2.1.20

Fixed​

• BIND answered nobody but itself, so no zone this panel created ever resolved.
• A record with a typo in it took the whole zone off the air instead of being refused.

Added​

• The record types a zone actually needs: NS, DS, PTR, SSHFP, SVCB, HTTPS, NAPTR, DNAME, LOC, HINFO and RP.
• The DNSSEC DS record, shown on the DNS page where people look for it.

Notes​

A zone file was written, included from named.conf, validated, loaded, and confirmed loaded — and then the panel printed the nameservers to set at the registrar. Every one of those steps was true, and the domain still resolved for nobody: nothing had ever written named's own options block, so it kept the one the distribution shipped, which on AlmaLinux and its relatives listens on 127.0.0.1 and answers queries from localhost.

Updating rewrites those settings, reloads named, and then checks the sockets rather than the file. Recursion is confined to the machine itself instead of being switched off, so a server that resolves through 127.0.0.1 keeps working while no one on the internet can use it as a resolver; zone transfers are refused. The original configuration is kept beside itself, and one named would refuse is rolled back before named is asked to use it. Nothing touches the firewall — if port 53 is closed, the update says so.

Adding a record now builds the zone as it would be and asks named-checkzone whether it still loads, before the record is kept. A zone that was already broken is not held against the next edit.

With that check in place there is no longer a reason for a short list of record types, and the list is enforced on the server as well as offered in the form.

The DS record a signed zone produces belongs in the parent zone, not its own, which is why it was nowhere on the DNS page. It is shown there now, with where it has to go and whether the registrar has published it yet.