password, the first division and the upstream resolvers. You’re signed in when it’s done. To run it without questions, pass everything as options and put the password in DNZ_PASSWORD:
For Docker and other automated installs, set DNZ_ADMIN_PASSWORD (and optionally DNZ_ADMIN_USERNAME, default admin) instead: the admin is created on start and setup is skipped. See First run.

​
Commands

Authentication

Sign in, API tokens for scripts, private CAs and sessions.

Zones and records

Zones, records, bulk changes, tags and views.

Access

Divisions, users, roles, API tokens and update keys.

Forwarding

Upstreams, strategies, rules and diagnosis.

Filtering

Blocklists, rules and client networks.

Replication

Primary and secondary servers, join codes.

Proxy

Proxy routes and dnz-proxy nodes.

Cloudflare

Connect, import and push zones.

Notifications

Telegram, email and webhook providers, alert thresholds.

Monitoring

Query log, stats, audit log, topology and settings.

Maintenance

Configuration, health checks, version and factory reset.