From 13ffd8cad43bb15ba6fb722b77c9252fe955740e Mon Sep 17 00:00:00 2001
From: adam <adam@adbraun.lol>
Date: Mon, 12 Oct 2026 20:46:56 +0100
Subject: [PATCH] Encrypted DNS health, comparing a zone's views, --local
 everywhere

jarld checks the DoT and DoH listeners every 10 minutes as a client would (page, dashboard, jarl encrypted-dns health, jarl_encrypted_dns_up). The Compare views tab and jarl zone diff show what differs between a zone's views, with Use this version. --local works on unlinked zones. A changed certificates.dir is followed by encrypted DNS's tls statements. Sharing an already shared version replaces other views' overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitignore                                    |   2 +
 CHANGELOG.md                                  |  28 +++
 cmd/jarl/encdns.go                            |  72 +++++-
 cmd/jarl/zones.go                             |  89 +++++++-
 docs/api.md                                   |   1 +
 docs/certificates.md                          |   5 +-
 docs/cli.md                                   |   2 +
 docs/encrypted-dns.md                         |  26 +++
 docs/metrics.md                               |   6 +
 docs/views.md                                 |  17 ++
 internal/api/types.go                         |  14 ++
 internal/certs/certs_test.go                  |  32 +++
 internal/certs/manager.go                     |  35 +++
 internal/encdns/encdns.go                     |  12 +-
 internal/encdns/health.go                     | 208 ++++++++++++++++++
 internal/encdns/health_test.go                | 115 ++++++++++
 internal/engine/compare.go                    | 104 +++++++++
 internal/engine/expand.go                     |  29 ++-
 internal/engine/linked_test.go                |  56 +++++
 internal/server/h_changes.go                  |  15 ++
 internal/server/h_compare.go                  |  89 ++++++++
 internal/server/h_encdns.go                   |  84 +++++++
 internal/server/metrics.go                    |   7 +
 internal/server/present.go                    |   7 +
 internal/server/routes.go                     |   2 +
 internal/server/server.go                     |  18 ++
 internal/web/static/assets/pages/dashboard.js |   6 +
 internal/web/static/assets/pages/encdns.js    |  28 ++-
 internal/web/static/assets/pages/zone.js      |  36 +++
 internal/web/static/assets/style.css          |  10 +
 scripts/e2e.sh                                |  16 ++
 31 files changed, 1153 insertions(+), 18 deletions(-)
 create mode 100644 internal/encdns/health.go
 create mode 100644 internal/encdns/health_test.go
 create mode 100644 internal/engine/compare.go
 create mode 100644 internal/server/h_compare.go

diff --git a/.gitignore b/.gitignore
index e3ce933..7bc577c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,5 @@
 *.db
 *.db-wal
 *.db-shm
+/jarl
+/jarld
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6dbca86..6bc12a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,34 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Added
+
+- Encrypted DNS health: jarld checks the DoT and DoH listeners every 10
+  minutes as a client would (the certificate is for the host name,
+  current and the one Jarl last wrote; a question gets an answer) and
+  says what is wrong: nothing listening, a firewall, the wrong or an
+  older certificate. On the Encrypted DNS page (Check now), the
+  dashboard, `jarl encrypted-dns health` and Prometheus
+  `jarl_encrypted_dns_up`.
+- Comparing a zone's views: the Compare views tab and `jarl zone diff`
+  show the names and types that differ between the views that have a
+  zone, linked or not, with "Use this version" to share one view's
+  version. `GET /zones/{zone}/compare`.
+
+### Changed
+
+- `--local` (and `"local": true`) works on zones that aren't linked too:
+  their records are local anyway. `--shared` there is still refused.
+- When `certificates.dir` changes, jarld points the `tls` statements
+  encrypted DNS wrote at the new place when it starts; named kept the old
+  copies before, which renewals no longer updated.
+
+### Fixed
+
+- Sharing a view's version of a name that was shared already (Use this
+  version on the shared side) didn't replace another view's override; it
+  said there was nothing to do.
+
 ## [0.5.0] - 2026-10-12
 
 ### Upgrading from 0.4
diff --git a/cmd/jarl/encdns.go b/cmd/jarl/encdns.go
index b6bad94..77bcb7d 100644
--- a/cmd/jarl/encdns.go
+++ b/cmd/jarl/encdns.go
@@ -6,6 +6,7 @@ import (
 	"io"
 	"net/url"
 	"strings"
+	"time"
 
 	"github.com/spf13/cobra"
 )
@@ -24,6 +25,7 @@ type encStatus struct {
 	DoT         []encEndpoint `json:"dot"`
 	DoH         []encEndpoint `json:"doh"`
 	Other       bool          `json:"other"`
+	Health      *encHealth    `json:"health"`
 	Addresses   []struct {
 		Address string `json:"address"`
 		Private bool   `json:"private"`
@@ -99,6 +101,9 @@ views.`,
 						fmt.Fprintf(w, "For DoH clients:\t%s   (Firefox, Chrome, Windows 11)\n", s.DoHURL)
 					}
 				}
+				if s.Enabled {
+					printHealth(w, s.Health)
+				}
 				if s.Other {
 					fmt.Fprintln(w, "Note:\tnamed has DoT or DoH listeners written by hand too; setup leaves them alone")
 				}
@@ -308,7 +313,38 @@ replaces the earlier setup.`,
 			return report(resp)
 		},
 	}
-	cmd.AddCommand(setup, check, disable)
+	health := &cobra.Command{
+		Use:   "health",
+		Short: "Check the DoT and DoH listeners now, as a client would",
+		Long: `Connects to each listener, checks the certificate it serves (for the
+host name, current, the one Jarl last wrote) and asks a question. jarld
+also does this every 10 minutes; the dashboard and Prometheus
+(jarl_encrypted_dns_up) show the result. Exits 1 when a listener doesn't
+work.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			var h encHealth
+			if err := c.Do(ctx(), "POST", "/encrypted-dns/health", nil, map[string]any{}, &h); err != nil {
+				return err
+			}
+			if err := output(h, func(w io.Writer) { printHealth(w, &h) }); err != nil {
+				return err
+			}
+			ok := true
+			for _, p := range h.Probes {
+				ok = ok && p.OK
+			}
+			if !ok {
+				return errors.New("encrypted DNS isn't working everywhere")
+			}
+			return nil
+		},
+	}
+	cmd.AddCommand(setup, check, disable, health)
 	return cmd
 }
 
@@ -337,3 +373,37 @@ func contains(list []string, s string) bool {
 	}
 	return false
 }
+
+type encHealth struct {
+	Checked time.Time `json:"checked"`
+	Probes  []struct {
+		Kind    string `json:"kind"`
+		Address string `json:"address"`
+		Port    int    `json:"port"`
+		OK      bool   `json:"ok"`
+		Problem string `json:"problem"`
+		Warning string `json:"warning"`
+		RCode   string `json:"rcode"`
+		Ms      int64  `json:"ms"`
+	} `json:"probes"`
+}
+
+func printHealth(w io.Writer, h *encHealth) bool {
+	if h == nil {
+		fmt.Fprintln(w, "Health:\tnot checked yet (jarl encrypted-dns health)")
+		return true
+	}
+	ok := true
+	for _, p := range h.Probes {
+		kind := map[string]string{"dot": "DoT", "doh": "DoH"}[p.Kind]
+		state := fmt.Sprintf("working (%s in %d ms)", p.RCode, p.Ms)
+		if !p.OK {
+			state, ok = "NOT WORKING: "+p.Problem, false
+		} else if p.Warning != "" {
+			state += "; " + p.Warning
+		}
+		fmt.Fprintf(w, "%s %s port %d:\t%s\n", kind, p.Address, p.Port, state)
+	}
+	fmt.Fprintf(w, "Checked:\t%s\n", h.Checked.Local().Format("2006-01-02 15:04:05"))
+	return ok
+}
diff --git a/cmd/jarl/zones.go b/cmd/jarl/zones.go
index be6dc80..031936a 100644
--- a/cmd/jarl/zones.go
+++ b/cmd/jarl/zones.go
@@ -424,7 +424,7 @@ equal to the file: records not in the file are deleted.`,
 	importCmd.Flags().BoolVar(&replace, "replace", false, "delete records that are not in the file")
 	importCmd.Flags().BoolVar(&useSOA, "use-soa", false, "also take SOA timers and $TTL from the file")
 
-	cmd.AddCommand(list, show, create, update, del, toggle(true), toggle(false), fileCmd, importCmd, zoneSerialsCmd(), zoneDelegationCmd(), zoneDNSSECCmd(), zoneRegistrarCmd(), zoneLinkCmd(true), zoneLinkCmd(false))
+	cmd.AddCommand(list, show, create, update, del, toggle(true), toggle(false), fileCmd, importCmd, zoneSerialsCmd(), zoneDelegationCmd(), zoneDNSSECCmd(), zoneRegistrarCmd(), zoneLinkCmd(true), zoneLinkCmd(false), zoneDiffCmd())
 	return cmd
 }
 
@@ -937,3 +937,90 @@ zone is dissolved.`
 	cmd.Example = "  jarl zone unlink adbraun.lol --view vps"
 	return cmd
 }
+
+// zoneDiffCmd is 'zone diff': a zone's records side by side in the views
+// that have it.
+func zoneDiffCmd() *cobra.Command {
+	var views []string
+	var all bool
+	cmd := &cobra.Command{
+		Use:   "diff ZONE [--view V --view W] [--all]",
+		Short: "Show what differs between the views that have a zone",
+		Long: `Lines up a zone's records in the views that have it (or the views
+given), one row per name and type, and shows the ones that differ: a
+local override in a linked zone, a record one view lacks. With --all, the
+ones that are the same too. In a linked zone, 'jarl record update ID
+--shared' makes a view's version every view's.`,
+		Example: `  jarl zone diff adbraun.lol
+  jarl zone diff adbraun.lol --view internal --view external --all`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			c, err := newClient()
+			if err != nil {
+				return err
+			}
+			path, qv := zonePath(args[0], "")
+			if len(views) > 0 {
+				qv.Set("views", strings.Join(views, ","))
+			}
+			if all {
+				qv.Set("all", "1")
+			}
+			var r struct {
+				Zone   string   `json:"zone"`
+				Views  []string `json:"views"`
+				Linked bool     `json:"linked"`
+				Same   int      `json:"same"`
+				Rows   []struct {
+					Name  string `json:"name"`
+					Type  string `json:"type"`
+					Same  bool   `json:"same"`
+					Views []struct {
+						Records []string `json:"records"`
+						IDs     []int64  `json:"ids"`
+						Linked  string   `json:"linked"`
+					} `json:"views"`
+				} `json:"rows"`
+			}
+			if err := c.Get(ctx(), path+"/compare", qv, &r); err != nil {
+				return err
+			}
+			return output(r, func(w io.Writer) {
+				head := []string{"NAME", "TYPE"}
+				for _, v := range r.Views {
+					head = append(head, strings.ToUpper(v))
+				}
+				fmt.Fprintln(w, strings.Join(head, "\t"))
+				for _, row := range r.Rows {
+					cols := []string{row.Name, row.Type}
+					for _, vs := range row.Views {
+						cell := "-"
+						if len(vs.Records) > 0 {
+							cell = strings.Join(vs.Records, ", ")
+							if vs.Linked == "local" {
+								cell += " [local, id " + fmt.Sprint(vs.IDs[0]) + "]"
+							}
+						}
+						cols = append(cols, cell)
+					}
+					fmt.Fprintln(w, strings.Join(cols, "\t"))
+				}
+				link := "not linked (jarl zone link " + r.Zone + ")"
+				if r.Linked {
+					link = "linked"
+				}
+				fmt.Fprintf(w, "\n%d names and types differ, %d are the same; %s\n", len(r.Rows)-boolCount(all, r.Same), r.Same, link)
+			})
+		},
+	}
+	cmd.Flags().StringArrayVar(&views, "view", nil, "a view to compare (repeat; default: every view with the zone)")
+	cmd.Flags().BoolVar(&all, "all", false, "also show what is the same everywhere")
+	return cmd
+}
+
+func boolCount(b bool, n int) int {
+	if b {
+		return n
+	}
+	return 0
+}
diff --git a/docs/api.md b/docs/api.md
index f048737..133f3a2 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -353,6 +353,7 @@ and `linked_with` (the other views).
 |--------|------|------|
 | POST | `/zones/{zone}/link` | `{"with": ["external"]}` (default: every view with that zone). Names and types that are the same everywhere become shared, the rest stay local |
 | POST | `/zones/{zone}/unlink` | Takes the zone out of its link; its records stay, all local |
+| GET | `/zones/{zone}/compare` | The zone across the views that have it (`?views=a,b`; `?all=1` also the same rows): `views`, `linked`, `same` (count) and `rows` (name, type, `same`, per view `records`, `ids`, `linked`). The zone may be named without a view |
 
 `POST /zones` takes `"link_with": "VIEW"` to create a zone linked with
 that view's zone of the same name.
diff --git a/docs/certificates.md b/docs/certificates.md
index 28a8168..ec1a852 100644
--- a/docs/certificates.md
+++ b/docs/certificates.md
@@ -193,7 +193,10 @@ jarl option set listen-on 'port 853 tls dot { 10.0.10.5; }' --add
 ```
 
 A certificate named uses can't be deleted or lose its `dns` use until
-named no longer names its files.
+named no longer names its files. If you change `certificates.dir`, jarld
+writes the certificates to the new place when it starts and points the
+`tls` statements encrypted DNS wrote there (a hand-written `tls`
+statement you change yourself).
 
 ## A certificate you renew yourself
 
diff --git a/docs/cli.md b/docs/cli.md
index 5c7a1db..91425fc 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -221,6 +221,7 @@ jarl zone unlink adbraun.lol --view vps
 jarl record add adbraun.lol nas A 10.0.10.20 --view internal --local   # this view only
 jarl record set adbraun.lol www A 10.0.10.5 --view internal --local    # override the shared www A here
 jarl record update 1234 --local | --shared
+jarl zone diff adbraun.lol [--view V --view W] [--all]                 # what differs between the views
 ```
 
 When a zone exists in several views, add `--view NAME` to commands that
@@ -417,6 +418,7 @@ See [exposure.md](exposure.md).
 jarl encrypted-dns                                   # what is set up, what to give clients
 jarl encrypted-dns setup --hostname dns.adbraun.lol --address 10.0.10.5 [--address IPv6] [--doh-port 8443] [--no-doh]
 jarl encrypted-dns check --address 10.0.10.5 --doh-port 443
+jarl encrypted-dns health                            # check the listeners now, as a client would
 jarl encrypted-dns disable
 ```
 
diff --git a/docs/encrypted-dns.md b/docs/encrypted-dns.md
index 10c60dc..74bfe32 100644
--- a/docs/encrypted-dns.md
+++ b/docs/encrypted-dns.md
@@ -113,6 +113,31 @@ Clients check the certificate against the host name, so the name must
 resolve to this server for them: the setup adds it to your private views.
 Open the ports in the server's firewall for your own networks only.
 
+## Health
+
+jarld checks the listeners itself, a minute after it starts and then
+every 10 minutes, the way a client would: it connects to each, checks the
+certificate named serves (for the host name, current, and the one Jarl
+last wrote, so a renewal named hasn't reread shows up) and asks for the
+host name. The Encrypted DNS page shows the result per listener (**Check
+now** checks again), the dashboard a card and the problems, Prometheus
+`jarl_encrypted_dns_up{kind,address,port}`:
+
+```sh
+jarl encrypted-dns health        # check now; exit 1 when a listener doesn't work
+```
+
+What it can say:
+
+| | |
+|--|--|
+| nothing listens on ADDR port P | named couldn't bind the port: look in named's log (ports below 1024 need named to start as root, as the Debian service does) |
+| no answer within 5s | a firewall on the server |
+| a certificate for X, not HOST | named serves another certificate |
+| an older certificate | named hasn't reread the renewed files (`rndc reconfig`) |
+| not from a CA this server trusts (warning) | a staging or test CA: clients reject it unless they trust it |
+| REFUSED (warning) | it works, but this server's own address gets a view that doesn't answer for the host name |
+
 ## What Jarl checks
 
 * A `tls` statement whose files don't exist is an error
@@ -129,3 +154,4 @@ Open the ports in the server's firewall for your own networks only.
 | POST | `/encrypted-dns/check` | `{"addresses", "dot", "doh", "dot_port", "doh_port"}`: `conflicts` (address, port, what) and `free_doh_port` |
 | POST | `/encrypted-dns` | `{"hostname", "certificate", "addresses", "dot", "doh", "dot_port", "doh_port", "views"}`: staged or applied like any change; 409 while the certificate hasn't been obtained |
 | DELETE | `/encrypted-dns` | Turns it off |
+| POST | `/encrypted-dns/health` | Checks the listeners now: `checked`, `probes` (kind, address, port, `ok`, `problem`, `warning`, certificate names, expiry and serial, `trusted`, `rcode`, `ms`). `GET /encrypted-dns` has the last check as `health` |
diff --git a/docs/metrics.md b/docs/metrics.md
index 6414207..c344e8c 100644
--- a/docs/metrics.md
+++ b/docs/metrics.md
@@ -132,6 +132,7 @@ same values.
 | `jarl_certificate_expiry_timestamp_seconds{certificate,source}` | When each certificate Jarl manages expires ([certificates.md](certificates.md)). |
 | `jarl_certificate_failing{certificate,source}` | 1 when obtaining (or reading) the certificate failed the last time, or it has expired. |
 | `jarl_certificate_renewal_failures{certificate}` | Failed attempts to obtain a certificate since its last success. |
+| `jarl_encrypted_dns_up{kind,address,port}` | 1 when the DoT or DoH listener answered with the right, current certificate at the last check ([encrypted-dns.md](encrypted-dns.md#health)). |
 
 ### Queries (with `stats.enabled`)
 
@@ -232,6 +233,11 @@ groups:
         expr: jarl_certificate_expiry_timestamp_seconds - time() < 10 * 86400
         annotations:
           summary: "Certificate {{ $labels.certificate }} expires within 10 days"
+      - alert: EncryptedDNSDown
+        expr: jarl_encrypted_dns_up == 0
+        for: 20m
+        annotations:
+          summary: "DNS over {{ $labels.kind }} on {{ $labels.address }} port {{ $labels.port }} isn't working (see the Encrypted DNS page)"
       - alert: BlockingPausedForLong
         expr: jarl_blocking_paused == 1
         for: 24h
diff --git a/docs/views.md b/docs/views.md
index 153071c..0a1c600 100644
--- a/docs/views.md
+++ b/docs/views.md
@@ -209,6 +209,23 @@ each view (Jarl lists them). Share the right version afterwards. Unlinking
 keeps every record, all local; a link left with one zone is dissolved, as
 when the other zone is deleted.
 
+**Comparing the views.** The zone's **Compare views** tab, or `jarl zone
+diff adbraun.lol`, lines the views up and shows each name and type that
+differs: a view's own records, or a name one view lacks. **Use this
+version** (`jarl record update ID --shared`) makes one view's version
+every view's. It works for zones that aren't linked too, to see what
+linking them would keep local.
+
+```
+$ jarl zone diff adbraun.lol
+NAME  TYPE  INTERNAL                    EXTERNAL
+nas   A     10.0.10.20 [local, id 812]  203.0.113.20 [local, id 790]
+5 names and types differ, 21 are the same; linked
+```
+
+`--local` also works on a zone that isn't linked (its records are local
+anyway), so scripts don't need to know; `--shared` there is refused.
+
 **Permissions** are checked in every view a change reaches. A token with
 a grant for one view only (`views=internal`) can change that view's local
 records and make overrides, but not a shared record, since that would
diff --git a/internal/api/types.go b/internal/api/types.go
index b997e20..98dcb1c 100644
--- a/internal/api/types.go
+++ b/internal/api/types.go
@@ -34,6 +34,9 @@ type Zone struct {
 	LinkedWith []string `json:"linked_with,omitempty"`
 	// Links are the zones this one is linked with, with their views.
 	Links []ZoneLink `json:"links,omitempty"`
+	// OtherViews are the other views with a primary zone of this name
+	// (linked or not): what GET /zones/{zone}/compare compares.
+	OtherViews []string `json:"other_views,omitempty"`
 	// Pending is set when listing with a changeset: add, change or delete.
 	Pending string `json:"pending,omitempty"`
 }
@@ -266,6 +269,9 @@ type StatusResponse struct {
 	// Certificates sums up the TLS certificates Jarl manages
 	// (administrators only, when there are any).
 	Certificates *CertSummary `json:"certificates,omitempty"`
+	// EncryptedDNS is the last check of DNS over TLS and HTTPS, when it
+	// is set up (for those who may see options).
+	EncryptedDNS *EncDNSSummary `json:"encrypted_dns,omitempty"`
 }
 
 // CertSummary is what the dashboard reports about certificates.
@@ -575,3 +581,11 @@ type ZoneLink struct {
 	ID   int64  `json:"id"`
 	View string `json:"view"`
 }
+
+// EncDNSSummary is what the dashboard says about encrypted DNS.
+type EncDNSSummary struct {
+	Checked  time.Time `json:"checked"`
+	OK       bool      `json:"ok"`
+	Problems []string  `json:"problems"`
+	Warnings []string  `json:"warnings"`
+}
diff --git a/internal/certs/certs_test.go b/internal/certs/certs_test.go
index c830020..3fd9484 100644
--- a/internal/certs/certs_test.go
+++ b/internal/certs/certs_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/miekg/dns"
 
 	"jarl/internal/auth"
+	"jarl/internal/encdns"
 	"jarl/internal/engine"
 	"jarl/internal/model"
 	"jarl/internal/porkbun"
@@ -488,3 +489,34 @@ func TestCleanLegoError(t *testing.T) {
 		t.Errorf("rate limit: %s", got)
 	}
 }
+
+// When certificates.dir changes, Start writes the certificates to the new
+// place and points encrypted DNS's tls statement there.
+func TestDirChangeFollowed(t *testing.T) {
+	e := newEnv(t, false)
+	ctx := context.Background()
+	admin := &auth.Principal{User: &model.User{Username: "admin", Admin: true}}
+	now := time.Now()
+	certFile, keyFile := filepath.Join(e.dir, "c.pem"), filepath.Join(e.dir, "k.pem")
+	cert, key := makeCert(t, []string{"dns.example.com"}, now.Add(-time.Hour), now.Add(60*24*time.Hour), true)
+	os.WriteFile(certFile, cert, 0o600)
+	os.WriteFile(keyFile, key, 0o600)
+	if _, err := e.m.Create(ctx, Input{Name: model.Ptr("dns"), Source: model.Ptr("file"), CertFile: &certFile, KeyFile: &keyFile, Uses: &[]string{"dns"}}, admin); err != nil {
+		t.Fatal(err)
+	}
+	e.submit(engine.NewRequest(engine.OpOptionCreate, 0, engine.OptionInput{Scope: model.Ptr(model.ScopeTopLevel), Name: model.Ptr("tls"), Value: model.Ptr(encdns.TLSValue("dns", e.m.cfg.Dir))}))
+
+	moved := filepath.Join(e.dir, "tls-moved")
+	cfg := e.m.cfg
+	cfg.Dir = moved
+	m2 := New(cfg, e.st, e.eng, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	m2.Start(ctx)
+	if _, err := os.Stat(filepath.Join(moved, "dns", ChainFile)); err != nil {
+		t.Fatalf("not written to the new place: %v", err)
+	}
+	for _, o := range e.state().ScopedOptions(model.ScopeTopLevel, 0) {
+		if o.Name == "tls" && !strings.Contains(o.Value, moved+"/dns/fullchain.pem") {
+			t.Errorf("tls statement still points elsewhere: %s", o.Value)
+		}
+	}
+}
diff --git a/internal/certs/manager.go b/internal/certs/manager.go
index 767889e..133d3e6 100644
--- a/internal/certs/manager.go
+++ b/internal/certs/manager.go
@@ -22,6 +22,7 @@ import (
 	legolog "github.com/go-acme/lego/v4/log"
 
 	"jarl/internal/auth"
+	"jarl/internal/encdns"
 	"jarl/internal/engine"
 	"jarl/internal/model"
 	"jarl/internal/porkbun"
@@ -766,6 +767,40 @@ func (m *Manager) Start(ctx context.Context) {
 			}
 		}
 	}
+	m.followDir(ctx, all)
+}
+
+// followDir points the tls statements encrypted DNS wrote (jarl-NAME) at
+// certificates.dir when it has changed: Start has just written the
+// certificates there, and named would otherwise keep serving the old
+// copies, which renewals no longer update.
+func (m *Manager) followDir(ctx context.Context, all []*model.Certificate) {
+	st, err := m.store.LoadState(ctx)
+	if err != nil {
+		return
+	}
+	var reqs []engine.Request
+	for _, b := range encdns.TLSBlocks(st) {
+		name, ok := strings.CutPrefix(b.Name, encdns.Prefix)
+		if !ok || filepath.Dir(b.CertFile) == m.FilesDir(name) {
+			continue
+		}
+		i := slices.IndexFunc(all, func(c *model.Certificate) bool { return c.Name == name })
+		if i < 0 || !all[i].HasUse(model.CertUseDNS) {
+			continue
+		}
+		if _, err := os.Stat(filepath.Join(m.FilesDir(name), ChainFile)); err != nil {
+			continue // not written there (yet)
+		}
+		reqs = append(reqs, engine.NewRequest(engine.OpOptionUpdate, b.OptionID, engine.OptionInput{Value: model.Ptr(encdns.TLSValue(name, m.cfg.Dir))}))
+		m.log.Info("certificates.dir changed: pointing named at the new files", "tls", b.Name, "was", filepath.Dir(b.CertFile), "now", m.FilesDir(name))
+	}
+	if len(reqs) == 0 {
+		return
+	}
+	if _, err := m.eng.Submit(ctx, reqs, auth.System, "jarld", "certificates.dir changed: tls statements follow it", engine.ApplyOptions{}); err != nil {
+		m.log.Error("pointing named at the moved certificate files failed; run 'jarl encrypted-dns setup' again", "err", err)
+	}
 }
 
 // Run renews certificates when they are due and rereads file-source ones
diff --git a/internal/encdns/encdns.go b/internal/encdns/encdns.go
index ecbfd51..030da1b 100644
--- a/internal/encdns/encdns.go
+++ b/internal/encdns/encdns.go
@@ -272,9 +272,7 @@ func Plan(st *model.State, s Setup, certDir string) ([]engine.Request, []string,
 		return nil, nil, fmt.Errorf("choose at least one address to listen on")
 	}
 	tlsName := Prefix + s.Certificate
-	dir := filepath.Join(certDir, s.Certificate)
-	tlsValue := fmt.Sprintf(`%s { cert-file "%s"; key-file "%s"; protocols { TLSv1.2; TLSv1.3; }; }`,
-		tlsName, filepath.Join(dir, "fullchain.pem"), filepath.Join(dir, "privkey.pem"))
+	tlsValue := TLSValue(s.Certificate, certDir)
 
 	var reqs []engine.Request
 	// Take out the earlier setup's listeners and tls statements.
@@ -393,3 +391,11 @@ func Private(a netip.Addr) bool {
 	a = a.Unmap()
 	return a.IsPrivate() || a.IsLoopback() || a.IsLinkLocalUnicast() || netip.MustParsePrefix("100.64.0.0/10").Contains(a)
 }
+
+// TLSValue is the tls statement the setup writes for a certificate whose
+// files are in certDir/NAME.
+func TLSValue(cert, certDir string) string {
+	dir := filepath.Join(certDir, cert)
+	return fmt.Sprintf(`%s { cert-file "%s"; key-file "%s"; protocols { TLSv1.2; TLSv1.3; }; }`,
+		Prefix+cert, filepath.Join(dir, "fullchain.pem"), filepath.Join(dir, "privkey.pem"))
+}
diff --git a/internal/encdns/health.go b/internal/encdns/health.go
new file mode 100644
index 0000000..8de4d2f
--- /dev/null
+++ b/internal/encdns/health.go
@@ -0,0 +1,208 @@
+package encdns
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+// Probe is the outcome of checking one DoT or DoH listener the way a
+// client would: connect, check the certificate, ask a question.
+type Probe struct {
+	Kind    string `json:"kind"` // dot or doh
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+	// OK: it answered over TLS with a certificate for the host name that
+	// is current. Problem says what is wrong when not; Warning notes
+	// something that doesn't stop clients from working everywhere.
+	OK      bool   `json:"ok"`
+	Problem string `json:"problem,omitempty"`
+	Warning string `json:"warning,omitempty"`
+	// What the certificate named served says.
+	CertNames    []string   `json:"cert_names,omitempty"`
+	CertNotAfter *time.Time `json:"cert_not_after,omitempty"`
+	CertSerial   string     `json:"cert_serial,omitempty"`
+	// Trusted: it chains to a CA this server trusts (not so for a
+	// staging or test CA).
+	Trusted bool   `json:"trusted"`
+	RCode   string `json:"rcode,omitempty"`
+	Millis  int64  `json:"ms"`
+}
+
+// Health is the last check of every listener.
+type Health struct {
+	Checked time.Time `json:"checked"`
+	Probes  []Probe   `json:"probes"`
+}
+
+// OK reports whether every listener works.
+func (h *Health) OK() bool {
+	for _, p := range h.Probes {
+		if !p.OK {
+			return false
+		}
+	}
+	return true
+}
+
+// Check probes every DoT and DoH listener of the setup. hostname is what
+// clients ask for, serial the certificate Jarl last wrote for named ("" if
+// unknown), roots the CAs to trust (nil: the system's).
+func Check(ctx context.Context, s Status, hostname, serial string, roots *x509.CertPool) *Health {
+	h := &Health{Checked: time.Now(), Probes: []Probe{}}
+	for _, e := range s.DoT {
+		h.Probes = append(h.Probes, probe(ctx, "dot", e, hostname, serial, roots))
+	}
+	for _, e := range s.DoH {
+		h.Probes = append(h.Probes, probe(ctx, "doh", e, hostname, serial, roots))
+	}
+	return h
+}
+
+const probeTimeout = 5 * time.Second
+
+func probe(ctx context.Context, kind string, e Endpoint, hostname, serial string, roots *x509.CertPool) Probe {
+	p := Probe{Kind: kind, Address: e.Address, Port: e.Port}
+	addr := net.JoinHostPort(e.Address, strconv.Itoa(e.Port))
+	ctx, cancel := context.WithTimeout(ctx, probeTimeout)
+	defer cancel()
+	start := time.Now()
+	q := new(dns.Msg)
+	q.SetQuestion(dns.Fqdn(hostname), dns.TypeA)
+	q.RecursionDesired = true
+	var state tls.ConnectionState
+	var answer *dns.Msg
+	var err error
+	cfg := &tls.Config{ServerName: hostname, InsecureSkipVerify: true, MinVersion: tls.VersionTLS12} // checked below, to say what is wrong
+	if kind == "dot" {
+		cfg.NextProtos = []string{"dot"}
+		state, answer, err = askDoT(ctx, addr, cfg, q)
+	} else {
+		state, answer, err = askDoH(ctx, addr, hostname, e.Port, cfg, q)
+	}
+	p.Millis = time.Since(start).Milliseconds()
+	if len(state.PeerCertificates) > 0 {
+		leaf := state.PeerCertificates[0]
+		p.CertNames, p.CertSerial = leaf.DNSNames, fmt.Sprintf("%x", leaf.SerialNumber)
+		na := leaf.NotAfter
+		p.CertNotAfter = &na
+		inter := x509.NewCertPool()
+		for _, c := range state.PeerCertificates[1:] {
+			inter.AddCert(c)
+		}
+		_, verr := leaf.Verify(x509.VerifyOptions{Roots: roots, Intermediates: inter, DNSName: hostname})
+		p.Trusted = verr == nil
+		switch {
+		case leaf.VerifyHostname(hostname) != nil:
+			p.Problem = fmt.Sprintf("named serves a certificate for %s, not %s: clients reject it", strings.Join(leaf.DNSNames, ", "), hostname)
+		case time.Now().After(leaf.NotAfter):
+			p.Problem = "named serves an expired certificate (until " + leaf.NotAfter.Format(time.DateOnly) + ")"
+		case serial != "" && p.CertSerial != serial:
+			p.Problem = "named still serves an older certificate (serial " + p.CertSerial + ", Jarl has " + serial + "): it hasn't reread the files (rndc reconfig)"
+		case !p.Trusted:
+			p.Warning = "the certificate isn't from a CA this server trusts (a staging or test CA?): clients reject it unless they trust that CA"
+		}
+	}
+	switch {
+	case err != nil:
+		p.Problem = describe(err, e)
+	case p.Problem != "":
+	case answer == nil:
+		p.Problem = "no DNS answer"
+	default:
+		p.RCode = dns.RcodeToString[answer.Rcode]
+		p.OK = true
+		if answer.Rcode == dns.RcodeRefused {
+			p.Warning = strings.TrimPrefix(p.Warning+"; ", "; ") + "it answers, but REFUSED: this server's own address gets a view that doesn't answer for " + hostname
+		}
+	}
+	return p
+}
+
+func askDoT(ctx context.Context, addr string, cfg *tls.Config, q *dns.Msg) (tls.ConnectionState, *dns.Msg, error) {
+	d := &tls.Dialer{NetDialer: &net.Dialer{Timeout: probeTimeout}, Config: cfg}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return tls.ConnectionState{}, nil, err
+	}
+	defer conn.Close()
+	tc := conn.(*tls.Conn)
+	state := tc.ConnectionState()
+	conn.SetDeadline(time.Now().Add(probeTimeout))
+	co := &dns.Conn{Conn: conn}
+	if err := co.WriteMsg(q); err != nil {
+		return state, nil, err
+	}
+	r, err := co.ReadMsg()
+	return state, r, err
+}
+
+func askDoH(ctx context.Context, addr, hostname string, port int, cfg *tls.Config, q *dns.Msg) (tls.ConnectionState, *dns.Msg, error) {
+	cfg = cfg.Clone()
+	cfg.NextProtos = []string{"h2", "http/1.1"}
+	tr := &http.Transport{
+		TLSClientConfig:   cfg,
+		ForceAttemptHTTP2: true,
+		// Whatever the host name resolves to here: the listener's address.
+		DialContext: func(ctx context.Context, network, _ string) (net.Conn, error) {
+			return (&net.Dialer{Timeout: probeTimeout}).DialContext(ctx, network, addr)
+		},
+	}
+	defer tr.CloseIdleConnections()
+	wire, err := q.Pack()
+	if err != nil {
+		return tls.ConnectionState{}, nil, err
+	}
+	url := "https://" + net.JoinHostPort(hostname, strconv.Itoa(port)) + "/dns-query"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(wire))
+	if err != nil {
+		return tls.ConnectionState{}, nil, err
+	}
+	req.Header.Set("Content-Type", "application/dns-message")
+	req.Header.Set("Accept", "application/dns-message")
+	resp, err := (&http.Client{Transport: tr, Timeout: probeTimeout}).Do(req)
+	if err != nil {
+		return tls.ConnectionState{}, nil, err
+	}
+	defer resp.Body.Close()
+	var state tls.ConnectionState
+	if resp.TLS != nil {
+		state = *resp.TLS
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 64<<10))
+	if err != nil {
+		return state, nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return state, nil, fmt.Errorf("HTTP %d at /dns-query", resp.StatusCode)
+	}
+	r := new(dns.Msg)
+	if err := r.Unpack(body); err != nil {
+		return state, nil, fmt.Errorf("not a DNS answer: %w", err)
+	}
+	return state, r, nil
+}
+
+// describe says what a failed probe means.
+func describe(err error, e Endpoint) string {
+	var ne net.Error
+	switch {
+	case errors.Is(err, syscall.ECONNREFUSED):
+		return fmt.Sprintf("nothing listens on %s port %d: named may not have been able to bind it (look in named's log; ports below 1024 need named to start as root)", e.Address, e.Port)
+	case errors.As(err, &ne) && ne.Timeout(), errors.Is(err, context.DeadlineExceeded):
+		return fmt.Sprintf("no answer from %s port %d within %s (a firewall on the server?)", e.Address, e.Port, probeTimeout)
+	}
+	return err.Error()
+}
diff --git a/internal/encdns/health_test.go b/internal/encdns/health_test.go
new file mode 100644
index 0000000..f8ab44b
--- /dev/null
+++ b/internal/encdns/health_test.go
@@ -0,0 +1,115 @@
+package encdns
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"io"
+	"math/big"
+	"net"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+func testCert(t *testing.T, names ...string) (tls.Certificate, *x509.Certificate) {
+	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	tmpl := &x509.Certificate{SerialNumber: big.NewInt(0xabc123), Subject: pkix.Name{CommonName: names[0]}, DNSNames: names,
+		NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(24 * time.Hour), ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	leaf, _ := x509.ParseCertificate(der)
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key, Leaf: leaf}, leaf
+}
+
+// answer answers every question with 192.0.2.53.
+var answer = dns.HandlerFunc(func(w dns.ResponseWriter, r *dns.Msg) {
+	m := new(dns.Msg)
+	m.SetReply(r)
+	m.Answer = append(m.Answer, &dns.A{Hdr: dns.RR_Header{Name: r.Question[0].Name, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 60}, A: net.ParseIP("192.0.2.53")})
+	w.WriteMsg(m)
+})
+
+func listeners(t *testing.T, cert tls.Certificate) (dot, doh Endpoint) {
+	cfg := &tls.Config{Certificates: []tls.Certificate{cert}}
+	ln, err := tls.Listen("tcp", "127.0.0.1:0", cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := &dns.Server{Listener: ln, Net: "tcp-tls", Handler: answer}
+	go srv.ActivateAndServe()
+	t.Cleanup(func() { srv.Shutdown() })
+	hl, err := tls.Listen("tcp", "127.0.0.1:0", cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hs := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/dns-query" {
+			http.NotFound(w, r)
+			return
+		}
+		b, _ := io.ReadAll(r.Body)
+		q := new(dns.Msg)
+		if q.Unpack(b) != nil {
+			http.Error(w, "bad", 400)
+			return
+		}
+		m := new(dns.Msg)
+		m.SetReply(q)
+		m.Rcode = dns.RcodeSuccess
+		out, _ := m.Pack()
+		w.Header().Set("Content-Type", "application/dns-message")
+		w.Write(out)
+	})}
+	go hs.Serve(hl)
+	t.Cleanup(func() { hs.Close() })
+	port := func(l net.Listener) int { return l.Addr().(*net.TCPAddr).Port }
+	return Endpoint{"127.0.0.1", port(ln)}, Endpoint{"127.0.0.1", port(hl)}
+}
+
+func TestHealth(t *testing.T) {
+	ctx := context.Background()
+	cert, leaf := testCert(t, "dns.example.com")
+	dot, doh := listeners(t, cert)
+	roots := x509.NewCertPool()
+	roots.AddCert(leaf)
+	st := Status{Enabled: true, DoT: []Endpoint{dot}, DoH: []Endpoint{doh}}
+
+	h := Check(ctx, st, "dns.example.com", "abc123", roots)
+	if !h.OK() || len(h.Probes) != 2 {
+		t.Fatalf("working setup: %+v", h.Probes)
+	}
+	for _, p := range h.Probes {
+		if !p.Trusted || p.RCode != "NOERROR" || p.Warning != "" || p.CertSerial != "abc123" {
+			t.Errorf("%s: %+v", p.Kind, p)
+		}
+	}
+	// named hasn't reread a renewed certificate.
+	if h := Check(ctx, st, "dns.example.com", "def456", roots); h.OK() || !strings.Contains(h.Probes[0].Problem, "older certificate") {
+		t.Errorf("stale: %+v", h.Probes[0])
+	}
+	// The wrong name.
+	if h := Check(ctx, st, "other.example.com", "", roots); h.OK() || !strings.Contains(h.Probes[0].Problem, "not other.example.com") {
+		t.Errorf("wrong name: %+v", h.Probes[0])
+	}
+	// A CA this server doesn't trust: works, with a warning.
+	if h := Check(ctx, st, "dns.example.com", "abc123", x509.NewCertPool()); !h.OK() || !strings.Contains(h.Probes[1].Warning, "staging") {
+		t.Errorf("untrusted: %+v", h.Probes[1])
+	}
+	// Nothing listening.
+	l, _ := net.Listen("tcp", "127.0.0.1:0")
+	gone := l.Addr().(*net.TCPAddr).Port
+	l.Close()
+	if h := Check(ctx, Status{Enabled: true, DoT: []Endpoint{{"127.0.0.1", gone}}}, "dns.example.com", "", roots); h.OK() || !strings.Contains(h.Probes[0].Problem, "nothing listens") {
+		t.Errorf("nothing listening: %+v", h.Probes[0])
+	}
+}
diff --git a/internal/engine/compare.go b/internal/engine/compare.go
new file mode 100644
index 0000000..8159113
--- /dev/null
+++ b/internal/engine/compare.go
@@ -0,0 +1,104 @@
+package engine
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"jarl/internal/model"
+)
+
+// ViewSet is what one view has for a name and type.
+type ViewSet struct {
+	View    string   `json:"view"`
+	ZoneID  int64    `json:"zone_id"`
+	Records []string `json:"records"`          // data (with TTL and "(disabled)" when set), sorted
+	IDs     []int64  `json:"ids"`              // the records, in the same order
+	Linked  string   `json:"linked,omitempty"` // shared or local, in a linked zone
+}
+
+// CompareRow is one name and type across views.
+type CompareRow struct {
+	Name  string    `json:"name"` // relative to the zone
+	FQDN  string    `json:"fqdn"`
+	Type  string    `json:"type"`
+	Same  bool      `json:"same"`
+	Views []ViewSet `json:"views"` // in the order of the zones given
+}
+
+// CompareZones lines up the records of zones of the same name in
+// different views (docs/views.md#linked-zones), one row per name and type,
+// sorted like a zone file.
+func CompareZones(st *model.State, zones []*model.Zone) []CompareRow {
+	type key struct{ name, typ string }
+	sets := make([]map[key][]*model.Record, len(zones))
+	var keys []key
+	seen := map[key]bool{}
+	var all []*model.Record
+	for i, z := range zones {
+		sets[i] = map[key][]*model.Record{}
+		for _, r := range st.ZoneRecords(z.ID) {
+			k := key{r.Name, r.Type}
+			sets[i][k] = append(sets[i][k], r)
+			if !seen[k] {
+				seen[k] = true
+				keys = append(keys, k)
+				all = append(all, r)
+			}
+		}
+	}
+	if len(zones) > 0 {
+		// Zone file order: the apex first, then by name and type.
+		model.SortRecords(all, zones[0])
+		keys = keys[:0]
+		for _, r := range all {
+			keys = append(keys, key{r.Name, r.Type})
+		}
+	}
+	var out []CompareRow
+	for _, k := range keys {
+		row := CompareRow{FQDN: k.name, Type: k.typ, Same: true}
+		if len(zones) > 0 {
+			row.Name = relName(k.name, zones[0].Name)
+		}
+		var first string
+		for i, z := range zones {
+			vs := ViewSet{View: st.ViewName(z), ZoneID: z.ID, Records: []string{}, IDs: []int64{}}
+			rs := slices.Clone(sets[i][k])
+			slices.SortFunc(rs, func(a, b *model.Record) int { return strings.Compare(strings.ToLower(a.Data), strings.ToLower(b.Data)) })
+			for _, r := range rs {
+				d := r.Data
+				if r.TTL != nil {
+					d = fmt.Sprintf("%s (TTL %d)", d, *r.TTL)
+				}
+				if r.Disabled {
+					d += " (disabled)"
+				}
+				vs.Records = append(vs.Records, d)
+				vs.IDs = append(vs.IDs, r.ID)
+			}
+			if z.LinkGroup != 0 && len(rs) > 0 {
+				vs.Linked = "shared"
+				if rs[0].SharedID == 0 {
+					vs.Linked = "local"
+				}
+			}
+			sig := strings.Join(vs.Records, "\n")
+			if i == 0 {
+				first = sig
+			} else if sig != first {
+				row.Same = false
+			}
+			row.Views = append(row.Views, vs)
+		}
+		out = append(out, row)
+	}
+	return out
+}
+
+func relName(name, zone string) string {
+	if name == zone {
+		return "@"
+	}
+	return strings.TrimSuffix(name, "."+zone)
+}
diff --git a/internal/engine/expand.go b/internal/engine/expand.go
index 924da2d..f517186 100644
--- a/internal/engine/expand.go
+++ b/internal/engine/expand.go
@@ -801,9 +801,10 @@ func (x *expander) recordCreate(req Request) ([]model.Op, error) {
 			}
 			in.SharedID = &ids[0]
 		}
-	} else if in.Local != nil && *in.Local {
-		return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+	} else if in.Local != nil && !*in.Local {
+		return nil, notLinked(x.st, z)
 	}
+	// local on a zone that isn't linked: its records are local anyway.
 	in.Local = nil
 	ops := []model.Op{newOp(OpRecordCreate, ids[0], 0, in, summary)}
 	if ptr {
@@ -834,10 +835,10 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 	}
 	var pre []model.Op
 	if in.Local != nil {
-		if z.LinkGroup == 0 {
-			return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+		if z.LinkGroup == 0 && !*in.Local {
+			return nil, notLinked(x.st, z)
 		}
-		if want := *in.Local; want != (r.SharedID == 0) {
+		if want := *in.Local; z.LinkGroup != 0 && want != (r.SharedID == 0) {
 			// The whole set of this name and type changes sides.
 			for _, o := range x.st.RRset(z.ID, r.Name, r.Type) {
 				id := int64(0)
@@ -848,10 +849,11 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 				}
 				pre = append(pre, newOp(OpRecordUpdate, o.ID, o.Version, RecordInput{SharedID: model.Ptr(id)}, what))
 			}
-			if !want {
-				// Sharing a version makes it every view's.
-				pre = append(pre, x.dropOverrides(z, r.Name, r.Type)...)
-			}
+		}
+		if z.LinkGroup != 0 && !*in.Local {
+			// Sharing a version makes it every view's, also when it is
+			// shared already and another view overrides it.
+			pre = append(pre, x.dropOverrides(z, r.Name, r.Type)...)
 		}
 		in.Local = nil
 		if string(mustJSON(in)) == "{}" {
@@ -1153,8 +1155,8 @@ func (x *expander) rrsetReplace(req Request) ([]model.Op, error) {
 			// Explicitly shared: this version becomes every view's.
 			pre = x.dropOverrides(z, owner, typ)
 		}
-	} else if in.Local != nil && *in.Local {
-		return nil, errf(KindBadRequest, "zone %s isn't linked with other views, so its records are local anyway", zoneDesc(x.st, z))
+	} else if in.Local != nil && !*in.Local {
+		return nil, notLinked(x.st, z)
 	}
 	in.Local = nil
 	if len(canon) > 0 {
@@ -1356,3 +1358,8 @@ func firstNonEmptyStr(a, b string) string {
 	}
 	return b
 }
+
+// notLinked refuses sharing a record of a zone that isn't linked.
+func notLinked(st *model.State, z *model.Zone) error {
+	return errf(KindBadRequest, "zone %s isn't linked with other views, so there is nothing to share its records with (link it first: jarl zone link)", zoneDesc(st, z))
+}
diff --git a/internal/engine/linked_test.go b/internal/engine/linked_test.go
index e425542..1ae6908 100644
--- a/internal/engine/linked_test.go
+++ b/internal/engine/linked_test.go
@@ -285,3 +285,59 @@ func TestLinkExisting(t *testing.T) {
 		t.Errorf("shared from internal: external %q", env.view("external"))
 	}
 }
+
+// --local on a zone that isn't linked is fine (its records are local
+// anyway); --shared there is refused.
+func TestLocalOnUnlinkedZone(t *testing.T) {
+	env := linkedEnv(t)
+	local, shared := true, false
+	env.submit(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("a"), Type: model.Ptr("A"), Data: model.Ptr("10.0.0.1"), Local: &local}))
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", View: "internal", Name: "b", Type: "A", Data: []string{"10.0.0.2"}, Local: &local}))
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "a", "A"), RecordInput{Data: model.Ptr("10.0.0.3"), Local: &local}))
+	if v := env.view("internal"); !slices.Contains(v, "a A 10.0.0.3 L") || !slices.Contains(v, "b A 10.0.0.2 L") {
+		t.Errorf("records: %q", v)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("c"), Type: model.Ptr("A"), Data: model.Ptr("10.0.0.4"), Local: &shared})); !strings.Contains(e.Message, "nothing to share") {
+		t.Errorf("--shared on an unlinked zone: %v", e)
+	}
+}
+
+func TestCompareZones(t *testing.T) {
+	env := linkedEnv(t)
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("external"), LinkWith: "internal"}))
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", View: "external", Name: "www", Type: "A", Data: []string{"203.0.113.10"}, Local: model.Ptr(true)}))
+	env.submit(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("nas"), Type: model.Ptr("A"), Data: model.Ptr("10.0.0.20"), Local: model.Ptr(true)}))
+	st := env.state()
+	zones := st.ZonesNamed("example.com.")
+	st.SortByView(zones)
+	diff := map[string][]string{}
+	same := 0
+	for _, row := range CompareZones(st, zones) {
+		if row.Same {
+			same++
+			continue
+		}
+		var cells []string
+		for _, vs := range row.Views {
+			cells = append(cells, vs.View+"="+strings.Join(vs.Records, ",")+"/"+vs.Linked)
+		}
+		diff[row.Name+" "+row.Type] = cells
+	}
+	want := map[string][]string{
+		"www A": {"internal=192.0.2.10/shared", "external=203.0.113.10/local"},
+		"nas A": {"internal=10.0.0.20/local", "external=/"},
+	}
+	for k, v := range want {
+		if !slices.Equal(diff[k], v) {
+			t.Errorf("%s: %q, want %q", k, diff[k], v)
+		}
+	}
+	if len(diff) != 2 || same < 3 {
+		t.Errorf("differ %v, same %d", diff, same)
+	}
+	// "Use this version" on the shared one replaces external's override.
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "www", "A"), RecordInput{Local: model.Ptr(false)}))
+	if v := env.view("external"); !slices.Contains(v, "www A 192.0.2.10 S") || slices.Contains(v, "www A 203.0.113.10 L") {
+		t.Errorf("sharing the shared version: external %q", v)
+	}
+}
diff --git a/internal/server/h_changes.go b/internal/server/h_changes.go
index 36c8c61..d944f8d 100644
--- a/internal/server/h_changes.go
+++ b/internal/server/h_changes.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"strconv"
 	"time"
@@ -285,6 +286,20 @@ func (s *Server) status(w http.ResponseWriter, r *http.Request, p *auth.Principa
 		resp.TOTP = s.totpOverview(r.Context())
 		resp.Certificates = s.certSummary(r.Context())
 	}
+	if p.Can(auth.Action{Resource: auth.ResOptions}) {
+		if h := s.encryptedDNSHealth(); h != nil {
+			sum := &api.EncDNSSummary{Checked: h.Checked, OK: h.OK(), Problems: []string{}, Warnings: []string{}}
+			for _, pr := range h.Probes {
+				where := fmt.Sprintf("%s on %s port %d", map[string]string{"dot": "DNS over TLS", "doh": "DNS over HTTPS"}[pr.Kind], pr.Address, pr.Port)
+				if pr.Problem != "" {
+					sum.Problems = append(sum.Problems, where+": "+pr.Problem)
+				} else if pr.Warning != "" {
+					sum.Warnings = append(sum.Warnings, where+": "+pr.Warning)
+				}
+			}
+			resp.EncryptedDNS = sum
+		}
+	}
 	if p.Can(auth.Action{Resource: auth.ResBlocking}) {
 		resp.BlocklistErrors = s.blocklistErrors(r.Context())
 		if st, err := s.store.LoadState(r.Context()); err == nil {
diff --git a/internal/server/h_compare.go b/internal/server/h_compare.go
new file mode 100644
index 0000000..b35a684
--- /dev/null
+++ b/internal/server/h_compare.go
@@ -0,0 +1,89 @@
+package server
+
+import (
+	"net/http"
+	"strings"
+
+	"jarl/internal/auth"
+	"jarl/internal/engine"
+	"jarl/internal/model"
+)
+
+// zoneCompare: GET /zones/{zone}/compare lines up a zone's records across
+// the views that have it (docs/views.md#linked-zones). ?views=a,b picks the
+// views (default: every view with a primary zone of that name), ?all=1
+// includes the names and types that are the same everywhere.
+func (s *Server) zoneCompare(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	st, err := s.state(r)
+	if err != nil {
+		return err
+	}
+	z, err := s.zoneByPath(r, st, p)
+	if err != nil {
+		// A name in several views is what there is to compare.
+		ref := r.PathValue("zone")
+		if ref == "root" {
+			ref = "."
+		}
+		name, perr := engine.ParseZoneName(ref)
+		if zs := st.ZonesNamed(name); perr != nil || len(zs) < 2 {
+			return err
+		} else {
+			z = zs[0]
+		}
+	}
+	var want []string
+	for _, v := range strings.Split(r.URL.Query().Get("views"), ",") {
+		if v = strings.TrimSpace(v); v != "" {
+			want = append(want, v)
+		}
+	}
+	var zones []*model.Zone
+	for _, o := range st.ZonesNamed(z.Name) {
+		vn := st.ViewName(o)
+		if o.Type != model.ZonePrimary || !p.CanSeeZone(o.Name, vn) || !p.Can(auth.Action{Resource: auth.ResRecords, Zone: o.Name, View: vn}) {
+			continue
+		}
+		if len(want) > 0 && !containsFold(want, vn) {
+			continue
+		}
+		zones = append(zones, o)
+	}
+	st.SortByView(zones)
+	if len(zones) < 2 {
+		return badRequest("zone %s is in only one view (that you may read): there is nothing to compare", engine.Display(z.Name))
+	}
+	rows := engine.CompareZones(st, zones)
+	all := queryBool(r, "all")
+	out := struct {
+		Zone   string              `json:"zone"`
+		Views  []string            `json:"views"`
+		Linked bool                `json:"linked"` // all of them in one link
+		Same   int                 `json:"same"`   // names and types the same everywhere
+		Rows   []engine.CompareRow `json:"rows"`
+	}{Zone: engine.Display(z.Name), Rows: []engine.CompareRow{}, Linked: true}
+	for _, o := range zones {
+		out.Views = append(out.Views, st.ViewName(o))
+		out.Linked = out.Linked && o.LinkGroup != 0 && o.LinkGroup == zones[0].LinkGroup
+	}
+	for _, row := range rows {
+		if row.Same {
+			out.Same++
+			if !all {
+				continue
+			}
+		}
+		out.Rows = append(out.Rows, row)
+	}
+	writeJSON(w, http.StatusOK, out)
+	return nil
+}
+
+func containsFold(list []string, s string) bool {
+	for _, x := range list {
+		if strings.EqualFold(x, s) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/server/h_encdns.go b/internal/server/h_encdns.go
index 5cfe0da..be06880 100644
--- a/internal/server/h_encdns.go
+++ b/internal/server/h_encdns.go
@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"net/http"
 	"net/netip"
 	"slices"
@@ -43,6 +44,8 @@ type encStatus struct {
 	// DoTHost and DoHURL are what to give clients.
 	DoTHost string `json:"dot_host,omitempty"`
 	DoHURL  string `json:"doh_url,omitempty"`
+	// Health is the last check of the listeners (every 10 minutes).
+	Health *encdns.Health `json:"health,omitempty"`
 	// For the setup form.
 	Addresses    []encAddress `json:"addresses"`
 	Views        []encView    `json:"views"`
@@ -104,6 +107,9 @@ func (s *Server) encryptedDNS(w http.ResponseWriter, r *http.Request, p *auth.Pr
 			out.DoHURL += "/dns-query"
 		}
 	}
+	if out.Enabled {
+		out.Health = s.encryptedDNSHealth()
+	}
 	seen := map[netip.Addr]bool{}
 	for _, a := range localAddrs() {
 		a = a.Unmap()
@@ -234,3 +240,81 @@ func (s *Server) encryptedDNSDisable(w http.ResponseWriter, r *http.Request, p *
 	}
 	return s.mutate(w, r, p, "turn DNS over TLS and HTTPS off", reqs, nil)
 }
+
+// encTarget returns the host name clients connect to and the serial of
+// the certificate Jarl last wrote for named.
+func (s *Server) encTarget(ctx context.Context, st encdns.Status) (host, serial string) {
+	if s.cfg.Certs == nil || st.Certificate == "" {
+		return "", ""
+	}
+	c, err := s.cfg.Certs.Get(ctx, st.Certificate)
+	if err != nil {
+		return "", ""
+	}
+	for _, n := range append(c.Names, c.Domains...) {
+		if !strings.HasPrefix(n, "*.") {
+			host = n
+			break
+		}
+	}
+	return host, c.Serial
+}
+
+// checkEncryptedDNS checks the DoT and DoH listeners as a client would and
+// keeps the result; a change for the worse is logged.
+func (s *Server) checkEncryptedDNS(ctx context.Context) *encdns.Health {
+	if s.cfg.Certs == nil {
+		return nil
+	}
+	state, err := s.store.LoadState(ctx)
+	if err != nil {
+		return nil
+	}
+	st := encdns.GetStatus(state, s.cfg.Certs.FilesDir(""))
+	var h *encdns.Health
+	if st.Enabled {
+		if host, serial := s.encTarget(ctx, st); host != "" {
+			h = encdns.Check(ctx, st, host, serial, s.encRoots)
+		}
+	}
+	s.encHealth.Lock()
+	prev := s.encHealth.h
+	s.encHealth.h = h
+	s.encHealth.Unlock()
+	if h != nil {
+		for _, p := range h.Probes {
+			if p.OK {
+				continue
+			}
+			was := false
+			if prev != nil {
+				for _, q := range prev.Probes {
+					was = was || q.Kind == p.Kind && q.Address == p.Address && q.Port == p.Port && !q.OK
+				}
+			}
+			if !was {
+				s.log.Warn("encrypted DNS isn't working", "kind", p.Kind, "address", p.Address, "port", p.Port, "problem", p.Problem)
+			}
+		}
+	}
+	return h
+}
+
+func (s *Server) encryptedDNSHealth() *encdns.Health {
+	s.encHealth.Lock()
+	defer s.encHealth.Unlock()
+	return s.encHealth.h
+}
+
+// encryptedDNSCheckNow: POST /encrypted-dns/health checks the listeners now.
+func (s *Server) encryptedDNSCheckNow(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := s.encReady(p, false); err != nil {
+		return err
+	}
+	h := s.checkEncryptedDNS(r.Context())
+	if h == nil {
+		return conflict("encrypted DNS isn't set up")
+	}
+	writeJSON(w, http.StatusOK, h)
+	return nil
+}
diff --git a/internal/server/metrics.go b/internal/server/metrics.go
index 3f87ce9..dc0b59a 100644
--- a/internal/server/metrics.go
+++ b/internal/server/metrics.go
@@ -289,6 +289,13 @@ func (s *Server) collectState(ctx context.Context, pw *promWriter, now time.Time
 		}
 	}
 
+	if h := s.encryptedDNSHealth(); h != nil {
+		for _, pr := range h.Probes {
+			pw.gauge("jarl_encrypted_dns_up", "1 when the DNS over TLS or HTTPS listener answered with the right, current certificate at the last check (every 10 minutes).", b2f(pr.OK),
+				"kind", pr.Kind, "address", pr.Address, "port", strconv.Itoa(pr.Port))
+		}
+	}
+
 	if tokens, err := s.store.ListTokens(ctx, 0); err == nil {
 		for _, t := range tokens {
 			if t.ExpiresAt != nil && t.RevokedAt == nil {
diff --git a/internal/server/present.go b/internal/server/present.go
index 34fbbd3..1c9ea9a 100644
--- a/internal/server/present.go
+++ b/internal/server/present.go
@@ -22,6 +22,13 @@ func (s *Server) presentZone(st *model.State, z *model.Zone, counts map[int64]re
 		out.RName = dnsname.EmailFromMailbox(z.SOA.RName)
 	}
 	out.Registrar = s.registrarFor(z)
+	if z.Type == model.ZonePrimary && z.ViewID != 0 {
+		for _, o := range st.ZonesNamed(z.Name) {
+			if o.ID != z.ID && o.Type == model.ZonePrimary {
+				out.OtherViews = append(out.OtherViews, st.ViewName(o))
+			}
+		}
+	}
 	for _, o := range st.LinkedWith(z) {
 		out.LinkedWith = append(out.LinkedWith, st.ViewName(o))
 		out.Links = append(out.Links, api.ZoneLink{ID: o.ID, View: st.ViewName(o)})
diff --git a/internal/server/routes.go b/internal/server/routes.go
index 92441b5..f7d56e7 100644
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -111,6 +111,7 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE "+p+"/zones/{zone}/registrar/ds/{keytag}", s.authed(s.registrarRemoveDS))
 	m.HandleFunc("PUT "+p+"/zones/{zone}/registrar/ns", s.authed(s.registrarSetNS))
 	m.HandleFunc("GET "+p+"/zones/{zone}/file", s.authed(s.zoneFile))
+	m.HandleFunc("GET "+p+"/zones/{zone}/compare", s.authed(s.zoneCompare))
 	m.HandleFunc("POST "+p+"/zones/{zone}/link", s.authed(s.zoneLink(true)))
 	m.HandleFunc("POST "+p+"/zones/{zone}/unlink", s.authed(s.zoneLink(false)))
 	m.HandleFunc("POST "+p+"/zones/{zone}/import", s.authed(s.importZoneFile))
@@ -176,6 +177,7 @@ func (s *Server) routes() {
 	m.HandleFunc("POST "+p+"/encrypted-dns", s.authed(s.encryptedDNSSetup))
 	m.HandleFunc("DELETE "+p+"/encrypted-dns", s.authed(s.encryptedDNSDisable))
 	m.HandleFunc("POST "+p+"/encrypted-dns/check", s.authed(s.encryptedDNSCheck))
+	m.HandleFunc("POST "+p+"/encrypted-dns/health", s.authed(s.encryptedDNSCheckNow))
 	m.HandleFunc("GET "+p+"/exposure", s.authed(s.exposure))
 	m.HandleFunc("POST "+p+"/exposure/fix", s.authed(s.exposureFix))
 	m.HandleFunc("POST "+p+"/exposure/ack", s.authed(s.exposureAck(true)))
diff --git a/internal/server/server.go b/internal/server/server.go
index ed8656e..c7ac8e1 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -4,6 +4,7 @@ package server
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -21,6 +22,7 @@ import (
 	"jarl/internal/api"
 	"jarl/internal/auth"
 	"jarl/internal/certs"
+	"jarl/internal/encdns"
 	"jarl/internal/engine"
 	"jarl/internal/nscheck"
 	"jarl/internal/porkbun"
@@ -90,6 +92,13 @@ type Server struct {
 	// state part of /metrics.
 	started      time.Time
 	metricsCache metricsCache
+	// encHealth is the last check of encrypted DNS's listeners
+	// (h_encdns.go); encRoots the CAs it trusts (nil: the system's).
+	encHealth struct {
+		sync.Mutex
+		h *encdns.Health
+	}
+	encRoots *x509.CertPool
 
 	mu   sync.Mutex
 	srvs []*http.Server
@@ -226,6 +235,14 @@ func (s *Server) Serve(ctx context.Context, ready func()) error {
 		ready()
 	}
 	go s.housekeeping(ctx)
+	go func() {
+		// Once jarld and named have settled after a start.
+		select {
+		case <-ctx.Done():
+		case <-time.After(30 * time.Second):
+			s.checkEncryptedDNS(ctx)
+		}
+	}()
 	select {
 	case <-ctx.Done():
 	case err := <-errc:
@@ -300,6 +317,7 @@ func (s *Server) housekeeping(ctx context.Context) {
 			}
 			s.limiter.cleanup()
 			s.warnExpiringTokens(ctx, time.Now())
+			s.checkEncryptedDNS(ctx)
 			if s.certs != nil {
 				s.certs.reloadIfChanged()
 			}
diff --git a/internal/web/static/assets/pages/dashboard.js b/internal/web/static/assets/pages/dashboard.js
index 80535d1..ac4a10d 100644
--- a/internal/web/static/assets/pages/dashboard.js
+++ b/internal/web/static/assets/pages/dashboard.js
@@ -18,6 +18,9 @@ export async function render(el) {
     st.backup ? backupCard(st.backup) : null,
     exposure ? exposureCard(exposure) : null,
     st.certificates ? certCard(st.certificates) : null,
+    st.encrypted_dns ? h("a", { class: "card link", href: "#/encrypted-dns" }, h("div", { class: "label" }, "Encrypted DNS"),
+      h("div", { class: "value" }, st.encrypted_dns.ok ? badge("working", "ok") : badge("not working", "err")),
+      h("div", { class: "sub" }, "checked ", time(st.encrypted_dns.checked))) : null,
   );
   const last = s.last_applied;
   const parts = [h("div", { class: "page-head" },
@@ -43,6 +46,9 @@ export async function render(el) {
       h("strong", null, "The last backup failed "), time(b.last_error_at), ": " + b.last_error,
       h("div", { class: "small" }, "See 'journalctl -u jarl-backup' on the server.")));
   }
+  for (const p of (st.encrypted_dns || {}).problems || []) {
+    parts.push(h("div", { class: "msg err" }, h("strong", null, "Encrypted DNS: "), p, " ", h("a", { href: "#/encrypted-dns" }, "Encrypted DNS")));
+  }
   for (const c of (st.certificates || {}).problems || []) {
     parts.push(h("div", { class: "msg " + (c.state === "expiring" ? "warn" : "err") },
       h("strong", null, "Certificate " + c.name + " " + (c.state === "expired" ? "has expired" : c.state === "expiring" ? "expires soon" : "can't be renewed") + ": "), c.message, " ",
diff --git a/internal/web/static/assets/pages/encdns.js b/internal/web/static/assets/pages/encdns.js
index 546875f..4531ae8 100644
--- a/internal/web/static/assets/pages/encdns.js
+++ b/internal/web/static/assets/pages/encdns.js
@@ -2,7 +2,7 @@
 // set up and what to give clients, and a setup that obtains the
 // certificate if needed, checks the ports and stages named's
 // configuration like any change.
-import { h, mount, field, input, badge, toast, errorBox, confirmDialog, copyBox, checkbox } from "../ui.js";
+import { h, mount, field, input, badge, toast, errorBox, confirmDialog, copyBox, checkbox, fmtTime, relTime } from "../ui.js";
 import { api, get, change, describeResult, state } from "../api.js";
 import { rerender } from "../app.js";
 
@@ -50,6 +50,7 @@ function statusPanel(s) {
   }
   return [
     h("div", { class: "panel" }, h("h2", null, "Set up ", badge("on", "ok")), h("dl", { class: "kv" }, rows)),
+    healthPanel(s.health),
     h("div", { class: "panel" }, h("h2", null, "For your clients"),
       h("p", { class: "muted small" }, "Clients check the certificate against the host name, so it must resolve to this server for them (Jarl added it to the private views you chose). Open the ports in the server's firewall for your networks only."),
       clients),
@@ -223,3 +224,28 @@ async function disable() {
     rerender();
   } catch (e) { toast(e.message, "err", 8000); }
 }
+
+// healthPanel shows the last check of the listeners: Jarl connects to each
+// as a client would, checks the certificate and asks a question.
+function healthPanel(hl) {
+  const kind = { dot: "DNS over TLS", doh: "DNS over HTTPS" };
+  const out = h("div");
+  const draw = (x) => {
+    if (!x) return mount(out, h("div", { class: "muted" }, "Not checked yet: Jarl checks a minute after it starts, then every 10 minutes."));
+    mount(out, h("ul", { class: "probes" }, x.probes.map((p) => h("li", null,
+      badge(p.ok ? "working" : "not working", p.ok ? "ok" : "err"), " ",
+      h("strong", null, kind[p.kind]), " ", h("span", { class: "mono" }, p.address + " port " + p.port),
+      p.ok ? h("span", { class: "muted small" }, "  answered " + p.rcode + " in " + p.ms + " ms" + (p.cert_not_after ? " · certificate until " + fmtTime(p.cert_not_after) : "")) : null,
+      p.problem ? h("div", { class: "msg err small" }, p.problem) : null,
+      p.warning ? h("div", { class: "msg warn small" }, p.warning) : null))),
+      h("div", { class: "muted small" }, "Checked ", relTime(x.checked), "."));
+  };
+  draw(hl);
+  const btn = h("button", { class: "small", onclick: async () => {
+    btn.disabled = true;
+    try { draw(await api("POST", "/encrypted-dns/health", { body: {} })); } catch (e) { toast(e.message, "err", 8000); } finally { btn.disabled = false; }
+  } }, "Check now");
+  return h("div", { class: "panel" }, h("div", { class: "page-head" }, h("h2", { class: "grow" }, "Health"), h("div", { class: "actions" }, btn)),
+    h("p", { class: "muted small" }, "Jarl connects to each listener as a client would: the certificate must be for the host name, current, and the one Jarl last wrote; then it asks for the host name."),
+    out);
+}
diff --git a/internal/web/static/assets/pages/zone.js b/internal/web/static/assets/pages/zone.js
index 3885dd0..cfd3bd0 100644
--- a/internal/web/static/assets/pages/zone.js
+++ b/internal/web/static/assets/pages/zone.js
@@ -21,6 +21,7 @@ export async function render(el, params, query) {
     zone.type === "primary" ? ["file", "Zone file"] : null,
     ["primary", "secondary", "mirror"].includes(zone.type) ? ["servers", "Name servers"] : null,
     zone.type === "primary" ? ["dnssec", "DNSSEC"] : null,
+    zone.other_views ? ["compare", "Compare views"] : null,
     zone.registrar && state.me && state.me.admin ? ["registrar", "Registrar"] : null,
   ].filter(Boolean);
   const body = h("div");
@@ -64,6 +65,7 @@ export async function render(el, params, query) {
   else if (tab === "servers") await serversTab(body, zone);
   else if (tab === "dnssec") await dnssecTab(body, zone);
   else if (tab === "registrar") await registrarTab(body, zone);
+  else if (tab === "compare") await compareTab(body, zone);
   // A later click (another tab) has taken over the page.
   if (seq !== renderSeq || !holder.isConnected) return;
   holder.replaceWith(body);
@@ -71,6 +73,40 @@ export async function render(el, params, query) {
   if (first) first.focus();
 }
 
+// ---- comparing a zone across views
+
+// compareTab shows the names and types that differ between the views that
+// have the zone, with a button to share one view's version (linked zones).
+async function compareTab(el, zone) {
+  let all = false;
+  const out = h("div");
+  const draw = async () => {
+    const r = await get("/zones/" + zone.id + "/compare", { all: all ? 1 : "" });
+    const head = h("tr", null, h("th", null, "Name"), h("th", null, "Type"), r.views.map((v) => h("th", null, v)));
+    const rows = r.rows.map((row) => h("tr", { class: row.same ? "muted" : "" },
+      h("td", { class: "mono" }, row.name), h("td", null, h("strong", null, row.type)),
+      row.views.map((vs) => h("td", { class: "compare-cell" },
+        vs.records.length ? vs.records.map((d) => h("div", { class: "mono small" }, d)) : h("span", { class: "muted" }, "–"),
+        vs.linked === "local" ? [badge("only " + vs.view, "accent"), " "] : null,
+        r.linked && !row.same && vs.records.length ? h("button", { class: "small", title: "Make view " + vs.view + "'s version every view's: the others' records of this name and type are replaced",
+          onclick: () => share(vs, row) }, "Use this version") : null))));
+    mount(out,
+      h("p", { class: "muted" }, r.same + " names and types are the same in " + r.views.join(", ") + (r.rows.length && !all ? "; these differ." : ".") + " ",
+        r.linked ? "The zones are linked: shared records are kept in step, and a view's own records override them there." : "The zones aren't linked: a change in one doesn't reach the others. Link them (Link… above) to keep what is the same in step; linking changes no answer."),
+      r.rows.length ? h("div", { class: "table-wrap" }, h("table", { class: "compare" }, h("thead", null, head), h("tbody", null, rows))) : h("div", { class: "empty" }, "Nothing differs."),
+      h("label", { class: "check" }, h("input", { type: "checkbox", checked: all, onchange: (e) => { all = e.target.checked; draw(); } }), "Show what is the same too"));
+  };
+  const share = async (vs, row) => {
+    if (!await confirmDialog("Use view " + vs.view + "'s " + row.name + " " + row.type, "Every view gets " + vs.records.join(", ") + " for " + row.name + " " + row.type + ", shared from now on; the other views' records of that name and type are replaced.", "Use this version")) return;
+    try {
+      toast(describeResult(await change("PATCH", "/records/" + vs.ids[0], { local: false })));
+      await draw();
+    } catch (e) { toast(e.message, "err", 8000); }
+  };
+  await draw();
+  mount(el, out);
+}
+
 // ---- linked zones (docs/views.md#linked-zones)
 
 // linkButton links the zone with the same zone in other views, or takes
diff --git a/internal/web/static/assets/style.css b/internal/web/static/assets/style.css
index dd08df8..a7f2cc4 100644
--- a/internal/web/static/assets/style.css
+++ b/internal/web/static/assets/style.css
@@ -557,3 +557,13 @@ header.top .header-right { display: flex; align-items: center; gap: 12px; margin
   header.top form.search input { width: 160px; }
   header.top { gap: 10px; }
 }
+
+/* Encrypted DNS: the health of each listener. */
+ul.probes { list-style: none; padding: 0; margin: 0 0 8px; }
+ul.probes > li { padding: 6px 0; border-bottom: 1px solid var(--border); }
+ul.probes > li .msg { margin: 6px 0 0; }
+
+/* Comparing a zone across views. */
+table.compare td.compare-cell { vertical-align: top; }
+table.compare td.compare-cell button { margin-top: 4px; }
+table.compare tr.muted td { color: var(--muted); }
diff --git a/scripts/e2e.sh b/scripts/e2e.sh
index 7b5e203..5f71784 100755
--- a/scripts/e2e.sh
+++ b/scripts/e2e.sh
@@ -418,11 +418,20 @@ expect_dig "now every view's" "10.1.1.1" -k $E/external.key linked.adbraun.test
 run "--view all changes a link once" 0 $J record set adbraun.test linked A 10.1.1.2 --view all
 contains "linked with internal"
 expect_dig "both views" "10.1.1.2" -k $E/external.key linked.adbraun.test A
+run "zone diff: what differs between the views" 0 $J zone diff adbraun.test
+contains "ns1  *A  *127.0.0.1 \\[local, id [0-9]*\\]  *203.0.113.1 \\[local, id [0-9]*\\]"
+contains "names and types differ, [0-9]* are the same; linked"
+run "the compare API" 0 curl -sf -H "Authorization: Bearer $(cat $E/admin.token)" "http://127.0.0.1:$HTTP/api/v1/zones/adbraun.test/compare?view=internal&all=1"
+contains '"linked":true'
 run "a shared delete" 0 $J record delete adbraun.test linked A --view external -y
 expect_dig "gone from internal too" "" linked.adbraun.test A
 run "zone unlink" 0 $J zone unlink adbraun.test --view external
 run "unlinked: no link column" 0 $J record list adbraun.test --view external
 not_contains "shared"
+run "--local on a zone that isn't linked is fine" 0 $J record add adbraun.test solo A 10.9.9.9 --view external --local
+run "--shared there is refused (exit 6)" 6 $J record add adbraun.test solo2 A 10.9.9.8 --view external --shared
+contains "nothing to share"
+run "remove it" 0 $J record delete adbraun.test solo A --view external -y
 run "zone create --link-with: a linked copy" 0 $J zone create linkcopy.test --view internal --ns ns1.adbraun.test.
 run "a record in it" 0 $J record add linkcopy.test www A 192.0.2.80 --view internal
 run "copy it into external, linked" 0 $J zone create linkcopy.test --view external --link-with internal
@@ -792,6 +801,13 @@ if [ -n "$PEBBLE" ]; then
 	contains "^192.168.1.20$"
 	run "plain DNS still answers on port 53's listener" 0 $DIG +short -p $DNS @127.0.0.1 nas.adbraun.test A
 	contains "^192.168.1.20$"
+	run "encrypted-dns health: both listeners work" 0 $J encrypted-dns health
+	contains "DoT 127.0.0.1 port $EDOT: *working (NOERROR"
+	contains "DoH 127.0.0.1 port $EDOH: *working"
+	contains "isn't from a CA this server trusts"
+	sleep 16   # /metrics caches Jarl's state for 15 seconds
+	run "health metric" 0 curl -sf http://127.0.0.1:$HTTP/metrics
+	contains "^jarl_encrypted_dns_up{kind=\"dot\",address=\"127.0.0.1\",port=\"$EDOT\"} 1$"
 	run "a certificate named uses can't be deleted (exit 6)" 6 $J cert delete ns1 --yes
 	contains "take it out first"
 	run "encrypted-dns disable" 0 $J encrypted-dns disable