Features

Every feature of PowerDNS-AuthAdmin

Access control, single sign-on, safe record editing, an MCP server for AI assistants, multi-backend operations, DNSSEC and a real audit trail, in one self-hosted web UI for PowerDNS Authoritative.

Access control that fits real teams

Give each person exactly the zones and actions they need, and nothing that could break the zone.

RBAC roles list showing the five system roles and their permission counts

~60 permissions: A typed vocabulary across zones, records, SOA, DNSSEC, metadata, TSIG, autoprimaries, templates, users, teams, roles, servers, API tokens, audit, settings and auth providers.
System and custom roles: Super Admin, Team Owner, Operator, Zone Editor and Read Only are seeded. Define your own roles in the UI or in provisioning.yaml.
Scoped assignments: Every grant is (user, role, scope) where scope is global, a team, a single zone or a single server. An operator can edit records in one zone and nowhere else.
Zone authority kept apart: The SOA, the apex NS RRset and zone settings each answer to their own permission, so a hosting customer can manage records without seeing the knobs that break the zone.
Teams: Group users and zones into teams and delegate administration to a Team Owner scoped to that team.
MFA by role: Mark a role as MFA-required and anyone holding it must enrol TOTP or a passkey.

Sign-in for every identity stack

Bring your existing identity provider. Groups map to roles on every sign-in.

OIDC: Generic OpenID Connect with PKCE, per-provider group → role mapping and RP-initiated logout that signs you out at the IdP too. OIDC guide
SAML 2.0: Works with AD FS, Authentik, Keycloak, Okta, Microsoft Entra ID, PingFederate and Shibboleth. Signed assertions required by default, encryption optional. SAML guide
LDAP / Active Directory: Direct bind against Active Directory or OpenLDAP with StartTLS, no federation broker in the path. Groups feed the same mapping as OIDC. LDAP guide
Passkeys and security keys: WebAuthn passkeys (Touch ID, Windows Hello, Android, iCloud Keychain, 1Password, Bitwarden) and hardware keys such as YubiKey, for passwordless sign-in or as a second factor. Passkeys guide
Local accounts and TOTP: Argon2id password hashing with OWASP parameters, TOTP authenticator apps, session management and sign-in rate limiting.
Scoped API tokens: Personal access tokens prefixed pda_pat_ carry their own permission scopes for automation and CI.

Zones and records, edited safely

See exactly what will change before it is written to PowerDNS.

Review changes dialog showing a BIND-style before and after diff of an NS record

Diff-before-apply: Every change is previewed as a BIND-style before / after diff, then applied as a single RRset PATCH.
Inline editing: Enter on a row, a double-click or the row's Edit button opens an edit strip under the record for TTL, value and the disabled flag. Renames and type changes escalate to the full editor with the draft carried along.
Keyboard-first: / searches, N adds, arrows move, Enter edits in place, E opens the full editor, Delete deletes. Every select menu is a combo box with type-ahead and a filter for long lists.
Per-type validation: Structured editors per record type with inline validation and warnings, including trailing-dot fixes, CAA tags and underscore labels for DKIM, DMARC and SRV.
Optimistic concurrency: Edits are checked against the RRset you loaded, so two people can't silently overwrite each other.
Zone templates and cloning: Templates carry NS, SOA timers, prelude records, zone settings and per-kind metadata. Clone an existing zone in one step.
Configurable default TTL: New records start from the zone's metadata, the global setting, then 3600, and the editor tells you which applied.
Split-horizon zones: Mark a zone's internal copy so public and internal zones of the same name list separately with a clear badge.
BIND import and export: Import one or many zones from a BIND zone file, or export any selection as a single BIND-format bundle.
Change history: Every zone has its own history feed, built from the audit log.

Talk to your DNS with any AI assistant

A Model Context Protocol (MCP) server is built in. Describe the change; the assistant makes it through the same guard rails as the UI.

Built-in MCP server: POST /api/mcp speaks Streamable HTTP, stateless and JSON, so it works behind any reverse proxy and across replicas. MCP guide
Works with your client: Claude Code, Codex, Cursor, Windsurf and any HTTP-capable MCP client connect with a URL and a Bearer header. Stdio-only clients bridge through mcp-remote.
Nine task-shaped tools: List backends and zones, inspect a zone, read records, replace / append / delete records, and create or delete zones.
Never more than the token: Every call runs as the owner of a personal access token. Scopes and per-zone grants are the ceiling, re-evaluated on every call, and revocation is immediate.
Read-only tokens, read-only server: Write tools are only advertised to tokens that can write somewhere, so a look-only token never tempts the assistant to try.
Same validators, same diff path: Writes go through the per-type validators, optimistic concurrency and NOTIFY the UI uses. A malformed value comes back as a readable error the assistant can correct.
Destructive calls flagged: Replace, delete-records and delete-zone are annotated as destructive, so clients that confirm such calls will ask you first. Deleting a zone also requires the assistant to repeat its name.
Audited by name: Everything an assistant does lands in the audit log under the token owner, with the client's user agent, so you can filter for it.

Every PowerDNS topology, one UI

Run many PowerDNS Authoritative backends from a single install, side by side.

PowerDNS servers list with a three-peer cluster and a primary with three secondaries

Three topologies: Standalone primaries, primary + secondaries groups (bootstrapped via autoprimary and NOTIFY / AXFR) and multi-primary clusters on a replicated database.
Amalgamated zone list: Zones from every backend merge into one searchable, sortable list with serial, DNSSEC and sync state per row.
Cluster peer selection: Route reads and writes by round-robin, random, lowest latency or least load.
Sync probes: Compare each secondary's serial with the primary, or each cluster peer with the highest-serial peer, and diff record-for-record on demand.
Read-only backends: Mark a backend read-only and every write route refuses it, for public nameservers fed by database replication.
Health advisories: Bell-driven alerts for unreachable hosts, replication drift, missing TSIG keys on secondaries and daemon config drift.
Request log: Every HTTP call to PowerDNS is recorded so you can see what the app asked for and what came back, pruned after a configurable number of days.
SSRF guard: Backend URLs are validated; private networks and plain http are opt-in for trusted LANs.

DNSSEC, TSIG and metadata

The PowerDNS features you'd otherwise reach for pdnsutil to manage, with the secondaries kept in step.

Enable, disable, rectify: Sign a zone the way PowerDNS intends: one call adds default keys, rectifies and bumps the serial, then NOTIFYs. Disabling asks for the zone name and reminds you to pull the DS first.
The right DS set: The DNSSEC tab shows signing state, NSEC / NSEC3, SOA-EDIT and the DS records to publish, leaving out SHA-1 and GOST digests that registrars refuse.
Presigned secondaries handled: Transferred zones get SOA-EDIT so secondaries re-transfer fresh signatures, sync probes compare the served serial, and warnings flag LUA or ALIAS records a secondary cannot sign.
DNSSEC cryptokeys: Create, update and delete cryptokeys; creating one rectifies the zone so denial of existence is never left broken. Each key's activity is pulled from the audit log.
DNSSEC over the API: Signing state, keys, the DS set and per-mirror sync are readable with a scoped token, never private key material. Rollout order and curl examples
TSIG keys: Create and manage TSIG keys; revealing a secret is a separate permission from reading the key list.
Autoprimaries: Register and manage autoprimary (supermaster) entries for automatic secondary provisioning.
Zone metadata: Edit per-zone metadata with validation and diff history.

An audit trail you can trust

Answer “who changed what, when, and from where” without grepping logs.

Audit log with filters for action, actor, resource and time range

Append-only: Every state-changing action is written once and never edited.
Before / after snapshots: Full snapshots with known secret fields redacted, plus the request ID and source IP.
PowerDNS HTTP trail: Each audit row links to the PowerDNS requests it caused.
Filters and CSV export: Filter by action, actor, resource and time, bookmark the query, and export to CSV.

Built to operate

Observable, scriptable and quiet. Nothing leaves your network.

First-boot provisioning: One provisioning.yaml sets up settings, roles, teams, templates, clusters, servers, demo zones and identity providers. Provisioning guide
Full API: Every admin surface has an /api/admin route that accepts a session or a scoped API token.
Metrics and probes: Prometheus /metrics, /healthz liveness and /readyz readiness gated on the database and migration version.
Backup and restore: Export the app database (users, roles, grants, backends, providers, settings, audit log) as JSON with secrets still encrypted, and merge it back into a fresh install that shares the encryption key.
Structured logs: Pino JSON logs with secrets redacted.
Realtime UI: A server-sent events bus pushes external zone edits to open browsers without a refresh.
High availability: Postgres plus Redis for multiple replicas. Migrations are serialised by an advisory lock, so rolling boots are safe.
No telemetry, no CDN: No phone-home and no third-party assets, so air-gapped installs are first-class.
Hardened by default: Per-request CSP nonces, CSRF double-submit, AES-256-GCM encryption of stored secrets and a published security policy. Hardening guide

Mobile-first, accessible, light and dark

Every page reflows down to a phone and works without a mouse, so you can fix a record from wherever you are.

Responsive everywhere: An off-canvas drawer, stacked tables and full-width dialogs on small screens.
Keyboard operable: Sortable headers are real buttons, pickers are combo boxes, dialogs trap and restore focus, and the mobile drawer is inert while closed.
WCAG AA contrast: Semantic colours used as text meet AA in both themes, every field is labelled for screen readers, and animation honours reduced-motion preferences.
Light and dark themes: Follows your system preference, with a one-tap toggle.
Live status: A header chip shows backend connectivity and sync state at a glance, naming the actual state: lagging, missing or error.

See it with your own eyes

Click around a seeded install, or have your own running in a couple of minutes.

Open the live demo Quickstart