PowerDNS-AuthAdmin questions, answered

PowerDNS-AuthAdmin is a free, open-source web interface for managing PowerDNS Authoritative servers. It adds role-based access control, single sign-on (OIDC, SAML and LDAP), passkeys and MFA, a diff-before-apply record editor, DNSSEC and TSIG management, multi-backend cluster support, an append-only audit log and a built-in MCP server for AI assistants on top of the PowerDNS HTTP API. It ships as one Docker image and is MIT licensed.

Yes. PowerDNS-AuthAdmin is free and open source under the MIT licence. You self-host it on your own infrastructure; there is no SaaS, no account to create and no telemetry.

PowerDNS-AuthAdmin is tested in CI against PowerDNS Authoritative 4.6 to 5.0 (4.6, 4.7, 4.8, 4.9 and 5.0). It talks to PowerDNS through the Authoritative server's built-in HTTP API, so the API and an API key must be enabled.

No. PowerDNS-AuthAdmin manages PowerDNS Authoritative servers, the ones that host your zones. It does not configure PowerDNS Recursor or dnsdist.

Run the Docker image ghcr.io/powerdns-authadmin/powerdns-authadmin with Docker Compose. Generate APP_SECRET_KEY and APP_ENCRYPTION_KEY once into a .env file, set APP_URL to the URL your browser uses, set the bootstrap admin account and start the stack. Migrations run automatically on boot. The installation guide covers production setups with TLS and backups.

SQLite for a single instance (homelab, evaluation, small teams) or PostgreSQL for multiple instances. To run more than one replica you need PostgreSQL plus Redis, which coordinates rate limiting, one-time reveal tokens and live updates across replicas.

Any OpenID Connect provider (with PKCE, group → role mapping and RP-initiated logout), any SAML 2.0 identity provider such as AD FS, Authentik, Keycloak, Okta, Microsoft Entra ID, PingFederate or Shibboleth, and LDAP against Active Directory or OpenLDAP. Local email and password accounts are also available.

Yes. Users can enrol WebAuthn passkeys and hardware security keys such as YubiKey, either for passwordless sign-in or as a second factor, and TOTP authenticator apps. A role can be marked MFA-required so everyone holding it must enrol.

Yes. Every role assignment has a scope: global, a team, a single zone or a single server. A user can hold a record-editing role on one zone and have no access anywhere else. The SOA, apex NS records and zone settings are separate permissions, so you can let someone manage records without letting them change the zone's authority.

Yes. One install manages standalone primaries, primary + secondaries groups and multi-primary clusters that share a replicated database. Zones from all backends appear in one list, and sync probes show whether every secondary or cluster peer has the same serial and records.

Yes. Every admin screen has a matching /api/admin route. Scripts authenticate with personal access tokens (pda_pat_…) that carry their own permission scopes, sent as a Bearer token or X-API-Key header. The same tokens authenticate MCP clients on /api/mcp, and DNSSEC state (signing status, keys, the DS set, per-mirror sync) is readable over the API too.

Yes. Since version 1.9.0, PowerDNS-AuthAdmin includes a Model Context Protocol (MCP) server at /api/mcp. Connect Claude Code, Codex, Cursor, Windsurf or any MCP client over Streamable HTTP with a personal access token as the Bearer header, then ask in plain language: point www at an address, replace a zone's MX records, create a staging zone. The assistant gets nine tools for listing backends and zones, reading records, replacing, appending and deleting records, and creating or deleting zones. See the MCP guide for each client's configuration.

The MCP server gives an assistant no power its token owner doesn't have. Every call runs as the owner of a personal access token, limited by the token's scopes and per-zone grants, and goes through the same validators, optimistic concurrency and audit log as the web UI. A read-only token presents a read-only server, destructive tools are annotated so clients can ask for confirmation, deleting a zone requires the assistant to repeat its name, and every change is logged under the owner's name with the client's user agent. Give a bot the minimum: a per-zone grant beats a global role.

Zones already hosted in PowerDNS appear as soon as you register the backend, because PowerDNS-AuthAdmin reads them straight from the PowerDNS API. You can also import one or many zones from a BIND zone file, and export any selection of zones as a BIND-format bundle.

No. It makes no phone-home calls and serves all of its assets itself, so it runs in air-gapped networks.

PowerDNS-AuthAdmin is a separate project written from scratch in TypeScript on Node.js. Its focus is teams running multiple backends: scoped RBAC, OIDC / SAML / LDAP with group mapping, passkeys, diff-before-apply editing, cluster and secondary sync probes, an append-only audit log and a built-in MCP server for AI assistants. See the comparison page for details.

Yes. demo.powerdns-authadmin.org is a real, seeded install you can click around in. The sign-in details are on its login page and in the project README.

Please report vulnerabilities privately through GitHub's private vulnerability reporting, as described in the security policy. Do not open a public issue.