AD DNS delegation from search, per-zone proxy/TTL
AD DNS Improvements
- Create delegation from search — when searching for a record on an AD DNS zone, a
DELEGATE row appears alongside NEW. Double-click to open the delegation modal pre-filled with the child name
- "Create Delegation Instead" button — visible in the create form footer when the zone is AD DNS
- Per-zone proxy toggle — proxy status hidden for AD DNS zones even in multi-provider server mode (previously only checked global connection type)
- AD DNS default TTL — new records default to 300 seconds (5 minutes) instead of Auto
- Delegation child name read-only when opened from search or create form (editable when opened manually from the Delegations button)
Deployment validation, rollback, real-time progress, and UX improvements
Deployment Validation (Dry Run)
- "Validate" button — runs 8 pre-flight checks per item without making changes: connection, zone, record existence, drift, content, CNAME conflicts, duplicates, snapshot completeness
- Results modal with per-item pass/warning/error badges and expandable check details including drift current vs expected values
- Works in both server-connected and standalone modes
Deployment Rollback
- "Rollback Deployment" button on deployed/partial deployments — reverses all successful changes in reverse order
- Impact analysis modal — shows per-item risk (Safe, Modified, downstream deps, No snapshot) with clickable expandable details showing before/current/deployed state
- Downstream detection — warns if later deployments modified the same records
- ROLLED BACK / PARTIAL ROLLBACK status badges in deployment list and results view
- Atomic status guard prevents double-rollback race conditions
- Record IDs backfilled during execute so rollback can find created records
Progress & Verification
- Real-time progress bar — 3-phase: 0-50% execution (per-item), 50-60% status review (3s pause), 60-100% verification
- Cloudflare verification simplified to name+type via API (eliminates MX/SRV/CNAME content format mismatches)
- Verification timing: 6 attempts at 10 seconds (60 seconds total)
- Fix: Status cells stuck on "Pending" (DOM ID mismatch with server item IDs)
- Fix: "All records verified" false positive when count was zero
Search & UX
- Recent search history — last 10 terms cached in localStorage, shared between main and deploy search, with dropdown on focus and clear button
- Multi-provider create — when a zone exists on both Cloudflare and AD DNS, search shows one NEW row per provider
- Duplicate prevention — "In Deployment" badge on search results + blocks adding same record twice within a deployment
- Deployment items full-width table layout
- FQDN consistency — record names always stored as FQDN in deployment items
- Fix: deployment delete crashed (
deployEmpty DOM element destroyed by innerHTML)
AD DNS zone delegations — full lifecycle support
New Feature
- Zone delegations for Active Directory DNS — carve a subdomain out of a parent AD DNS zone and delegate it to external nameservers, with optional glue records. Fully supported in both standalone mode (desktop → AD DNS via WinRM) and server-connected mode (desktop → ZoneRails Server → AD DNS)
- Create / list / delete — all three operations exposed via a dedicated "Delegations" button on the DNS tab (visible only when an AD DNS connection is active)
- Create modal — repeating-row editor for nameservers, each with optional glue IP, TTL, and change-note fields; client-side validation for DNS labels, hostnames, and IPv4/IPv6 glue addresses
- List view — shows all delegations for the selected zone with their nameservers, glue IPs, and TTL; one-click delete with confirmation
Backend
- AdDnsProvider extended with
createDelegation(), listDelegations(), deleteDelegation() wrapping Add-DnsServerZoneDelegation, Get-DnsServerZoneDelegation, and Remove-DnsServerZoneDelegation over WinRM
- New server endpoints —
GET/POST/DELETE /api/dns/delegations, reusing existing dns:read/dns:create/dns:delete permissions
- Audit trail — delegation mutations logged to
audit_log with record_type = DELEGATION, preserving full before/after snapshots
- WebSocket broadcast —
delegation:changed event pushed to all connected clients
- No new tables, no migration, no new permissions — the feature slots into existing infrastructure
Full Cloudflare DNS record-type parity — 12 advanced types added
New Record Types
- 12 advanced record types added end-to-end (client + server + deployments + cache):
CERT, DNSKEY, DS, HTTPS, LOC, NAPTR, OPENPGPKEY, SMIMEA, SSHFP, SVCB, TLSA, URI
- Structured-data editor — One input per subfield for each advanced type (e.g. TLSA's
usage / selector / matching_type / certificate), with a collapsible "Edit as JSON" textarea as an escape hatch for power users
- Cloudflare docs deep-link per type beside the editor header
- Two-tier type selector —
Common and Advanced (RFC) optgroups in both the create/edit form and the deployment add-item form
Shared Registry
- Single source of truth — New
shared/record-types.js (mirrored to zonerails-server/lib/) defines every supported type's display metadata, Cloudflare data shape, DoH type number, validator, and form subfield schema
- Consumed by renderer (form + validation), main process (
buildRecordBody), server routes (buildCfBody, dohTypeNum), and deployment execution
- Removes duplication previously scattered across 6 files (HTML option lists, JS type switches, server type-number maps, docs)
Server
- Server-side validation —
POST/PUT /api/dns/records and POST /api/deployments/:id/items now validate record type and payload through the shared registry. Rejects unknown types, missing required subfields, and out-of-range numerics with HTTP 400 + structured error (previously zero validation — third-party callers had no safety net)
- Migration 004 — Adds
data_json column to deployment_items and dns_cache so advanced types roundtrip through draft → scheduled → execute and cache reads return the full Cloudflare data shape
- Deployment verification skips DoH text-match for advanced types (marks verified-by-provider instead, since Cloudflare's response is the source of truth for structured records)
- AD DNS guard — Returns HTTP 400 with a clear message if an advanced type is attempted on an Active Directory DNS connection (at the route, at deployment execution, and in the client)
Bug Fixes
- Fixed latent CAA bug in server mode — Server
buildCfBody previously dropped CAA's data object silently, breaking CAA records in server mode. Now handled through the registry end-to-end
Server-side caching, WebSocket push, deployment overhaul, hybrid auth
Server
- DNS cache service — Server caches all zones and records in SQLite with configurable background refresh (default 10 min). Clients load from cache in a single request instead of hitting Cloudflare API on every startup
- WebSocket real-time push — Server broadcasts DNS changes, deployment status transitions, and cache refreshes to all connected clients via
/ws endpoint with JWT auth
- Deployment duplicate prevention — Server rejects adding a record to a deployment if the same record is already in another active (draft/scheduled) deployment. Returns 409 with conflict details
- Locked records endpoint —
GET /api/deployments/locked-records returns all records in active deployments so clients can show scheduled/draft badges
- Hybrid authentication — Local accounts always work, AD login used as fallback when configured. Local admin can still log in even with
auth.type: "active-directory"
- User CRUD endpoints — Create local users, change passwords, delete users via
POST/PUT/DELETE /api/admin/users
- Connected client tracking —
ws_clients table tracks all WebSocket connections with user, IP, and heartbeat. Viewable via GET /api/admin/ws-clients
- DNS verification via Cloudflare DoH — Proxied records verified via Cloudflare API (since DNS resolves to proxy IPs). Non-proxied records verified via DNS-over-HTTPS at
cloudflare-dns.com
- AD DNS cache filtering — System zones (
_msdcs, TrustAnchors, RootDNSServers) excluded from cache
- Server web UI — User management (create, delete, reset password, enable/disable), AD group-to-role mapping, all in the admin dashboard
Desktop Client
- Server-mode caching —
load-data uses single GET /api/dns/cached/all request instead of multi-connection API loop. Local cache fallback when server unreachable
- WebSocket event handling — Auto-reloads data on
cache:refreshed, record:changed, and deployment:status events
- Provider column + filter — Search results show CF/AD badge per record. Provider dropdown filter (hidden when single provider)
- Scheduled/draft lock badges — Records in active deployments show "Scheduled" or "In Draft" badge in search results
- Deploy search parity — Deploy tab search now has provider filter, pagination, tunnel badges, and lock badges matching Tab 1
- Deployment status filter — Dropdown to filter deployment list by status (draft, scheduled, deployed, failed, etc.)
- Deployment results view — Click a deployed/failed deployment to see per-item results and verification status
- Auto-verify after deployment — DNS propagation verification runs automatically (5 attempts over ~45 seconds) after execution
- Deployment note field — Optional note on the deployment itself (alongside name and ticket number)
- CAA record support in deploy form — Flags, tag, and CA domain fields for CAA records in the deployment add-item form
- Record validation in deploy form —
validateRecord() checks content format per record type before adding to deployment
- Refresh button on deploy tab — Reloads all zones and records from the deploy list view
- Cart-to-deployment rename — All internal references renamed from "cart" to "deployment" across client codebase
- Admin tab removed from client — User management moved to server web UI
Bug Fixes
- Fixed cart ID overwrite in
openDeploymentDetail causing "Add Edit/Delete to Deployment" buttons to do nothing
- Fixed
beforeSnapshot double-serialization (JSON.stringify in main.js + server route)
- Fixed foreign key constraint on
connection_id when adding deployment items in server mode
- Fixed deployment name not updating when clicking "Back to Deployments"
- Fixed deployment items table floating in middle of page (
justify-content: center on column flex)
- Fixed
Object.assign(dep, result.deployment) overwriting client-side deployment ID, breaking verify button
- Fixed foreign key constraint on deployment delete (audit_log references)
- Fixed verify endpoint using system DNS resolver for Cloudflare records (now uses DoH/API)
Connectors tab, in-app Pro modal, UI improvements
- Connectors tab — Full Cloudflare Tunnel management: create/delete tunnels, view connectors, manage ingress rules, routes, and virtual networks
- In-app Pro upgrade modal — Feature-gated UI with upgrade prompts for Pro-only features
- License activation flow — In-app license key entry, activation, and deactivation
- UI polish and layout improvements across all tabs
ZoneRails Server, multi-user support, Active Directory DNS
ZoneRails Server
- Multi-user DNS management backend — Node.js + Express + SQLite server with JWT authentication
- Role-based access control — Admin, Operator, Deployer, Viewer roles with granular permissions
- Active Directory integration — LDAP authentication with automatic group-to-role mapping
- Deployment scheduling — Server-side cron executes deployments at scheduled times
- Admin web dashboard — Web UI for user management, roles, connections, and license management
- Server licensing — Server-level license with client seat limits and activation workflow
- Installation packages — Linux (systemd), Docker (compose), and Windows (service) deployment options
Desktop Client
- Server mode — Connect desktop client to ZoneRails Server for shared DNS management
- Active Directory DNS provider — Manage Windows DNS servers via WinRM alongside Cloudflare
- Deploy tab — Batch DNS change planning, execution, and verification
- Auto-reconnect — Saved server credentials encrypted and restored on app restart
Cloudflare DNS management with ZoneOps guardrails
- DNS record management — Search, create, edit, delete across all Cloudflare zones
- 9 record types — A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, PTR
- Multi-token support — Store and switch between multiple Cloudflare API tokens
- ZoneOps guardrails — Record protection, conflict detection, drift detection, propagation verification
- Tunnel guardrails — Orphaned DNS record detection, tunnel health mapping, ingress conflict prevention
- Activity log — Full audit trail with before/after snapshots and one-click rollback
- Audit auto-archive — Oldest entries archived to JSON when log exceeds limit
- Token inspection — View token permissions, expiration, and account details
- Cross-platform — macOS (Intel + Apple Silicon) and Windows (x64)
- Secure storage — API tokens encrypted via OS keychain (macOS Keychain / Windows Credential Manager)
ZoneRails · © 2026 A Holdings Company LLC · Home · Docs