Compare
A modern alternative to PowerDNS-Admin
PowerDNS-Admin is the long-standing community web UI for PowerDNS. PowerDNS-AuthAdmin is a separate project, written from scratch in TypeScript, for teams that run several backends, sign in through an identity provider and need to show who changed what.
What PowerDNS-AuthAdmin is
PowerDNS-AuthAdmin is a free, MIT-licensed web interface for PowerDNS Authoritative. It talks to PowerDNS through its built-in HTTP API, so your zones and records stay where they are. On top it adds what multi-person DNS operations need: scoped role-based access control, single sign-on, passkeys, a diff-before-apply editor, cluster and secondary awareness, an append-only audit log, and an MCP server so an AI assistant can make changes under the same rules.
It is not a fork. It is a clean-sheet build on Node.js 24, Next.js and TypeScript in strict mode, shipped as one container image (ghcr.io/powerdns-authadmin/powerdns-authadmin) and tested in CI against PowerDNS 4.6 to 5.0.
Checklist
What to look for in a PowerDNS web UI
The questions teams ask when choosing an admin interface, and how PowerDNS-AuthAdmin answers each one.
| Requirement | PowerDNS-AuthAdmin |
|---|---|
| Access scoped to one zone | Assign any role globally, to a team, to a single zone or to a single server. SOA, apex NS and zone settings are separate permissions. |
| Your identity provider | OIDC (PKCE, RP-initiated logout), SAML 2.0 and LDAP / Active Directory, each with group → role mapping on every sign-in. |
| Phishing-resistant MFA | WebAuthn passkeys and hardware security keys, or TOTP. Roles can require MFA. |
| Safe edits | Per-type validation, a BIND-style diff before every write and optimistic concurrency per RRset. |
| More than one backend | Standalone primaries, primary + secondaries and multi-primary clusters, with sync probes and health advisories. |
| A trail for auditors | Append-only log with redacted before / after snapshots, the PowerDNS request trail and CSV export. |
| AI assistants | A built-in MCP server: Claude Code, Codex, Cursor or any MCP client manages records in natural language, limited to a token's scopes and written to the audit log. |
| Automation | A full admin API with scoped personal access tokens, Prometheus metrics and first-boot YAML provisioning. |
| Operations | One Docker image on SQLite or Postgres, Postgres + Redis for HA, no telemetry and no CDN. |
Switching
How to move to PowerDNS-AuthAdmin
No zone migration is needed. The admin UI is a client of the PowerDNS API, so you can run it next to your current tool and switch when you're ready.
Deploy alongside
Start PowerDNS-AuthAdmin with Docker Compose next to what you run today. It only needs network access to the PowerDNS Authoritative HTTP API. Installation guide.
Register your backends
Add each PowerDNS server with its API URL and key, or group them into clusters and primary + secondaries. Your existing zones appear straight away because they live in PowerDNS, not in the admin UI.
Connect sign-in
Point it at your OIDC, SAML or LDAP provider and map groups to roles, or create local accounts. RBAC guide.
Recreate access rules
Users, roles, teams and API tokens are not imported from other tools. Define them in the UI or in a provisioning.yaml so the setup is reviewable and repeatable.
Switch over
Once your team works in PowerDNS-AuthAdmin, retire the old UI. Edits made by any other client show up live, so running both during the transition is fine.
Is it the right fit?
If a single shared admin login on one PowerDNS server covers your needs and your current UI does the job, you may not need to change anything. PowerDNS-AuthAdmin earns its place when more people, more backends or more scrutiny come into play: delegating zones to customers or teams, enforcing SSO and MFA, operating clusters and secondaries, or answering audit requests.
The quickest way to decide is to click around the live demo, then read the FAQ.
Up and running in minutes
One image, one compose file, your existing PowerDNS.