Skip to main content

​
Account security

First passwords

The first admin created with DNZ_ADMIN_PASSWORD must choose a new password at the first sign-in. So must every user whose password an admin created or reset. Passwords need at least 10 characters and are hashed with argon2.
After 5 failed sign-ins, that username is locked for 15 minutes. An IP address is locked after 20 failures. Both show up in the audit log as user.login_failed and user.login_locked.Behind a reverse proxy, set DNZ_TRUSTED_PROXIES so the client’s address is locked, not the proxy’s. See HTTPS and reverse proxies.
Sessions end after DNZ_SESSION_TTL_HOURS (168 hours by default), or sooner when unused for DNZ_SESSION_IDLE_HOURS (72 hours by default). Signed-in devices are listed under Account → Sessions, where you can sign any of them out. The CLI has the same with dnz session list and dnz session revoke.
Every response carries a per-page Content Security Policy that only allows DNZ’s own scripts, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and HSTS when reached over HTTPS (directly, or through a proxy that sends X-Forwarded-Proto: https).
API tokens and update-key secrets are shown once; DNZ stores only a hash of each API token. Passwords and secrets are never written to the audit log, and notification secrets are shown masked.

​
Firewall

Don’t open port 53 to the whole internet unless DNZ is a public nameserver: an open resolver can be abused for amplification attacks. Limit it to your own networks:
A public nameserver should turn on response rate limiting (RRL).
Other ports you may need: See Encrypted DNS and Replication.