Skip to main content
This runs the Linux binary as a service with its own throwaway user and the systemd sandbox.
One command installs dnz, sets up the service and starts it:
It asks for sudo when it needs to, and then:
  • installs dnz in /usr/local/bin (as Linux binary does),
  • writes the unit to /etc/systemd/system/dnz.service, the same one as in the Manual tab,
  • creates /etc/dnz/dnz.env with every setting commented out, readable only by root. An existing one is left alone,
  • frees port 53 when systemd-resolved’s stub holds it, as in Port 53 and systemd-resolved,
  • enables and starts dnz, checks that it stays up, and prints the dashboard address.
Open the dashboard and create the first admin; see First run. The dashboard listens only on 127.0.0.1:8080, so from your computer use an SSH tunnel (ssh -L 8080:127.0.0.1:8080 you@server) or put a reverse proxy in front.Run the same command again to upgrade: it replaces the binary and restarts dnz. If the unit changed, the old one is kept as dnz.service.bak.
To leave systemd-resolved alone, create /etc/dnz/dnz.env with DNZ_DNS_ADDR=<this server's IP>:53 before running the command. The script keeps that file and doesn’t touch systemd-resolved when DNZ listens on one address.
When another program (dnsmasq, bind9, unbound and so on) holds port 53, the script sets up the service but doesn’t start it, and says which program it is. Stop that program or bind DNZ to one address, then run sudo systemctl start dnz.

​
What the unit does

  • DynamicUser=yes: a temporary user just for DNZ. Data lives in /var/lib/dnz/dnz.db.
  • AmbientCapabilities=CAP_NET_BIND_SERVICE: ports 53, 443 and 853 without root.
  • The systemd sandbox: ProtectSystem=strict, NoNewPrivileges, a syscall filter and more.
  • The dashboard only on 127.0.0.1:8080. To reach it from the network, put a reverse proxy in front, or change DNZ_HTTP_ADDR.

​
Changing settings

Edit /etc/dnz/dnz.env, then restart:
Settings can also go in /etc/dnz/dnz.toml (dnz config example prints one with every setting).
The environment wins over the file. The unit’s three Environment= lines (database, DNS address and HTTP address) therefore beat the same keys in dnz.toml. Delete those lines from the unit to set them in the file. dnz config show prints where each value comes from. See Configuration.

​
Running without the web UI

Set DNZ_UI=false (or ui = false under [http] in dnz.toml), create the first admin with dnz setup on the server, and manage everything with the CLI.

​
Without systemd

Give the binary permission to bind low ports once: