2.1.28

A delegation fault the health check could not see, and the licence key format finished.

Fixed​

• A zone whose nameservers are CNAMEs was reported as healthy. RFC 2181 does not allow the target of an NS record to be an alias, so a resolver following the rules cannot use the answer: the zone looks dead from the internet while this server is serving it perfectly. The delegation check compared nameserver names, and the names matched, so it passed — which is the worst shape a check can have. It answered confidently about the thing that was broken and called it fine.

  There is a second check now. It asks whether each delegated nameserver can be turned into an address at all and whether it is allowed to be, and it names the remedy in the zone that holds the nameserver — not in the zone being checked, which is the part that is not obvious when an external checker points at your domain. A nameserver with no address is reported separately.

• The DNS zone table would not show the zone's own records. The SOA and the apex NS records were parsed out and dropped, so an administrator whose delegation had just failed could open the zone and not find out which nameservers it claims — the first thing that question needs. They are shown now, marked Managed rather than editable: the serial is rewritten on every save, and an apex NS edited here would disagree with the registrar rather than change it.

Changed​

• Licence keys no longer use base64. Not because it was weak — it is an encoding, not a security measure, and neither is the base32 replacing it — but because it is the wrong alphabet for something a person handles. Base64 is case-sensitive and carries +, / and =, so a key that survives a copy-paste stops surviving a support call, a spreadsheet cell or a URL. A key is now upper-case letters and digits, in groups of eight.

• A mistyped key is told apart from a forged one. Five bytes of SHA-256 end every key, so one wrong character is answered "some of it was lost on the way here, copy it again" instead of "the signature does not match". Those two send an administrator to two different places, and before this both got the same sentence.

Added​

• The vendor's key-issuing tool, and the public key both panels check against. Nothing about this changes what any existing install is: a server holding a licence key is Enterprise, one with no key is Community, and that is decided offline as before.

Notes​

Nothing to migrate. The update script runs the new nameserver check once across every zone this server hosts, so an operator with a broken delegation hears about it today rather than the next time somebody happens to open the health page for that domain. It is read-only and changes nothing — the fault it looks for is always in a zone this server has no business writing to.

Why the signature is still Ed25519. Post-quantum was measured rather than assumed. ML-DSA (FIPS 204) is in the Go release this is built with, and it makes a licence key between 4,000 and 7,500 characters — not something anybody pastes into a licence field. Ed25519 is EdDSA over SHA-512, a stronger statement than a SHA-256 digest makes on its own, and the key names its own scheme in its prefix, so moving later is a new prefix rather than a migration.