// DNS MANAGEMENT REIMAGINED
Plan, deploy, and verify DNS changes with safety guardrails that prevent disasters. ZoneRails Server runs on your own infrastructure, and your team works in it from the browser.
// ZONEOPS GUARDRAILS
Six layers of protection between you and a DNS disaster. Every guardrail works automatically — no configuration needed.
Mark critical records as protected. Prevents accidental modification or deletion with confirmation prompts.
Detects CNAME conflicts, duplicate records, and multi-value type collisions before they cause outages.
Compares expected vs. current record state. Warns you when records have been changed outside the app.
Verifies against live DNS where the record type resolves, not just the provider’s API. Confirms the change took effect before you close the ticket.
Detect orphaned tunnel DNS records, preview ingress impact, and map tunnel health across your infrastructure.
Immutable audit log of every change with before/after snapshots. One-click rollback to any previous state.
// DEPLOYMENT PIPELINE
Stop making DNS changes one record at a time. Plan your entire migration, review the diff, and deploy atomically.
Search records across all zones. Add creates, edits, and deletes to a named deployment with ticket tracking.
See every change at a glance. Run pre-flight validation — 11 checks per DNS record covering connection, zone, drift, conflicts, protected and locked records, and more. Nothing deploys by accident.
Execute all changes in one batch. Real-time per-item progress bar. Per-item success/failure reporting. Schedule for later. Full rollback with impact analysis if anything goes wrong.
Two-stage verification after every deploy: provider API read-back and live DNS resolution, content-matched per record type. Deletes verified as absence. A change isn't "Verified" until the internet actually serves it.
// ZONERAILS SERVER
One server your team opens in a browser. It turns DNS changes into a reviewed, recorded process — there is no app to install.
Six system roles with granular permissions — including Planner, which drafts deployments but can never execute, and Approver, who signs them off. Turn on required approval for four-eyes change control. Build custom roles from the full permission catalog. Every action attributed to a user with full audit trail.
LDAP/AD authentication with automatic group-to-role mapping. Users log in with their domain credentials. Roles assigned by group membership.
WebSocket push to every open browser. Deployment status, DNS changes, and cache updates broadcast instantly.
Server-side cron executes deployments during maintenance windows. No laptop required. Permissions re-checked at fire time — revoke a user and their queued deployments refuse to run. Automatic verification after execution.
Scheduled and completed deployments by day, in an agenda or a month view. Scheduled runs have a dashed outline; finished ones are coloured by result. Open one to see each change with its result, who scheduled it, and who ran it when it was run by hand. Reschedule from a dialog, or drag to another day in the month view — reschedules and cancellations are recorded in the Activity Log. A Pro feature.
DNS provider tokens encrypted at rest (AES-256-GCM). Admins configure once — all users access shared connections. No credential sharing.
An audit log of every change, with before/after snapshots and user attribution. Guardrail overrides are recorded with their written reason. The Activity Log, where you browse the log and export it to JSON, is a Pro feature.
OpenID Connect sign-in, with a preset for Microsoft Entra ID. People are provisioned on their first sign-in and get their roles from group mappings. A Pro feature.
The first sign-in opens a setup wizard: replace the installed password, add a licence, choose how people sign in, connect your first DNS provider, and set the port and HTTPS. Everything after the password can be finished later.
Terminate TLS in the server itself, or put a reverse proxy in front. Paste a certificate and key into the wizard and the server checks them first, refusing a mismatched key, an encrypted key or a chain in the wrong order with the reason.
Built-in Admin Dashboard. The web app's 07 // ADMIN tab manages users (with a live named-seat counter), roles built from the full permission catalog, AD group mappings, and shared provider connections. No additional tools required.
// PROVIDERS
Full API integration. Zones, records, and tunnels. Proxied and DNS-only records. Scoped API tokens.
Connect to Windows DNS servers via WinRM. Full record management with the same guardrails as Cloudflare.
// FEATURES
Self-host ZoneRails Server and start managing a zone from the browser immediately. No email, no license key.
One email gets your server a Pro license. Every feature unlocked for a team of five named users.
// INSTALL
Self-host it on Linux, Windows, macOS, or Docker, and your team signs in from the browser. Every installer carries its own Node.js runtime. Free to install, free to use.
x86_64 or arm64 · systemd service
DEB & RPM packages
Windows 10 / Server 2016 or later (x64)
Signed installer · Windows Service
macOS 12 or later · Apple silicon or Intel
Signed & notarized pkg
Data and logs on volumes · health checks
Docker image
Version 1.8.1 · SHA256SUMS · Release notes
Need help installing? Ask in the community
System Requirements: Linux (x86_64 or arm64, DEB- or RPM-based), Windows 10 / Server 2016 or later (x64), macOS 12 or later (Apple silicon or Intel), or Docker. No Node.js install is needed for the packages; running from source needs Node.js 18 or newer. The server must reach the Cloudflare API, or WinRM (port 5986 by default) on your AD DNS server. Your team needs only a browser.
// COMMUNITY
The ZoneRails community forum is where admins get help, report bugs and shape what comes next. Answers are public, so the next person with the same problem finds them too.
Ask about installs, upgrades, Cloudflare tokens or Active Directory DNS. The reply that fixes it is marked as the solution.
Browse Help →Something broken? The report template asks for what we need. Every report carries a public status, from needs-triage to fixed in a release.
Report a bug →Suggest what ZoneRails should do next, and vote on the ideas other admins have posted.
See requests →Licensing or private questions? [email protected]
