The list below mirrors what the codebase does today. Every entry is
reachable through the dashboard at /app
and through the API at /v1. Anything not implemented is not on this page.
Zones are served by the in-house authoritative resolver with primary and
secondary transfer. Each zone carries an axfr_allow list and
an optional set of TSIG keys that gate AXFR / IXFR authentication.
Records round-trip through the same control plane the resolver honours.
Create, update, enable, disable, pause, resume, clone, share, soft-delete, restore and rename zones. Each zone carries its own SOA timers (refresh / retry / expire / minimum), an apex NS record, and a TSIG key list.
Manage A, AAAA, CNAME, MX, NS, TXT, SRV, CAA and other record
types. Stage a batch of record changes and publish them
atomically, or discard the batch before it touches the live zone.
Bulk import from a zone file is supported at
/v1/zones/<id>/import.
Enable signing per zone. Signed zones expose a usable DS record
and surface expiring-signature warnings on the dashboard and the
API. DNSSEC keys follow a per-zone rollover schedule readable at
/v1/zones/<id>/key-rollover.
Every action in the dashboard is reachable under
/v1 as a REST endpoint.
Authenticate with API keys minted from
/v1/api-keys; keys are scoped
per tenant and shown exactly once at create time. See the
API quick start
for the canonical surface.
Per-zone query counters, top queried names, top client IPs, q-type
distributions, and response-code counts are surfaced at
/v1/zones/<id>/stats,
/top-names and
/top-clients. The dashboard
reads the same surface.
Tag records with an operator-set label so the zone page groups records by service and filters the list to a single tag at a time. Tags live on the record row and round-trip through the API.
DNS filtering profiles with blocking-list support, and
load-balancer pools whose endpoints become DNS records on the
zone. Pool, endpoint and monitor CRUD all live under
/v1.
Every zone, record, share, API key, audit row and proxy-rule row is scoped to the tenant on the request. Cross-tenant reads and writes are refused at the storage layer.
Every control-plane mutation produces an audit-log entry with
the actor, action, target and before / after payload. Filter by
action, date or actor from the dashboard, or read the entries
at /v1/audit-logs.
Run a DNS lookup against public resolvers from the dashboard and check propagation state across the public DNS. Useful when a registrar NS change is rolling through.
A simple health probe is reachable at /health
for load-balancer and uptime checks; the
status page
renders the latest answer and a timestamp.
The features above are reachable from the dashboard and from the REST API. Read the API quick start or open the dashboard.