# DNZ

> Self-hosted authoritative DNS server and forwarder with a web dashboard, a CLI and an API.

- [Introduction](https://dnzwithazee.com/index.md): DNZ is a self-hosted authoritative DNS server and forwarder, managed from a web dashboard, a CLI and an API.
- [Quickstart](https://dnzwithazee.com/get-started/quickstart.md): Run DNZ, finish the setup page, add a zone and answer your first query.
- [First run](https://dnzwithazee.com/get-started/first-run.md): Create the first admin with the setup page, the dnz setup command, or environment variables.
- [Concepts](https://dnzwithazee.com/get-started/concepts.md): How DNZ answers a query, and how divisions, roles and superadmins fit together.
- [Install](https://dnzwithazee.com/deploy/install.md): Get DNZ as a Docker image or as a Linux binary.
- [Docker](https://dnzwithazee.com/deploy/docker.md): Run DNZ with Docker Compose: ports, the data volume and environment settings.
- [systemd](https://dnzwithazee.com/deploy/systemd.md): Run the dnz binary as a sandboxed systemd service on Linux.
- [Database](https://dnzwithazee.com/deploy/database.md): Keep DNZ's data in SQLite, Postgres or MySQL, and move an existing install from SQLite.
- [Port 53 and systemd-resolved](https://dnzwithazee.com/deploy/port-53.md): Free port 53 when systemd-resolved or another DNS server already uses it.
- [HTTPS and reverse proxies](https://dnzwithazee.com/deploy/https.md): Reach the dashboard securely from the network, behind Caddy or nginx or with DNZ's own HTTPS.
- [Configuration](https://dnzwithazee.com/deploy/configuration.md): Every setting, as a config file key, an environment variable and a flag.
- [Security and firewall](https://dnzwithazee.com/deploy/security.md): Sign-in protection, sessions, security headers, and which ports to open.
- [Pointing clients at DNZ](https://dnzwithazee.com/deploy/clients.md): Make devices on your network use DNZ as their DNS server.
- [Backups and updates](https://dnzwithazee.com/deploy/backups.md): Back up DNZ's database safely and update DNZ.
- [Troubleshooting](https://dnzwithazee.com/deploy/troubleshooting.md): Common problems when deploying DNZ and how to fix them.
- [Benchmarks](https://dnzwithazee.com/deploy/benchmarks.md): How fast DNZ answers compared with Knot DNS, Knot Resolver, Unbound and CoreDNS, and how to measure it yourself.
- [Dashboard tour](https://dnzwithazee.com/dashboard/tour.md): Find your way around the DNZ dashboard: the top bar, the menu, Find and Create New.
- [Monitoring](https://dnzwithazee.com/dashboard/monitoring.md): Upstream health, incidents, traffic alerts and the daily summary.
- [Topology map](https://dnzwithazee.com/dashboard/topology.md): Your whole DNS setup on one interactive canvas, with live health drawn on it.
- [Zones and records](https://dnzwithazee.com/dns/zones.md): Create local zones, add and edit records, and control how DNZ answers for names a zone does not have.
- [GeoDNS and health checks](https://dnzwithazee.com/dns/geodns.md): Answer plain A and AAAA records by the client's country or continent, by weight, and only while a health check of the address passes.
- [Import and export](https://dnzwithazee.com/dns/import-export.md): Move zones in and out of DNZ as BIND zone files, and copy records to and from Cloudflare, with a preview before anything changes.
- [Forwarding](https://dnzwithazee.com/dns/forwarding.md): Send names outside your zones to upstream resolvers over plain or encrypted DNS, choose how DNZ picks between them, and route some domains or networks elsewhere.
- [Recursive resolution](https://dnzwithazee.com/dns/recursive.md): Let DNZ resolve names itself from the root servers, like Unbound, instead of forwarding them to a public resolver.
- [Resolver options](https://dnzwithazee.com/dns/resolver-options.md): Serve stale answers while upstreams are down, refresh busy names early, pass the client's subnet to CDNs, DNS64 for IPv6-only networks, DNS cookies and NSID.
- [Query logs](https://dnzwithazee.com/dns/query-logs.md): See which names clients ask for, who answered them, and how long the logs and traffic counts are kept.
- [Filtering](https://dnzwithazee.com/dns/filtering.md): Block ads, trackers, malware or specific sites in DNS with blocklists and your own rules, server-wide or per division, with safe search, parental control, schedules and per-client rules.
- [Response policy zones](https://dnzwithazee.com/dns/rpz.md): Subscribe to RPZ threat feeds by zone transfer or URL, and serve DNZ's own blocklists as an RPZ zone for BIND, Unbound and PowerDNS.
- [Views (split horizon)](https://dnzwithazee.com/dns/views.md): Answer the same name differently depending on where the client asks from, such as a private address inside the office and a public one outside.
- [DNSSEC](https://dnzwithazee.com/dns/dnssec.md): Sign a local zone with DNSSEC so validating resolvers can verify that DNZ's answers are genuine.
- [DNSSEC validation](https://dnzwithazee.com/dns/dnssec-validation.md): Check the signatures of the domains DNZ resolves, reject forged answers, and exempt domains whose signatures are broken.
- [Encrypted DNS](https://dnzwithazee.com/dns/encrypted-dns.md): Serve DNS over TLS, HTTPS, QUIC and HTTP/3 to your devices, so the network in between can't read or change their queries.
- [Rate limiting](https://dnzwithazee.com/dns/rate-limiting.md): A per-client query limit and response rate limiting (RRL) against floods and DNS amplification attacks over UDP.
- [Replication](https://dnzwithazee.com/dns/replication.md): Run more than one nameserver for your zones: DNZ as primary, secondary or both, with AXFR/IXFR, TSIG, NOTIFY and a catalog zone.
- [Dynamic updates (RFC 2136)](https://dnzwithazee.com/dns/dynamic-updates.md): Let DHCP servers, ExternalDNS, certbot and nsupdate change records with standard DNS UPDATE messages signed with a TSIG key.
- [Proxied records](https://dnzwithazee.com/proxy/overview.md): Put a name behind one or more reverse proxies, so DNS answers with the proxies' addresses and your servers stay hidden.
- [Connecting Traefik](https://dnzwithazee.com/proxy/traefik.md): Point Traefik's HTTP provider at DNZ, so each Traefik serves the routers, services and middlewares set up for it.
- [Routers, services and middlewares](https://dnzwithazee.com/proxy/routing.md): Set up what a proxy serves: the hostnames it takes, where visits go, and what happens to them on the way.
- [Records from Traefik's routers](https://dnzwithazee.com/proxy/traefik-records.md): Give the hostnames of Traefik's Docker, Swarm, Kubernetes and other routers DNS records automatically.
- [dnz-proxy](https://dnzwithazee.com/proxy/dnz-proxy.md): Run DNZ's own Pingora-based reverse proxy on any number of servers, with certificates, caching, a firewall and analytics.
- [Certificates for dnz-proxy](https://dnzwithazee.com/proxy/certificates.md): Let DNZ get TLS certificates over ACME and hand them to every dnz-proxy node, or upload your own.
- [Cloudflare](https://dnzwithazee.com/integrations/cloudflare.md): Manage a division's Cloudflare zones from DNZ, and copy records between Cloudflare and local DNS.
- [Caddy](https://dnzwithazee.com/integrations/caddy.md): DNS records for the sites a Caddy serves, kept up to date as the Caddyfile changes.
- [Notifications](https://dnzwithazee.com/integrations/notifications.md): Send outages, traffic alerts, certificate problems and a daily summary to Telegram, e-mail or webhooks.
- [ACME DNS-01 certificates](https://dnzwithazee.com/integrations/acme.md): Get Let's Encrypt certificates, including wildcards, with DNS-01 challenges answered by DNZ.
- [Dynamic DNS (DynDNS2)](https://dnzwithazee.com/integrations/dynamic-dns.md): Keep a hostname pointed at a changing IP address from routers, ddclient or inadyn.
- [Terraform](https://dnzwithazee.com/integrations/terraform.md): Manage DNZ records from Terraform with a generic REST provider.
- [Users, divisions and roles](https://dnzwithazee.com/admin/access.md): Give people access to the divisions they work in, with only the permissions they need.
- [Audit log](https://dnzwithazee.com/admin/audit-log.md): Who changed what, when, and from which IP address.
- [Server settings](https://dnzwithazee.com/admin/settings.md): Time zone, automatic PTR, response rate limiting, the GeoIP database, encrypted DNS status and factory reset under Settings → General.
- [Command line](https://dnzwithazee.com/cli/overview.md): Manage a DNZ server from the terminal with the same dnz binary that runs it.
- [Authentication](https://dnzwithazee.com/cli/authentication.md): Sign in from the CLI, use API tokens in scripts, trust a private CA and manage your sessions.
- [Zones and records](https://dnzwithazee.com/cli/zones-records.md): Create and change zones, records, traffic steering (GeoDNS, weights, health checks) and split-horizon views from the terminal.
- [Access](https://dnzwithazee.com/cli/access.md): Manage divisions, users, roles, API tokens and dynamic update keys from the terminal.
- [Forwarding](https://dnzwithazee.com/cli/forwarding.md): Manage upstreams, the forwarding strategy and conditional forwarding rules, and diagnose upstreams from the terminal.
- [Filtering](https://dnzwithazee.com/cli/filtering.md): Manage blocklists, allow and block rules, client networks and groups, schedules, safe search, parental control and response policy zones from the terminal.
- [Replication](https://dnzwithazee.com/cli/replication.md): Set up primaries, secondaries and join requests from the terminal.
- [Proxy](https://dnzwithazee.com/cli/proxy.md): Add proxy routes and manage dnz-proxy nodes from the terminal.
- [Cloudflare](https://dnzwithazee.com/cli/cloudflare.md): Connect a division to Cloudflare, copy zones in both directions and set up Sign in with Cloudflare from the terminal.
- [Caddy](https://dnzwithazee.com/cli/caddy.md): Connect a Caddy, preview its records and keep them in sync from the terminal.
- [Notifications](https://dnzwithazee.com/cli/notifications.md): Manage notification providers, alert thresholds and upstream incidents from the terminal.
- [Monitoring](https://dnzwithazee.com/cli/monitoring.md): Read the query log, traffic stats, audit log and topology, and change server-wide settings from the terminal.
- [Maintenance](https://dnzwithazee.com/cli/maintenance.md): Write and check the configuration, run health checks, print the version and factory-reset a server.
- [API overview](https://dnzwithazee.com/api/overview.md): DNZ's HTTP API, API tokens for automation, authentication and errors.
- [Zones](https://dnzwithazee.com/api/zones.md): API endpoints for zones, zone files, secondary refresh, the query log and token info.
- [Records](https://dnzwithazee.com/api/records.md): API endpoints for records: the record format, filtering, proxied records, traffic steering and bulk changes.
- [Filtering](https://dnzwithazee.com/api/filtering.md): API endpoints for blocklists, rules, client groups, schedules, safe search and response policy zones.
- [Settings](https://dnzwithazee.com/api/settings.md): API endpoints for server settings: response rate limiting (RRL) and the GeoIP database.
- [Caddy API](https://dnzwithazee.com/api/caddy.md): Endpoints for connecting Caddies and syncing the DNS records of their sites.
- [ACME and Dynamic DNS endpoints](https://dnzwithazee.com/api/acme-ddns.md): Reference for the httpreq ACME DNS-01 endpoints and the DynDNS2 update endpoint.
- [Proxy API](https://dnzwithazee.com/api/proxy.md): Endpoints for proxying settings, proxies, routers, services, middlewares and the Traefik provider.
- [dnz-proxy API](https://dnzwithazee.com/api/dnz-proxy.md): Endpoints for dnz-proxy nodes, entry points, cache purges and analytics.
- [Certificates API](https://dnzwithazee.com/api/certificates.md): Endpoints for the ACME accounts, DNS credentials, resolvers and certificates DNZ uses for dnz-proxy.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.