Release 0.3.0-rc.2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,61 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Added
+
+- Disabled records: a record can be disabled instead of deleted. It stays
+  in Jarl with its ID, TTL and comment but is left out of the zone (the
+  zone file lists it as a comment), and enabling it puts it back exactly
+  as it was. Web UI: a Disable/Enable button on each record, disabled
+  records greyed out with a badge, a filter for them, and a count in the
+  zone list. CLI: `jarl record disable|enable` (by ID or by name, type and
+  data, `--ptr` for the PTR record, `--missing-ok`), `record list
+  --disabled`, and `disable:`/`enable:` entries for `jarl apply -f`. API:
+  `POST /records/{id}/disable|enable`, `POST
+  /zones/{zone}/records/disable|enable`, a `disabled` field on records,
+  `?disabled=` on record lists and `record.disable|enable` operations.
+  Validation checks the zone as it is served: the last NS record can't be
+  disabled, enabling a record is checked like adding it, and a disabled
+  record that a CNAME now blocks gets a warning. Database schema 5.
+- DNSSEC for a zone whose parent zone is in Jarl: the DNSSEC tab gives the
+  `jarl record add PARENT NAME DS ...` command to copy and an "Add to
+  PARENT" button (staged like any change), links to the parent zone, and
+  says when the parent has the DS record. `jarl zone dnssec status` prints
+  the command too, and turning signing off gives the matching `jarl record
+  delete`.
+
+- CLI output for scripts: `-o id` prints just the IDs of what a command
+  shows or lists (`jarl zone show adbraun.lol -o id`), `-o
+  field=view,soa.serial` just those fields, tab separated. `-q` on `show`
+  and `list` prints the IDs too. With a change (`jarl record add ... -o
+  id`) they apply to the changed object.
+
+- Statistics: client lists (busiest and refused clients, in the web UI,
+  `jarl stats top clients|refused` and `jarl stats summary`) show the host
+  name Jarl's records have for each address: the PTR record's target, or
+  else the name of an A/AAAA record. Looked up in Jarl's own data, so no
+  DNS queries; an address without a record shows as before.
+- Zones list: a padlock after each signed zone's name, linking to its
+  DNSSEC tab (open and amber while signing is being turned off).
+
+### Changed
+
+- The web UI and API can listen on ports below 1024, such as 443:
+  `jarl.service` now gives jarld the `CAP_NET_BIND_SERVICE` capability
+  (and only that). With a unit that doesn't, jarld's error says what's
+  missing. See docs/configuration.md, "HTTPS on port 443".
+- Records table: names are no longer greyed out when they repeat the row
+  above (it made those records look inactive). Records of the same name
+  are separated by a faint line instead, and a full line marks where the
+  next name starts.
+
+### Fixed
+
+- `jarl record list`: one long value (a DKIM key) padded every row to its
+  length, so on a terminal each row wrapped onto a second, blank-looking
+  line. Long data is now shortened to fit the terminal; `--wide` shows it
+  in full, as does output to a pipe or file.
+
 ## [0.2.0] - 2026-10-09
 
 ### Added

README.md

@@ -166,9 +166,10 @@ review step.
 
 ## Status
 
-Version 0.2.0 is the current release.
-It adds DNSSEC signing, Porkbun support, two-factor login and view
-colours. Jarl is feature-complete for one server's configuration.
+Version 0.2.0 is the current release, and 0.3.0 is in testing
+(0.3.0-rc.2). 0.2.0 added DNSSEC signing, Porkbun support, two-factor
+login and view colours; 0.3.0 adds disabled records and scripting output
+for the CLI. Jarl is feature-complete for one server's configuration.
 Managing several servers from one jarld and dynamic updates are not
 handled yet ([concepts.md](docs/concepts.md#what-jarl-deliberately-doesnt-do-yet)).
 

VERSION

@@ -1 +1 @@
-0.2.0
+0.3.0-rc.2

cmd/jarl/changes.go

@@ -26,6 +26,10 @@ type batchEntry struct {
 	Delete map[string]any `yaml:"delete,omitempty" json:"delete,omitempty"`
 	Set    map[string]any `yaml:"set,omitempty" json:"set,omitempty"`
 	Update map[string]any `yaml:"update,omitempty" json:"update,omitempty"`
+	// Disable and Enable find records like Delete: by id, or by zone,
+	// name, type and optionally data.
+	Disable map[string]any `yaml:"disable,omitempty" json:"disable,omitempty"`
+	Enable  map[string]any `yaml:"enable,omitempty" json:"enable,omitempty"`
 	// Any API operation: op, id, data.
 	Op   string         `yaml:"op,omitempty" json:"op,omitempty"`
 	ID   int64          `yaml:"id,omitempty" json:"id,omitempty"`
@@ -57,25 +61,23 @@ func (b *batchFile) requests() ([]api.ChangeRequest, error) {
 	var out []api.ChangeRequest
 	for i, e := range b.Changes {
 		n := 0
-		for _, set := range []bool{e.Add != nil, e.Delete != nil, e.Set != nil, e.Update != nil, e.Op != ""} {
+		for _, set := range []bool{e.Add != nil, e.Delete != nil, e.Set != nil, e.Update != nil, e.Disable != nil, e.Enable != nil, e.Op != ""} {
 			if set {
 				n++
 			}
 		}
 		if n != 1 {
-			return nil, fmt.Errorf("change %d: use exactly one of add, delete, set, update or op", i+1)
+			return nil, fmt.Errorf("change %d: use exactly one of add, delete, set, update, disable, enable or op", i+1)
 		}
 		switch {
 		case e.Add != nil:
 			out = append(out, api.ChangeRequest{Op: "record.create", Data: rawJSON(e.Add)})
 		case e.Delete != nil:
-			d := e.Delete
-			if id, ok := toInt64(d["id"]); ok {
-				delete(d, "id")
-				out = append(out, api.ChangeRequest{Op: "record.delete", ID: id, Data: rawJSON(d)})
-			} else {
-				out = append(out, api.ChangeRequest{Op: "record.delete", Data: rawJSON(d)})
-			}
+			out = append(out, byIDOrMatch("record.delete", e.Delete))
+		case e.Disable != nil:
+			out = append(out, byIDOrMatch("record.disable", e.Disable))
+		case e.Enable != nil:
+			out = append(out, byIDOrMatch("record.enable", e.Enable))
 		case e.Set != nil:
 			s := e.Set
 			switch d := s["data"].(type) {
@@ -104,6 +106,16 @@ func (b *batchFile) requests() ([]api.ChangeRequest, error) {
 	return out, nil
 }
 
+// byIDOrMatch is a request for the record with d's id, or for the records
+// d matches.
+func byIDOrMatch(op string, d map[string]any) api.ChangeRequest {
+	if id, ok := toInt64(d["id"]); ok {
+		delete(d, "id")
+		return api.ChangeRequest{Op: op, ID: id, Data: rawJSON(d)}
+	}
+	return api.ChangeRequest{Op: op, Data: rawJSON(d)}
+}
+
 // submitBatch applies requests as one changeset, or stages them into the
 // changeset given with --changeset.
 func submitBatch(c *client.Client, description string, reqs []api.ChangeRequest) error {

cmd/jarl/complete.go

@@ -24,7 +24,7 @@ const completeTimeout = 3 * time.Second
 // setupCompletion adds value completion to the command tree.
 func setupCompletion(root *cobra.Command) {
 	root.RegisterFlagCompletionFunc("server", completeServers(true))
-	root.RegisterFlagCompletionFunc("output", cobra.FixedCompletions([]string{"table", "json", "yaml"}, cobra.ShellCompDirectiveNoFileComp))
+	root.RegisterFlagCompletionFunc("output", cobra.FixedCompletions([]string{"table", "json", "yaml", "id", "field="}, cobra.ShellCompDirectiveNoFileComp|cobra.ShellCompDirectiveNoSpace))
 	var walk func(c *cobra.Command)
 	walk = func(c *cobra.Command) {
 		for _, name := range []string{"view", "user", "zone"} {

cmd/jarl/dnssec.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"slices"
 	"strings"
 	"time"
 
@@ -110,7 +111,7 @@ A zone whose DS never reached the parent can be wiped at once instead
 				}
 				return nil
 			case st.Policy != "insecure":
-				if !confirm(fmt.Sprintf("Start turning DNSSEC off for %s? named keeps it signed until you've removed the DS record at your registrar.", displayName(st.Zone)), yes) {
+				if !confirm(fmt.Sprintf("Start turning DNSSEC off for %s? named keeps it signed until you've removed the DS record from the parent zone.", displayName(st.Zone)), yes) {
 					return fmt.Errorf("canceled")
 				}
 				next = "insecure"
@@ -133,7 +134,9 @@ A zone whose DS never reached the parent can be wiped at once instead
 			if err := report(resp); err != nil || !resp.Applied || flagQuiet {
 				return err
 			}
-			if next == "insecure" {
+			if next == "insecure" && st.ParentZone != "" {
+				fmt.Printf("\nNext: remove the DS record for %s from %s:\n  %s\nthen run\n  jarl zone dnssec check-ds %s\nRun 'jarl zone dnssec disable %s' again when 'status' says it has finished.\n", displayName(st.Zone), displayName(st.ParentZone), parentDSCommand(st, "delete", ""), args[0]+viewFlag(view), args[0]+viewFlag(view))
+			} else if next == "insecure" {
 				fmt.Printf("\nNext: remove the DS record for %s at your registrar, then run\n  jarl zone dnssec check-ds %s\nRun 'jarl zone dnssec disable %s' again when 'status' says it has finished.\n", displayName(st.Zone), args[0]+viewFlag(view), args[0]+viewFlag(view))
 			} else {
 				fmt.Println("\nDNSSEC is off. The old keys stay in the key directory until you wipe them ('jarl zone dnssec wipe').")
@@ -344,7 +347,7 @@ func printDNSSEC(w io.Writer, r *api.DNSSECResponse) {
 	if len(ds) > 0 && r.Policy != "insecure" {
 		where := "at your registrar"
 		if r.ParentZone != "" {
-			where = "in the parent zone " + displayName(r.ParentZone) + " (in Jarl: add it as a DS record there)"
+			where = "in the parent zone " + displayName(r.ParentZone) + ", which is in Jarl: add it as a DS record there"
 		}
 		fmt.Fprintf(w, "\nDS record for the parent zone (%s):\n", where)
 		if !r.Phase.CanPublishDS && r.Phase.DSReadyAt != nil {
@@ -353,10 +356,31 @@ func printDNSSEC(w io.Writer, r *api.DNSSECResponse) {
 		for _, k := range ds {
 			fmt.Fprintf(w, "  %s\n", strings.ReplaceAll(k.DS.Record, "\t", " "))
 			fmt.Fprintf(w, "  key tag %d, algorithm %d (%s), digest type %d (SHA-256), digest %s\n", k.DS.KeyTag, k.DS.Algorithm, k.AlgorithmName, k.DS.DigestType, k.DS.Digest)
+			if r.ParentZone != "" {
+				data := fmt.Sprintf("%d %d %d %s", k.DS.KeyTag, k.DS.Algorithm, k.DS.DigestType, k.DS.Digest)
+				if slices.ContainsFunc(r.ParentDS, func(d string) bool { return strings.EqualFold(d, data) }) {
+					fmt.Fprintf(w, "  %s has it.\n", displayName(r.ParentZone))
+				} else {
+					fmt.Fprintf(w, "  %s\n", parentDSCommand(r, "add", data))
+				}
+			}
 		}
 	}
 }
 
+// parentDSCommand is the jarl command that adds (or deletes) the zone's DS
+// record in its parent zone in Jarl.
+func parentDSCommand(r *api.DNSSECResponse, verb, data string) string {
+	parts := []string{"jarl record", verb, displayName(r.ParentZone), strings.TrimSuffix(r.Zone, "."+r.ParentZone), "DS"}
+	if data != "" {
+		parts = append(parts, data)
+	}
+	if r.ParentView != "" {
+		parts = append(parts, "--view", r.ParentView)
+	}
+	return strings.Join(parts, " ")
+}
+
 func dash(s string) string {
 	if s == "" {
 		return "-"

cmd/jarl/main.go

@@ -3,6 +3,7 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -11,6 +12,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -237,10 +239,10 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 	pf.Int64VarP(&flagChangeset, "changeset", "C", 0, "stage changes into this changeset instead of applying them (env JARL_CHANGESET)")
 	pf.BoolVarP(&flagDryRun, "dry-run", "n", false, "validate and show the changes without applying them")
 	pf.BoolVar(&flagForce, "force", false, "overwrite BIND files that were changed outside Jarl")
-	pf.StringVarP(&flagOutput, "output", "o", "table", "output format: table, json or yaml")
+	pf.StringVarP(&flagOutput, "output", "o", "table", "output format: table, json, yaml, id (just the IDs) or field=NAME[,NAME...] (just those fields, e.g. field=view or field=soa.serial)")
 	pf.BoolVar(&flagInsecure, "insecure", false, "don't verify the server's TLS certificate")
 	pf.StringVar(&flagCACert, "ca-cert", "", "PEM file with a CA to trust for the server's certificate")
-	pf.BoolVarP(&flagQuiet, "quiet", "q", false, "only print errors (and IDs where useful)")
+	pf.BoolVarP(&flagQuiet, "quiet", "q", false, "only print errors and IDs (with show and list: just the IDs, like -o id)")
 	root.AddGroup(&cobra.Group{ID: "dns", Title: "DNS commands:"}, &cobra.Group{ID: "changes", Title: "Changes:"}, &cobra.Group{ID: "admin", Title: "Administration:"})
 	add := func(group string, cmds ...*cobra.Command) {
 		for _, c := range cmds {
@@ -262,7 +264,15 @@ func ctx() context.Context { return context.Background() }
 // ---- output
 
 func output(v any, table func(w io.Writer)) error {
-	switch flagOutput {
+	format := flagOutput
+	quietIDs := flagQuiet && (format == "table" || format == "")
+	if quietIDs {
+		format = "id"
+	}
+	if fieldFormat(format) {
+		return outputFields(v, format, quietIDs)
+	}
+	switch format {
 	case "json":
 		enc := json.NewEncoder(os.Stdout)
 		enc.SetIndent("", "  ")
@@ -286,7 +296,79 @@ func output(v any, table func(w io.Writer)) error {
 		table(tw)
 		return tw.Flush()
 	}
-	return fmt.Errorf("unknown output format %q (use table, json or yaml)", flagOutput)
+	return fmt.Errorf("unknown output format %q (use table, json, yaml, id or field=NAME)", flagOutput)
+}
+
+// outputFields prints fields of each object (or of the one object), one
+// line per object with the fields separated by tabs, for scripts:
+// "id" prints the IDs, "field=view,soa.serial" those fields. Names are the
+// JSON field names (see -o json); a dot reaches into nested objects. A
+// field an object doesn't have prints as empty (the API leaves out empty
+// fields).
+func outputFields(v any, format string, quiet bool) error {
+	fields := []string{"id"}
+	if f, ok := strings.CutPrefix(format, "field="); ok {
+		fields = strings.Split(f, ",")
+	}
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+	dec := json.NewDecoder(bytes.NewReader(b))
+	dec.UseNumber()
+	var x any
+	if err := dec.Decode(&x); err != nil {
+		return err
+	}
+	items, ok := x.([]any)
+	if !ok {
+		items = []any{x}
+	}
+	if quiet && !slices.ContainsFunc(items, func(it any) bool { _, ok := lookupField(it, "id"); return ok }) {
+		return nil // -q on something without IDs: only errors
+	}
+	var out strings.Builder
+	for _, it := range items {
+		var vals []string
+		for _, f := range fields {
+			val, _ := lookupField(it, strings.TrimSpace(f))
+			vals = append(vals, fieldText(val))
+		}
+		out.WriteString(strings.Join(vals, "\t") + "\n")
+	}
+	_, err = io.WriteString(os.Stdout, out.String())
+	return err
+}
+
+// fieldFormat reports whether an -o format prints fields (id, field=...).
+func fieldFormat(format string) bool {
+	return format == "id" || strings.HasPrefix(format, "field=")
+}
+
+func lookupField(v any, path string) (any, bool) {
+	for _, part := range strings.Split(path, ".") {
+		m, ok := v.(map[string]any)
+		if !ok {
+			return nil, false
+		}
+		if v, ok = m[part]; !ok {
+			return nil, false
+		}
+	}
+	return v, true
+}
+
+func fieldText(v any) string {
+	switch x := v.(type) {
+	case nil:
+		return ""
+	case string:
+		return x
+	case json.Number, bool:
+		return fmt.Sprint(x)
+	}
+	b, _ := json.Marshal(v)
+	return string(b)
 }
 
 func dot(name string) string {
@@ -391,6 +473,14 @@ func report(resp *api.MutationResponse) error {
 	if flagOutput == "json" || flagOutput == "yaml" {
 		return output(resp, nil)
 	}
+	if fieldFormat(flagOutput) {
+		// The changed object, if the response has it ("jarl record add
+		// ... -o id" prints the new record's ID).
+		if len(resp.Object) > 0 {
+			return outputFields(resp.Object, flagOutput, false)
+		}
+		return outputFields(resp, flagOutput, false)
+	}
 	w := os.Stdout
 	r := client.ParseResult(resp.Result)
 	switch {

cmd/jarl/main_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -22,6 +23,8 @@ changes:
   - set:    {zone: example.com, name: api, type: A, data: 192.0.2.5}
   - set:    {zone: example.com, name: gone, type: TXT}
   - update: {id: 13, data: 192.0.2.9}
+  - disable: {zone: example.com, name: www, type: A, data: 192.0.2.1, ptr: true}
+  - enable: {id: 14}
   - op: zone.create
     data: {name: lab.example.com}
 `
@@ -44,6 +47,8 @@ changes:
 		{"rrset.replace", 0, `{"data":["192.0.2.5"],"name":"api","type":"A","zone":"example.com"}`},
 		{"rrset.replace", 0, `{"data":[],"name":"gone","type":"TXT","zone":"example.com"}`},
 		{"record.update", 13, `{"data":"192.0.2.9"}`},
+		{"record.disable", 0, `{"data":"192.0.2.1","name":"www","ptr":true,"type":"A","zone":"example.com"}`},
+		{"record.enable", 14, `{}`},
 		{"zone.create", 0, `{"name":"lab.example.com"}`},
 	}
 	if len(reqs) != len(want) {
@@ -112,6 +117,38 @@ func TestListValue(t *testing.T) {
 // filters they send: flags bound to variables shared between subcommands
 // must not leak defaults (zone create's --type primary once hid every
 // non-primary zone from 'zone list').
+func TestDisableCommands(t *testing.T) {
+	var got string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got = r.Method + " " + r.URL.Path + "?" + r.URL.RawQuery
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"applied":true,"changeset_id":1}`))
+	}))
+	defer srv.Close()
+	t.Setenv("JARL_CLI_CONFIG", filepath.Join(t.TempDir(), "cli.yaml"))
+	for _, tc := range []struct {
+		args []string
+		want string
+	}{
+		{[]string{"record", "disable", "example.com", "www", "A"}, "POST /api/v1/zones/example.com/records/disable?name=www&type=A"},
+		{[]string{"record", "disable", "example.com", "www", "A", "192.0.2.1", "--ptr", "--view", "internal"}, "POST /api/v1/zones/example.com/records/disable?data=192.0.2.1&name=www&ptr=1&type=A&view=internal"},
+		{[]string{"record", "enable", "--id", "12", "--ptr"}, "POST /api/v1/records/12/enable?ptr=1"},
+		{[]string{"record", "enable", "example.com", "old", "CNAME", "--missing-ok"}, "POST /api/v1/zones/example.com/records/enable?missing_ok=1&name=old&type=CNAME"},
+	} {
+		got = ""
+		root := rootCmd()
+		root.SetArgs(append(tc.args, "--server", srv.URL, "--token", "jarl_test_token", "-o", "json"))
+		root.SetOut(io.Discard)
+		if err := root.Execute(); err != nil {
+			t.Errorf("%v: %v", tc.args, err)
+			continue
+		}
+		if got != tc.want {
+			t.Errorf("%v sent %q, want %q", tc.args, got, tc.want)
+		}
+	}
+}
+
 func TestListQueries(t *testing.T) {
 	var got string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -154,3 +191,44 @@ func TestListQueries(t *testing.T) {
 		}
 	}
 }
+
+func TestOutputFields(t *testing.T) {
+	capture := func(f func() error) string {
+		t.Helper()
+		r, w, _ := os.Pipe()
+		old := os.Stdout
+		os.Stdout = w
+		err := f()
+		os.Stdout = old
+		w.Close()
+		b, _ := io.ReadAll(r)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(b)
+	}
+	zones := []map[string]any{
+		{"id": 12, "name": "adbraun.lol.", "view": "external", "soa": map[string]any{"serial": 2026100901}},
+		{"id": 3, "name": "lab.adbraun.lol.", "soa": map[string]any{"serial": 7}},
+	}
+	defer func(o string, q bool) { flagOutput, flagQuiet = o, q }(flagOutput, flagQuiet)
+	for _, tc := range []struct {
+		format string
+		quiet  bool
+		v      any
+		want   string
+	}{
+		{"id", false, zones, "12\n3\n"},
+		{"id", false, zones[0], "12\n"},
+		{"field=name,view,soa.serial", false, zones, "adbraun.lol.\texternal\t2026100901\nlab.adbraun.lol.\t\t7\n"},
+		{"field=soa", false, zones[1], "{\"serial\":7}\n"},
+		{"table", true, zones, "12\n3\n"},
+		{"table", true, map[string]any{"status": "ok"}, ""}, // -q without IDs: nothing
+	} {
+		flagOutput, flagQuiet = tc.format, tc.quiet
+		got := capture(func() error { return output(tc.v, func(io.Writer) { t.Error("table printed") }) })
+		if got != tc.want {
+			t.Errorf("-o %s (quiet %v) = %q, want %q", tc.format, tc.quiet, got, tc.want)
+		}
+	}
+}

cmd/jarl/stats.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -109,7 +110,11 @@ export the data.`,
 					}
 					fmt.Fprintf(w, "\n%s\t\n", map[string]string{stats.KindName: "Top names", stats.KindClient: "Top clients", stats.KindNXDomain: "Top NXDOMAIN names"}[k])
 					for _, e := range es {
-						fmt.Fprintf(w, "  %s\t%d\n", e.Key, e.Count)
+						key := e.Key
+						if e.Name != "" {
+							key += " (" + e.Name + ")"
+						}
+						fmt.Fprintf(w, "  %s\t%d\n", key, e.Count)
 					}
 				}
 			})
@@ -152,9 +157,18 @@ export the data.`,
 				if head == "" {
 					head = "NAME"
 				}
-				fmt.Fprintf(w, "#\t%s\tQUERIES\t\n", head)
+				named := slices.ContainsFunc(es, func(e stats.Entry) bool { return e.Name != "" })
+				if named {
+					fmt.Fprintf(w, "#\t%s\tHOST\tQUERIES\t\n", head)
+				} else {
+					fmt.Fprintf(w, "#\t%s\tQUERIES\t\n", head)
+				}
 				for i, e := range es {
-					fmt.Fprintf(w, "%d\t%s\t%d\t%s\n", i+1, e.Key, e.Count, bar(e.Count, es[0].Count, 20))
+					if named {
+						fmt.Fprintf(w, "%d\t%s\t%s\t%d\t%s\n", i+1, e.Key, dash(e.Name), e.Count, bar(e.Count, es[0].Count, 20))
+					} else {
+						fmt.Fprintf(w, "%d\t%s\t%d\t%s\n", i+1, e.Key, e.Count, bar(e.Count, es[0].Count, 20))
+					}
 				}
 			})
 		},

cmd/jarl/zones.go

@@ -3,12 +3,14 @@ package main
 import (
 	"encoding/json"
 	"fmt"
+	"golang.org/x/term"
 	"io"
 	"net/netip"
 	"net/url"
 	"os"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 
 	"github.com/spf13/cobra"
 
@@ -75,7 +77,11 @@ func zoneCmd() *cobra.Command {
 					fmt.Fprintf(w, "Serial:\t%d\n", z.SOA.Serial)
 					fmt.Fprintf(w, "SOA:\t%s %s refresh %d retry %d expire %d minimum %d\n", z.SOA.MName, z.SOA.RName, z.SOA.Refresh, z.SOA.Retry, z.SOA.Expire, z.SOA.Minimum)
 					fmt.Fprintf(w, "Default TTL:\t%d\n", z.DefaultTTL)
-					fmt.Fprintf(w, "Records:\t%d\n", z.Records)
+					if z.Disabled > 0 {
+						fmt.Fprintf(w, "Records:\t%d (%d disabled: jarl record list %s --disabled)\n", z.Records, z.Disabled, args[0])
+					} else {
+						fmt.Fprintf(w, "Records:\t%d\n", z.Records)
+					}
 				}
 				if z.InView != "" {
 					fmt.Fprintf(w, "In view:\t%s\n", z.InView)
@@ -403,7 +409,7 @@ func jsonUnmarshal(b []byte, v any) error { return json.Unmarshal(b, v) }
 func recordCmd() *cobra.Command {
 	cmd := &cobra.Command{Use: "record", Aliases: []string{"records", "rr"}, Short: "Manage records in primary zones"}
 	var view, name, typ, search, comment, ttlArg string
-	var ptr, missingOK, yes bool
+	var ptr, missingOK, yes, onlyDisabled, wide bool
 	var id int64
 
 	list := &cobra.Command{
@@ -419,18 +425,31 @@ func recordCmd() *cobra.Command {
 			for k, v := range q("name", name, "type", strings.ToUpper(typ), "q", search) {
 				qv[k] = v
 			}
+			if onlyDisabled {
+				qv.Set("disabled", "1")
+			}
 			var recs []api.Record
 			if err := c.Get(ctx(), path+"/records", qv, &recs); err != nil {
 				return err
 			}
 			return output(recs, func(w io.Writer) {
-				fmt.Fprintln(w, "ID\tNAME\tTTL\tTYPE\tDATA\tCOMMENT")
+				rows := [][]string{{"ID", "NAME", "TTL", "TYPE", "DATA", "COMMENT"}}
 				for _, r := range recs {
 					ttl := fmt.Sprint(r.EffectiveTTL)
 					if r.TTL == nil {
 						ttl += "*"
 					}
-					fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%s\n", r.ID, r.RelativeName, ttl, r.Type, r.Data, r.Comment)
+					comment := r.Comment
+					if r.Disabled {
+						comment = strings.TrimSpace("[disabled] " + comment)
+					}
+					rows = append(rows, []string{fmt.Sprint(r.ID), r.RelativeName, ttl, r.Type, r.Data, comment})
+				}
+				if !wide {
+					fitColumn(rows, 4)
+				}
+				for _, row := range rows {
+					fmt.Fprintln(w, strings.Join(row, "\t"))
 				}
 			})
 		},
@@ -439,6 +458,8 @@ func recordCmd() *cobra.Command {
 	list.Flags().StringVar(&name, "name", "", "only this name")
 	list.Flags().StringVarP(&typ, "type", "t", "", "only this type")
 	list.Flags().StringVar(&search, "search", "", "only records whose name, data or comment contains this")
+	list.Flags().BoolVar(&onlyDisabled, "disabled", false, "only disabled records")
+	list.Flags().BoolVarP(&wide, "wide", "w", false, "show long data in full (on a terminal it is shortened to fit)")
 
 	add := &cobra.Command{
 		Use:   "add ZONE NAME TYPE DATA...",
@@ -618,7 +639,83 @@ spaces.
 	set.Flags().StringVar(&ttlArg, "ttl", "", "TTL for the RRset")
 	set.Flags().StringVar(&comment, "comment", "", "comment for new records")
 
-	cmd.AddCommand(list, add, update, del, set)
+	toggle := func(disable bool) *cobra.Command {
+		verb := "enable"
+		long := `Enable disabled records again: by name and type (all of them, or only the
+one with DATA), or one record by ID. The record is checked as if it were
+added, so a CNAME added in the meantime at its name stops it.
+
+  jarl record enable example.com www A 192.0.2.10
+  jarl record enable --id 1234 --ptr`
+		if disable {
+			verb = "disable"
+			long = `Disable records: they stay in Jarl, with their TTL, comment and ID, but are
+left out of the zone (the zone file lists them as comments) until they are
+enabled again. Select them by name and type (all of them, or only the one
+with DATA), or one record by ID.
+
+  jarl record disable example.com www A 192.0.2.10 --ptr   # and its PTR record
+  jarl record disable example.com old CNAME
+  jarl record disable --id 1234
+  jarl record list example.com --disabled`
+		}
+		var tview string
+		var tid int64
+		var tptr, tmissing bool
+		c := &cobra.Command{
+			Use:   verb + " ZONE NAME TYPE [DATA...]  |  " + verb + " --id ID",
+			Short: strings.ToUpper(verb[:1]) + verb[1:] + " records",
+			Long:  long,
+			RunE: func(cmd *cobra.Command, args []string) error {
+				c, err := newClient()
+				if err != nil {
+					return err
+				}
+				qv := q()
+				if tptr {
+					qv.Set("ptr", "1")
+				}
+				if tid > 0 {
+					resp, err := c.Mutate(ctx(), "POST", "/records/"+strconv.FormatInt(tid, 10)+"/"+verb, qv, nil)
+					if err != nil {
+						return err
+					}
+					return report(resp)
+				}
+				if len(args) < 3 {
+					return fmt.Errorf("give ZONE NAME TYPE [DATA], or --id")
+				}
+				path, zq := zonePath(args[0], tview)
+				for k, v := range zq {
+					qv[k] = v
+				}
+				qv.Set("name", args[1])
+				qv.Set("type", args[2])
+				if len(args) > 3 {
+					qv.Set("data", strings.Join(args[3:], " "))
+				}
+				if tmissing {
+					qv.Set("missing_ok", "1")
+				}
+				resp, err := c.Mutate(ctx(), "POST", path+"/records/"+verb, qv, nil)
+				if err != nil && tmissing && strings.HasSuffix(err.Error(), "nothing to do") {
+					fmt.Println("nothing to do")
+					return nil
+				}
+				if err != nil {
+					return err
+				}
+				return report(resp)
+			},
+		}
+		c.Flags().StringVar(&tview, "view", "", "view of the zone")
+		c.Flags().Int64Var(&tid, "id", 0, verb+" the record with this ID")
+		c.Flags().BoolVar(&tmissing, "missing-ok", false, "succeed when nothing matches or the records are already "+verb+"d")
+		c.Flags().BoolVar(&tptr, "ptr", false, "also "+verb+" the matching PTR record (A/AAAA)")
+		return c
+	}
+
+	cmd.AddCommand(list, add, update, del, set, toggle(true), toggle(false))
 	return cmd
 }
 
@@ -636,3 +733,39 @@ func setTTL(body map[string]any, ttl string) error {
 	}
 	return nil
 }
+
+// fitColumn shortens column col of a table (header row first) so that the
+// rows fit the terminal: the table pads every row to its longest cell, so
+// one long TXT record would make every row wrap. Nothing is shortened when
+// standard output isn't a terminal.
+func fitColumn(rows [][]string, col int) {
+	fd := int(os.Stdout.Fd())
+	if !term.IsTerminal(fd) {
+		return
+	}
+	width, _, err := term.GetSize(fd)
+	if err != nil || width <= 0 {
+		return
+	}
+	widths := make([]int, len(rows[0]))
+	for _, row := range rows {
+		for i, c := range row {
+			widths[i] = max(widths[i], utf8.RuneCountInString(c))
+		}
+	}
+	used := 0
+	for i, w := range widths {
+		if i != col {
+			used += w + 2 // the table's padding
+		}
+	}
+	if col == len(widths)-1 {
+		used -= 2
+	}
+	limit := max(width-used-2, 24)
+	for _, row := range rows[1:] {
+		if r := []rune(row[col]); len(r) > limit {
+			row[col] = string(r[:limit-1]) + "…"
+		}
+	}
+}

deploy/systemd/jarl.service

@@ -40,8 +40,10 @@ ProtectHome=yes
 PrivateTmp=yes
 PrivateDevices=yes
 NoNewPrivileges=yes
-CapabilityBoundingSet=
-AmbientCapabilities=
+# The only privilege jarld gets: listening on ports below 1024 (443 for the
+# web UI). Nothing else, and NoNewPrivileges still applies.
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes

docs/api.md

@@ -110,7 +110,8 @@ on the resources below, except users and tokens) works the same way:
 
 Reads accept `?changeset=ID` too. They then show the configuration as it
 will be after the changeset, with `"pending": "add" | "change" | "delete"`
-on affected zones and records.
+on affected zones and records (`"disable"` or `"enable"` for a record
+that is only being disabled or enabled).
 
 The response of an applied change:
 
@@ -333,14 +334,18 @@ registrar_error`.
 
 | Method | Path | Body / query |
 |--------|------|--------------|
-| GET | `/zones/{zone}/records` | `?name=`, `?type=`, `?q=` |
+| GET | `/zones/{zone}/records` | `?name=`, `?type=`, `?q=`, `?disabled=1` (only disabled records) or `0` (only enabled ones) |
 | POST | `/zones/{zone}/records` | a RecordInput, or an array of them (one changeset) |
 | DELETE | `/zones/{zone}/records` | `?name=&type=[&data=][&missing_ok=1][&ptr=1]`: delete by match |
+| POST | `/zones/{zone}/records/disable` | same query as delete by match: disable the matching records |
+| POST | `/zones/{zone}/records/enable` | same query: enable them again |
 | PUT | `/zones/{zone}/rrsets/{name}/{type}` | `{"data": ["192.0.2.1", "192.0.2.2"], "ttl": 60, "comment": "..."}`: make the RRset exactly this |
 | DELETE | `/zones/{zone}/rrsets/{name}/{type}` | delete the whole RRset |
 | GET | `/records/{id}` | |
 | PATCH | `/records/{id}` | RecordInput fields to change (`If-Match` supported) |
 | DELETE | `/records/{id}` | `?ptr=1` also deletes the matching PTR |
+| POST | `/records/{id}/disable` | `?ptr=1` also disables the matching PTR |
+| POST | `/records/{id}/enable` | `?ptr=1` also enables the matching PTR |
 
 RecordInput:
 
@@ -351,12 +356,26 @@ RecordInput:
   "data": "192.0.2.10",        // zone file syntax; TXT/SPF take plain text
   "ttl": 300,                  // null or absent: the zone's default TTL
   "comment": "web server",
-  "ptr": true                  // A/AAAA: also create/move/delete the PTR in the reverse zone
+  "disabled": false,           // true: keep the record in Jarl but out of the zone
+  "ptr": true                  // A/AAAA: also create/move/delete (or disable/enable) the PTR in the reverse zone
 }
 ```
 
 Responses add `zone`, `view`, `relative_name`, `effective_ttl`, and `text`
-(the decoded value of TXT records).
+(the decoded value of TXT records). Zones have `disabled_count` when
+some of their records are disabled.
+
+**Disabled records** stay in Jarl, with their ID, TTL and comment, but are
+left out of the zone: the zone file lists them as comments (`; disabled:
+www IN A 192.0.2.10`). Disabling and enabling are ordinary changes (staged,
+reviewed, reverted like any other). Validation checks the zone as it is
+served, so disabling the zone's last NS record is refused, and enabling a
+record is checked as if it were added: a CNAME added at its name in the
+meantime stops it (and gives a `disabled_conflict` warning until then).
+`PUT /rrsets` makes the RRset exactly the given data: a disabled record
+with one of the values is enabled, other disabled records are left alone.
+Disabling a record that is already disabled is a 409; with `missing_ok=1`
+(by match) it's "nothing to do".
 
 ### Views
 
@@ -436,6 +455,7 @@ An **Operation** is `{"op": "...", "id": 0, "base_version": 0, "data": {...}}`:
 | `record.create` | | RecordInput + `"zone": "adbraun.lol"` (or `zone_id`) and `"view"` |
 | `record.update` | record | RecordInput |
 | `record.delete` | record, or 0 with `zone`, `name`, `type`, optional `data`, `missing_ok`, `ptr` | |
+| `record.disable` / `record.enable` | record, or 0 with the same match fields as `record.delete` | stored as `record.update` operations |
 | `rrset.replace` | | `{"zone", "view", "name", "type", "ttl", "data": [...]}` (empty data deletes the RRset) |
 | `view.create` / `view.update` / `view.delete` / `view.reorder` | view (update/delete) | ViewInput / `{"ids": [...]}` |
 | `acl.create` / `acl.update` / `acl.delete` | ACL | ACL fields |
@@ -466,7 +486,7 @@ Needs `stats:read`. When statistics are disabled, every endpoint but
 | GET | `/stats/status` | | `{enabled, query_log, statistics_channel, log_file, last_poll, last_log_line, log_lines_read, first_data, retention, warnings}` |
 | GET | `/stats/summary` | `since` (90m, 24h, 7d, 2w; default 24h), `top` (default 10) | totals, `avg_qps`, `peak`, `rcodes`, `qtypes`, `views`, `zones`, `answers`, `transport`, `cache_hit_ratio`, `nxdomain_ratio`, `tops` |
 | GET | `/stats/timeline` | `since`, `step` (auto, 1m, 5m, 15m, 1h, 6h, 1d), `key` (repeatable or comma separated; `rcode:*` = every counter of a group; default `queries`) | `{step, times: [unix...], series: [{key, values}]}` |
-| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused), `since`, `limit` (default 20) | `[{key, count}]` |
+| GET | `/stats/top` | `kind` (name, client, nxdomain, servfail, refused), `since`, `limit` (default 20) | `[{key, count}]`; client and refused entries add `name`, the host name of Jarl's record for the address (the summary's client list too) |
 | GET | `/stats/heatmap` | `since` (default 28d), `key` (default queries) | `{key, from, avg[7][24], samples[7][24]}`, Monday first, local time, `-1` = no data |
 | GET | `/stats/breakdown` | `group` (qtype, rcode, view, zone, answer, transport, rtt, dnssec, cache, ratelimit), `since` | `[{key, count}]` |
 

docs/cli.md

@@ -139,10 +139,11 @@ to stderr with `-o json` or `-o yaml`, so stdout holds just the documents.
 | Flag | Meaning |
 |------|---------|
 | `-o table\|json\|yaml` | Output format. JSON and YAML have the API's full objects, for scripts. |
+| `-o id`, `-o field=NAME[,NAME...]` | Just the IDs, or just those fields, one line per object (fields separated by tabs). See [Scripting tips](#scripting-tips). |
 | `-n, --dry-run` | Validate and show the diff without changing anything. |
 | `-C, --changeset ID` | Stage the change into an open changeset instead of applying it. |
 | `--force` | Overwrite BIND files that were changed outside Jarl (drift). |
-| `-q, --quiet` | Print only errors, or just the ID where a command creates something. |
+| `-q, --quiet` | Print only errors, or just the IDs: of what a command creates, or what `show` and `list` find (like `-o id`). |
 
 ## Exit codes
 
@@ -245,7 +246,7 @@ Jarl.)
 ## Records
 
 ```sh
-jarl record list adbraun.lol [--name www] [-t A] [--search nas]
+jarl record list adbraun.lol [--name www] [-t A] [--search nas] [--disabled]
 jarl record add adbraun.lol nas A 192.168.1.20 --ptr --comment "synology"
 jarl record add adbraun.lol @ MX 10 mail
 jarl record add adbraun.lol @ TXT "v=spf1 mx -all"      # plain text, quoting is automatic
@@ -257,6 +258,9 @@ jarl record update 1234 --ttl default
 jarl record delete adbraun.lol www A                      # every A record of www
 jarl record delete adbraun.lol www A 192.168.1.10         # just this one
 jarl record delete --id 1234 [--ptr]
+jarl record disable adbraun.lol www A 192.168.1.10 --ptr  # out of the zone, kept in Jarl
+jarl record enable adbraun.lol www A 192.168.1.10 --ptr   # back again
+jarl record disable --id 1234                             # by ID; same for enable
 
 # reverse zones: name records by address; the host name needs no final dot
 jarl record add 0.10.10.in-addr.arpa 10.10.0.20 PTR nas.adbraun.lol
@@ -273,6 +277,16 @@ by Jarl). Every record type BIND supports can be used. Jarl knows the
 syntax of the common ones and checks them strictly, and the rest are
 validated by parsing.
 
+**Disabling** a record takes it out of the zone without deleting it: it
+keeps its ID, TTL and comment, the zone file lists it as a comment
+(`; disabled: www IN A ...`), and `enable` puts it back exactly as it
+was. `record list` marks disabled records `[disabled]`, and `zone show`
+counts them. The zone is validated as it is served: you can't disable its
+last NS record, and enabling a record is checked like adding it (a CNAME
+added at the same name in the meantime stops it). `record set` enables a
+disabled record whose value it is given, and leaves other disabled
+records alone.
+
 ## Batches: `jarl apply -f`
 
 Several changes that must succeed or fail together:
@@ -287,6 +301,7 @@ changes:
   - set:    {zone: adbraun.lol, name: api, type: A, data: [192.168.1.41, 192.168.1.42], ttl: 60}
   - update: {id: 1235, comment: "old web server, remove in November"}
   - delete: {id: 1240}
+  - disable: {zone: adbraun.lol, name: old, type: A}   # or {id: ...}; enable: likewise
   - op: acl.update                     # any API operation (see api.md)
     id: 3
     data: {elements: [192.168.1.0/24, 10.10.0.0/16]}
@@ -426,8 +441,25 @@ See [acme.md](acme.md) for certbot, acme.sh and a dedicated ACME zone.
 
 ## Scripting tips
 
-* `-o json` gives full API objects. Pipe them to `jq`.
-* `-q` with `create` commands prints just the ID or token.
+* `-o id` prints just the IDs of what a `show` or `list` command finds, one
+  per line, and `-o field=...` picks fields (their names are those of
+  `-o json`; a dot reaches inside, as in `soa.serial`; a field an object
+  doesn't have prints as empty). For changes, they apply to the changed
+  object:
+
+  ```sh
+  ZONE=$(jarl zone show adbraun.lol --view external -o id)
+  jarl record list adbraun.lol --name www -t A -o id | xargs -n1 jarl record disable --id
+  jarl zone show adbraun.lol -o field=view,soa.serial          # external	2026100901
+  jarl zone list -o field=id,name,view
+  ID=$(jarl record add adbraun.lol www A 192.0.2.10 -o id)     # the new record's ID
+  ```
+* `-q` with `create` commands prints just the ID or token, and with `show`
+  and `list` just the IDs. Commands without IDs (status, checks) print
+  nothing but errors.
+* `jarl record list` on a terminal shortens data too long for a line
+  (`…`); `--wide` shows it in full, and so does output to a pipe or file.
 * Check `$?` against the exit code table.
 * `jarl record delete ... --missing-ok` succeeds when nothing matches, which
-  keeps cleanup scripts idempotent. `jarl record set` is idempotent by nature.
+  keeps cleanup scripts idempotent. So does `record disable|enable
+  --missing-ok`, also when the records are already disabled (enabled). `jarl record set` is idempotent by nature.

docs/configuration.md

@@ -18,7 +18,7 @@ The CLI has its own small configuration file, described in [cli.md](cli.md).
 
 | Key | Default | Meaning |
 |-----|---------|---------|
-| `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. |
+| `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. Ports below 1024 (`"192.168.10.2:443"`) work because `jarl.service` gives jarld the `CAP_NET_BIND_SERVICE` capability, and only that ([HTTPS on port 443](#example-https-on-port-443)). |
 | `socket` | `/run/jarl/jarl.sock` | A local unix socket for the API. Requests on it from root or jarld's own user need no token and have administrator rights; anyone else must send a token ([permissions.md](permissions.md#the-local-socket)). The `jarl` CLI uses it when no server is configured. At most 107 bytes long; `""` turns it off. If it can't be created, jarld logs a warning and serves the network addresses only. |
 | `tls.cert_file`, `tls.key_file` | (empty: plain HTTP) | PEM certificate chain and key. Both or neither. The files are rechecked every 10 minutes and on SIGHUP (`systemctl reload jarl`), so renewed certificates are used without a restart. |
 | `trusted_proxies` | `[]` | Addresses or prefixes of reverse proxies whose `X-Forwarded-For` and `X-Forwarded-Proto` (or `Forwarded: proto=`) headers are believed. Needed for correct client IPs in the audit log and for rate limiting behind a proxy, and for knowing that a proxied request came over HTTPS (the session cookie's Secure flag, `acme.httpreq`). From other addresses these headers are ignored. |
@@ -149,6 +149,32 @@ audit:
   retention_days: 730
 ```
 
+## Example: HTTPS on port 443
+
+```yaml
+listen:
+  - "127.0.0.1:8053"        # the CLI on the server keeps using this (or the socket)
+  - "192.168.10.2:443"
+tls:
+  cert_file: /etc/jarl/tls/fullchain.pem
+  key_file: /etc/jarl/tls/privkey.pem
+```
+
+jarld runs as the unprivileged `jarl` user, and binding a port below 1024
+needs the `CAP_NET_BIND_SERVICE` capability, which `jarl.service` grants
+(`AmbientCapabilities=CAP_NET_BIND_SERVICE`; nothing else). The unit in
+Jarl 0.2.0 and earlier doesn't, and jarld then fails with "bind:
+permission denied". Upgrading the package installs the new unit; until
+then, a drop-in does the same:
+
+```sh
+sudo systemctl edit jarl
+#   [Service]
+#   CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+#   AmbientCapabilities=CAP_NET_BIND_SERVICE
+sudo systemctl restart jarl
+```
+
 ## Example: behind nginx
 
 ```yaml

docs/dnssec.md

@@ -122,8 +122,18 @@ can make validating resolvers reject cached answers. Then:
    [DNSViz](https://dnsviz.net/) gives an independent picture.
 
 If the parent zone is itself a primary zone in Jarl (`home.adbraun.lol`
-inside `adbraun.lol`), the DNSSEC tab says so: add the DS as a record in
-that zone.
+inside `adbraun.lol`), the DS goes in as a record in that zone, and Jarl
+gives you both ways to add it: an **Add to adbraun.lol** button on the
+DNSSEC tab, and the command, which `jarl zone dnssec status` prints too:
+
+```sh
+jarl record add adbraun.lol home DS 51126 13 2 FFBECE3D...
+```
+
+Once the parent zone has it, the tab and `status` say so. When turning
+signing off, the steps give the matching `jarl record delete adbraun.lol
+home DS`. The zone must be delegated first (NS records for `home` in
+`adbraun.lol`), or validation refuses the DS.
 
 ## Putting your own name servers on the internet
 

docs/stats.md

@@ -111,6 +111,16 @@ Nothing else is stored. In particular there's no per-query record, so you
 can't look up "who asked for X at 14:02". That is deliberate, both for size
 and privacy.
 
+**Client names.** Where the client lists (busiest and refused clients) show
+an address Jarl has a record for, they show its host name too: the PTR
+record's target, or else the name of an A/AAAA record with that address
+(disabled records don't count, and only records you may read). This is
+looked up in Jarl's own data when the list is shown, not stored and not
+asked of DNS, so it is instant and adds no queries of its own. The name is
+what the records say now: with DHCP, an address seen last week may have
+been another machine. Anonymized clients (`anonymize_clients`) are
+prefixes and get no name.
+
 ## Using it
 
 **Web UI**: Statistics. Pick a range (1 hour to 90 days); everything on the

internal/api/types.go

@@ -19,9 +19,11 @@ const Prefix = "/api/v1"
 // Zone is a zone as returned by the API.
 type Zone struct {
 	model.Zone
-	Display  string `json:"display_name"`
-	View     string `json:"view,omitempty"`
-	Records  int    `json:"record_count"`
+	Display string `json:"display_name"`
+	View    string `json:"view,omitempty"`
+	Records int    `json:"record_count"`
+	// Disabled is how many of the records are disabled.
+	Disabled int    `json:"disabled_count,omitempty"`
 	ZoneFile string `json:"zone_file,omitempty"` // the file named loads
 	RName    string `json:"rname_email,omitempty"`
 	// Registrar names the registrar Jarl can manage the domain at
@@ -40,7 +42,8 @@ type Record struct {
 	EffectiveTTL uint32 `json:"effective_ttl"`
 	// Text is the decoded value of TXT and SPF records.
 	Text *string `json:"text,omitempty"`
-	// Pending is set when listing with a changeset: add, change or delete.
+	// Pending is set when listing with a changeset: add, change, delete,
+	// disable or enable.
 	Pending string `json:"pending,omitempty"`
 }
 
@@ -370,7 +373,12 @@ type DNSSECResponse struct {
 	*dnssec.Status
 	// ParentZone is set when the parent zone is a primary zone in Jarl
 	// (in the same view): the DS record then goes there, as a record.
-	ParentZone string `json:"parent_zone,omitempty"`
+	ParentZone   string `json:"parent_zone,omitempty"`
+	ParentZoneID int64  `json:"parent_zone_id,omitempty"`
+	ParentView   string `json:"parent_view,omitempty"`
+	// ParentDS is the DS records the parent zone in Jarl has for the
+	// zone (record data, e.g. "51126 13 2 FFBE...").
+	ParentDS []string `json:"parent_ds,omitempty"`
 	// Registrar names the registrar Jarl can publish the DS at
 	// ("porkbun"), when one is configured in jarl.yaml.
 	Registrar string `json:"registrar,omitempty"`

internal/engine/diffops.go

@@ -88,7 +88,7 @@ func DiffOps(from, to *model.State) []model.Op {
 	}
 	for _, k := range sortedKeys(to.Records) {
 		n := to.Records[k]
-		in := RecordInput{ZoneID: n.ZoneID, Name: &n.Name, Type: &n.Type, Data: &n.Data, Comment: &n.Comment}
+		in := RecordInput{ZoneID: n.ZoneID, Name: &n.Name, Type: &n.Type, Data: &n.Data, Comment: &n.Comment, Disabled: &n.Disabled}
 		if n.TTL != nil {
 			in.TTL = model.Some(*n.TTL)
 		} else {

internal/engine/disable_test.go

@@ -0,0 +1,176 @@
+package engine
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+func disableReq(id int64, ptr bool) Request {
+	return NewRequest(OpRecordDisable, id, RecordInput{PTR: ptr})
+}
+
+func enableReq(id int64, ptr bool) Request {
+	return NewRequest(OpRecordEnable, id, RecordInput{PTR: ptr})
+}
+
+func (env *testEnv) zoneFile(name string) string {
+	env.t.Helper()
+	b, err := os.ReadFile(filepath.Join(env.dir, "zones/_default", name+".zone"))
+	if err != nil {
+		env.t.Fatal(err)
+	}
+	return string(b)
+}
+
+func serialOf(env *testEnv, zone string) uint32 {
+	return env.state().ZonesNamed(zone)[0].SOA.Serial
+}
+
+func TestDisableRecord(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, rec("example.com", "www", "A", "192.0.2.10"))
+	www := findRec(env.state(), "www.example.com.", "A")
+	serial := serialOf(env, "example.com")
+
+	res := env.submit(env.admin, disableReq(www.ID, false))
+	if len(res.Ops) != 1 || res.Ops[0].Summary != "disable www.example.com. A 192.0.2.10" {
+		t.Fatalf("ops = %+v", res.Ops)
+	}
+	if r := env.state().Records[www.ID]; r == nil || !r.Disabled {
+		t.Fatalf("record = %+v", r)
+	}
+	zf := env.zoneFile("example.com")
+	if !strings.Contains(zf, "; disabled: www\t\tIN\tA\t192.0.2.10\n") || strings.Contains(zf, "\nwww\t") {
+		t.Errorf("zone file:\n%s", zf)
+	}
+	if s := serialOf(env, "example.com"); s != serial+1 {
+		t.Errorf("serial after disable = %d, want %d", s, serial+1)
+	}
+	// Editing a disabled record changes nothing that is served.
+	env.submit(env.admin, NewRequest(OpRecordUpdate, www.ID, RecordInput{Comment: model.Ptr("old web server"), Data: model.Ptr("192.0.2.11")}))
+	if s := serialOf(env, "example.com"); s != serial+1 {
+		t.Errorf("serial after editing a disabled record = %d", s)
+	}
+	// Disabling it again says so.
+	if e := env.submitErr(env.admin, disableReq(www.ID, false)); e.Kind != KindConflict || !strings.Contains(e.Message, "already disabled") {
+		t.Errorf("second disable: %+v", e)
+	}
+
+	env.submit(env.admin, enableReq(www.ID, false))
+	r := env.state().Records[www.ID]
+	if r.Disabled || r.Data != "192.0.2.11" || r.Comment != "old web server" {
+		t.Errorf("enabled record = %+v", r)
+	}
+	if zf := env.zoneFile("example.com"); !strings.Contains(zf, "\nwww\t\tIN\tA\t192.0.2.11\t; old web server\n") || strings.Contains(zf, "disabled") {
+		t.Errorf("zone file after enable:\n%s", zf)
+	}
+}
+
+func TestDisableValidation(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	// The zone must keep a name server.
+	ns := findRec(env.state(), "example.com.", "NS")
+	if e := env.submitErr(env.admin, disableReq(ns.ID, false)); e.Kind != KindValidation {
+		t.Errorf("disabling the only NS: %+v", e)
+	}
+
+	// A disabled record doesn't count for the CNAME rule...
+	env.submit(env.admin, rec("example.com", "www", "A", "192.0.2.10"))
+	www := findRec(env.state(), "www.example.com.", "A")
+	env.submit(env.admin, disableReq(www.ID, false))
+	res := env.submit(env.admin, rec("example.com", "www", "CNAME", "ns1"))
+	// ...but there's a warning that it can't come back,
+	if len(res.Problems) != 1 || res.Problems[0].Code != "disabled_conflict" || res.Problems[0].ObjectID != www.ID {
+		t.Errorf("problems = %+v", res.Problems)
+	}
+	// and enabling it is checked like adding it.
+	if e := env.submitErr(env.admin, enableReq(www.ID, false)); e.Kind != KindValidation || !strings.Contains(e.Message, "CNAME") {
+		t.Errorf("enabling next to a CNAME: %+v", e)
+	}
+}
+
+func TestDisableByMatchAndPTR(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("192.0.2.0/24")}))
+	env.submit(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", Name: model.Ptr("nas"), Type: model.Ptr("A"), Data: model.Ptr("192.0.2.20"), PTR: true}))
+	ptrDisabled := func() bool {
+		return findRec(env.state(), "20.2.0.192.in-addr.arpa.", "PTR").Disabled
+	}
+
+	// By match, with the PTR record.
+	match := RecordInput{Zone: "example.com", Name: model.Ptr("nas"), Type: model.Ptr("A"), PTR: true}
+	res := env.submit(env.admin, NewRequest(OpRecordDisable, 0, match))
+	if len(res.Ops) != 2 || res.Ops[1].Summary != "disable 20.2.0.192.in-addr.arpa. PTR nas.example.com." {
+		t.Fatalf("ops = %+v", res.Ops)
+	}
+	if !findRec(env.state(), "nas.example.com.", "A").Disabled || !ptrDisabled() {
+		t.Fatal("A or PTR not disabled")
+	}
+	env.submit(env.admin, NewRequest(OpRecordEnable, 0, match))
+	if findRec(env.state(), "nas.example.com.", "A").Disabled || ptrDisabled() {
+		t.Fatal("A or PTR not enabled")
+	}
+	// Without ptr, the PTR record stays as it is.
+	a := findRec(env.state(), "nas.example.com.", "A")
+	env.submit(env.admin, disableReq(a.ID, false))
+	if ptrDisabled() {
+		t.Error("PTR disabled without ptr")
+	}
+
+	// Data narrows the match; nothing matching is an error unless missing_ok.
+	env.submit(env.admin, rec("example.com", "api", "A", "192.0.2.30"), rec("example.com", "api", "A", "192.0.2.31"))
+	one := RecordInput{Zone: "example.com", Name: model.Ptr("api"), Type: model.Ptr("A"), Data: model.Ptr("192.0.2.31")}
+	env.submit(env.admin, NewRequest(OpRecordDisable, 0, one))
+	if findRecData(env.state(), "api.example.com.", "192.0.2.30").Disabled || !findRecData(env.state(), "api.example.com.", "192.0.2.31").Disabled {
+		t.Error("data match wrong")
+	}
+	none := RecordInput{Zone: "example.com", Name: model.Ptr("nope"), Type: model.Ptr("A")}
+	if e := env.submitErr(env.admin, NewRequest(OpRecordDisable, 0, none)); e.Kind != KindNotFound {
+		t.Errorf("no match: %+v", e)
+	}
+	// missing_ok: nothing to do (an error the CLI's --missing-ok accepts).
+	none.MissingOK = true
+	if e := env.submitErr(env.admin, NewRequest(OpRecordDisable, 0, none)); e.Message != "nothing to do" {
+		t.Errorf("missing_ok: %+v", e)
+	}
+}
+
+func TestDisableRRSetAndRevert(t *testing.T) {
+	env := newEnv(t)
+	setupZone(env)
+	env.submit(env.admin, rec("example.com", "api", "A", "192.0.2.30"), rec("example.com", "api", "A", "192.0.2.31"))
+	r30 := findRecData(env.state(), "api.example.com.", "192.0.2.30")
+	r31 := findRecData(env.state(), "api.example.com.", "192.0.2.31")
+	env.submit(env.admin, disableReq(r30.ID, false), disableReq(r31.ID, false))
+
+	// Setting the RRset enables a disabled record with a given value and
+	// leaves the other disabled one alone.
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", Name: "api", Type: "A", Data: []string{"192.0.2.30", "192.0.2.40"}}))
+	s := env.state()
+	if r := s.Records[r30.ID]; r == nil || r.Disabled {
+		t.Errorf(".30 = %+v, want kept and enabled", r)
+	}
+	if r := s.Records[r31.ID]; r == nil || !r.Disabled {
+		t.Errorf(".31 = %+v, want kept and disabled", r)
+	}
+
+	// Reverting a disabling changeset enables the record again.
+	res := env.submit(env.admin, disableReq(r30.ID, false))
+	rev, err := env.e.Revert(env.ctx, res.ChangesetID, env.admin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := env.e.Apply(env.ctx, rev.ID, env.admin, ApplyOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	if env.state().Records[r30.ID].Disabled {
+		t.Error("revert did not enable the record")
+	}
+}

internal/engine/expand.go

@@ -155,6 +155,8 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 		return x.recordDelete(req)
 	case OpRRSetReplace:
 		return x.rrsetReplace(req)
+	case OpRecordDisable, OpRecordEnable:
+		return x.recordSetDisabled(req, req.Op == OpRecordDisable)
 	case OpViewCreate:
 		return x.viewCreate(req)
 	case OpViewUpdate, OpViewDelete:
@@ -413,6 +415,9 @@ func (x *expander) zoneCreate(req Request) ([]model.Op, error) {
 	if src != nil {
 		for _, r := range x.st.ZoneRecords(src.ID) {
 			ri := RecordInput{Name: model.Ptr(r.Name), Type: model.Ptr(r.Type), Data: model.Ptr(r.Data), Comment: model.Ptr(r.Comment)}
+			if r.Disabled {
+				ri.Disabled = model.Ptr(true)
+			}
 			if r.TTL != nil {
 				ri.TTL = model.Some(*r.TTL)
 			} else {
@@ -502,6 +507,10 @@ func (x *expander) ptrCreate(z *model.Zone, owner string, p *rr.Parsed) ([]model
 	for _, r := range x.st.ZoneRecords(rz.ID) {
 		if r.Name == ptrName && r.Type == "PTR" {
 			if strings.EqualFold(r.Data, owner) {
+				if r.Disabled {
+					in := RecordInput{Disabled: model.Ptr(false)}
+					return []model.Op{newOp(OpRecordUpdate, r.ID, r.Version, in, fmt.Sprintf("enable %s PTR %s", r.Name, r.Data))}, nil
+				}
 				return nil, nil // already there
 			}
 			x.warnings = append(x.warnings, fmt.Sprintf("%s already has a PTR record (%s); adding another one", ptrName, r.Data))
@@ -515,6 +524,34 @@ func (x *expander) ptrCreate(z *model.Zone, owner string, p *rr.Parsed) ([]model
 	return []model.Op{newOp(OpRecordCreate, ids[0], 0, in, fmt.Sprintf("add %s IN PTR %s", ptrName, owner))}, nil
 }
 
+// ptrSetDisabled returns operations disabling or enabling the PTR record
+// of an address record.
+func (x *expander) ptrSetDisabled(z *model.Zone, owner string, p *rr.Parsed, disabled bool) []model.Op {
+	addr, ok := addrOf(p)
+	if !ok {
+		return nil
+	}
+	rz, ptrName := reverseZoneFor(x.st, z.ViewID, addr)
+	if rz == nil {
+		return nil
+	}
+	var ops []model.Op
+	for _, r := range x.st.ZoneRecords(rz.ID) {
+		if r.Name == ptrName && r.Type == "PTR" && strings.EqualFold(r.Data, owner) && r.Disabled != disabled {
+			in := RecordInput{Disabled: model.Ptr(disabled)}
+			ops = append(ops, newOp(OpRecordUpdate, r.ID, r.Version, in, fmt.Sprintf("%s %s PTR %s", enableWord(disabled), r.Name, r.Data)))
+		}
+	}
+	return ops
+}
+
+func enableWord(disabled bool) string {
+	if disabled {
+		return "disable"
+	}
+	return "enable"
+}
+
 func (x *expander) ptrDelete(z *model.Zone, owner string, p *rr.Parsed) []model.Op {
 	addr, ok := addrOf(p)
 	if !ok {
@@ -635,8 +672,15 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 	if in.Comment != nil && *in.Comment != r.Comment {
 		changes = append(changes, "comment")
 	}
+	toggled := in.Disabled != nil && *in.Disabled != r.Disabled
 	summary := fmt.Sprintf("change %s %s %s", r.Name, r.Type, r.Data)
-	if len(changes) > 0 {
+	switch {
+	case toggled && len(changes) == 0:
+		summary = fmt.Sprintf("%s %s %s %s", enableWord(*in.Disabled), r.Name, r.Type, r.Data)
+	case toggled:
+		changes = append(changes, enableWord(*in.Disabled)+"d")
+		fallthrough
+	case len(changes) > 0:
 		summary += ": " + strings.Join(changes, ", ")
 	}
 	base := req.BaseVersion
@@ -644,15 +688,28 @@ func (x *expander) recordUpdate(req Request) ([]model.Op, error) {
 		base = r.Version
 	}
 	ops := []model.Op{newOp(OpRecordUpdate, r.ID, base, in, summary)}
-	if ptr && (p.Data != r.Data || owner != r.Name) {
+	disabled := r.Disabled
+	if in.Disabled != nil {
+		disabled = *in.Disabled
+	}
+	moved := p.Data != r.Data || owner != r.Name
+	if ptr && moved {
 		if old, err := rr.Parse(z.Name, r.Name, r.Type, r.Data); err == nil {
 			ops = append(ops, x.ptrDelete(z, r.Name, old)...)
 		}
-		more, err := x.ptrCreate(z, owner, p)
-		if err != nil {
-			return nil, err
+		if !disabled {
+			more, err := x.ptrCreate(z, owner, p)
+			if err != nil {
+				return nil, err
+			}
+			ops = append(ops, more...)
 		}
-		ops = append(ops, more...)
+	}
+	if ptr && !moved && toggled {
+		if _, ok := addrOf(p); !ok {
+			return nil, errf(KindBadRequest, "ptr only applies to A and AAAA records")
+		}
+		ops = append(ops, x.ptrSetDisabled(z, owner, p, disabled)...)
 	}
 	return ops, nil
 }
@@ -725,6 +782,82 @@ func (x *expander) recordDelete(req Request) ([]model.Op, error) {
 	return ops, nil
 }
 
+// recordSetDisabled expands record.disable and record.enable: the record
+// with the request's ID, or the records matching zone, name, type and
+// (optionally) data.
+func (x *expander) recordSetDisabled(req Request, disabled bool) ([]model.Op, error) {
+	var in RecordInput
+	if err := decode(req.Data, &in); err != nil {
+		return nil, err
+	}
+	var recs []*model.Record
+	if req.ID != 0 {
+		r := x.st.Records[req.ID]
+		if r == nil {
+			return nil, errf(KindNotFound, "record %d does not exist", req.ID)
+		}
+		recs = append(recs, r)
+	} else {
+		z, err := x.resolveZone(in.ZoneID, in.Zone, in.View)
+		if err != nil {
+			return nil, err
+		}
+		if in.Name == nil || in.Type == nil {
+			return nil, errf(KindBadRequest, "finding records needs a name and a type (or give the record id)")
+		}
+		owner, err := dnsname.Owner(*in.Name, z.Name)
+		if err != nil {
+			return nil, errf(KindBadRequest, "%v", err)
+		}
+		typ, _, err := rr.NormalizeType(*in.Type)
+		if err != nil {
+			return nil, errf(KindBadRequest, "%v", err)
+		}
+		data, what := "", owner+" "+typ
+		if in.Data != nil && strings.TrimSpace(*in.Data) != "" {
+			_, p, err := parseRecord(z, owner, typ, *in.Data)
+			if err != nil {
+				return nil, err
+			}
+			data, what = p.Data, what+" "+p.Data
+		}
+		for _, r := range x.st.ZoneRecords(z.ID) {
+			if r.Name == owner && r.Type == typ && (data == "" || strings.EqualFold(r.Data, data)) {
+				recs = append(recs, r)
+			}
+		}
+		if len(recs) == 0 {
+			if in.MissingOK {
+				return nil, nil
+			}
+			return nil, errf(KindNotFound, "no record %s in zone %s", dnsname.Display(what), dnsname.Display(z.Name))
+		}
+	}
+	var ops []model.Op
+	for _, r := range recs {
+		if r.Disabled == disabled {
+			continue // already so
+		}
+		base := 0
+		if req.ID != 0 {
+			base = req.BaseVersion
+		}
+		more, err := x.recordUpdate(Request{Op: OpRecordUpdate, ID: r.ID, BaseVersion: base, Data: mustJSON(RecordInput{Disabled: model.Ptr(disabled), PTR: in.PTR})})
+		if err != nil {
+			return nil, err
+		}
+		ops = append(ops, more...)
+	}
+	if len(ops) == 0 && !in.MissingOK {
+		what := fmt.Sprintf("%s %s %s is", recs[0].Name, recs[0].Type, recs[0].Data)
+		if len(recs) > 1 {
+			what = fmt.Sprintf("all %d %s %s records are", len(recs), recs[0].Name, recs[0].Type)
+		}
+		return nil, errf(KindConflict, "%s already %sd", what, enableWord(disabled))
+	}
+	return ops, nil
+}
+
 func (x *expander) rrsetReplace(req Request) ([]model.Op, error) {
 	var in RRSetInput
 	if err := decode(req.Data, &in); err != nil {

internal/engine/inputs.go

@@ -29,6 +29,12 @@ const (
 	OpOptionUpdate   = "option.update"
 	OpOptionDelete   = "option.delete"
 	OpSettingsUpdate = "settings.update"
+
+	// Requests only: disabling and enabling records, by ID or by match
+	// (zone, name, type and optionally data), become record.update
+	// operations.
+	OpRecordDisable = "record.disable"
+	OpRecordEnable  = "record.enable"
 )
 
 // OpKinds lists all operation kinds.
@@ -121,8 +127,10 @@ type RecordInput struct {
 	TTL     model.Opt[uint32] `json:"ttl,omitzero"` // null: use the zone default
 	Data    *string           `json:"data,omitempty"`
 	Comment *string           `json:"comment,omitempty"`
-	// PTR also creates (or deletes) the matching PTR record in the
-	// reverse zone, for A and AAAA records.
+	// Disabled keeps the record in Jarl but out of the zone.
+	Disabled *bool `json:"disabled,omitempty"`
+	// PTR also creates (or deletes, disables or enables) the matching PTR
+	// record in the reverse zone, for A and AAAA records.
 	PTR bool `json:"ptr,omitempty"`
 	// MissingOK makes a delete-by-match succeed when nothing matches.
 	MissingOK bool `json:"missing_ok,omitempty"`

internal/engine/ops.go

@@ -373,7 +373,7 @@ func parseRecord(z *model.Zone, name, typ, data string) (string, *rr.Parsed, err
 
 func rrsetTTL(st *model.State, zoneID int64, name, typ string, exceptID int64) (*uint32, bool) {
 	for _, r := range st.Records {
-		if r.ZoneID == zoneID && r.Name == name && r.Type == typ && r.ID != exceptID {
+		if r.ZoneID == zoneID && r.Name == name && r.Type == typ && r.ID != exceptID && !r.Disabled {
 			if r.TTL == nil {
 				return nil, true
 			}
@@ -422,6 +422,9 @@ func applyRecordCreate(st *model.State, op model.Op, c *applyCtx) error {
 	if in.Comment != nil {
 		r.Comment = *in.Comment
 	}
+	if in.Disabled != nil {
+		r.Disabled = *in.Disabled
+	}
 	for _, w := range p.Warnings {
 		c.warn("%s %s: %s", dnsname.Display(owner), p.Type, w)
 	}
@@ -498,6 +501,9 @@ func applyRecordUpdate(st *model.State, op model.Op, c *applyCtx) error {
 	if in.Comment != nil {
 		r.Comment = *in.Comment
 	}
+	if in.Disabled != nil {
+		r.Disabled = *in.Disabled
+	}
 	r.Touch(c.user(), c.now)
 	return nil
 }
@@ -617,20 +623,32 @@ func applyRRSetReplace(st *model.State, op model.Op, c *applyCtx) error {
 	} else if t, ok := rrsetTTL(st, z.ID, owner, typ, 0); ok {
 		ttl, ttlKnown = t, true
 	}
+	// The RRset becomes exactly the given data. A disabled record with
+	// one of the values is enabled again; other disabled records are left
+	// alone.
 	keep := map[string]bool{}
-	for id, r := range st.Records {
+	// (In ID order, so which of two identical records is kept doesn't
+	// depend on map order.)
+	for _, id := range sortedKeys(st.Records) {
+		r := st.Records[id]
 		if r.ZoneID != z.ID || r.Name != owner || r.Type != typ {
 			continue
 		}
 		k := strings.ToLower(r.Data)
 		if seen[k] && !keep[k] {
 			keep[k] = true
-			if ttlKnown && !sameTTL(r.TTL, ttl) {
-				r.TTL = copyTTL(ttl)
+			if (ttlKnown && !sameTTL(r.TTL, ttl)) || r.Disabled {
+				if ttlKnown {
+					r.TTL = copyTTL(ttl)
+				}
+				r.Disabled = false
 				r.Touch(c.user(), c.now)
 			}
 			continue
 		}
+		if r.Disabled {
+			continue
+		}
 		delete(st.Records, id)
 	}
 	ids := in.NewIDs

internal/model/model.go

@@ -154,6 +154,9 @@ type Record struct {
 	TTL     *uint32 `json:"ttl,omitempty"`
 	Data    string  `json:"data"` // canonical presentation format
 	Comment string  `json:"comment"`
+	// Disabled records stay in Jarl but are left out of the zone (the
+	// zone file lists them as comments).
+	Disabled bool `json:"disabled,omitempty"`
 	Meta
 }
 
@@ -446,6 +449,18 @@ func (s *State) ZoneRecords(zoneID int64) []*Record {
 	return out
 }
 
+// ServedRecords returns the records of a zone that are in the zone file
+// (not disabled), in display order.
+func (s *State) ServedRecords(zoneID int64) []*Record {
+	var out []*Record
+	for _, r := range s.ZoneRecords(zoneID) {
+		if !r.Disabled {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
 // RecordsByZone groups all records by zone ID (unsorted).
 func (s *State) RecordsByZone() map[int64][]*Record {
 	out := map[int64][]*Record{}
@@ -455,6 +470,17 @@ func (s *State) RecordsByZone() map[int64][]*Record {
 	return out
 }
 
+// ServedRecordsByZone is RecordsByZone without disabled records.
+func (s *State) ServedRecordsByZone() map[int64][]*Record {
+	out := map[int64][]*Record{}
+	for _, r := range s.Records {
+		if !r.Disabled {
+			out[r.ZoneID] = append(out[r.ZoneID], r)
+		}
+	}
+	return out
+}
+
 // ScopedOptions returns the options of a scope, in position order.
 func (s *State) ScopedOptions(scope string, scopeID int64) []*Option {
 	var out []*Option

internal/render/render.go

@@ -461,6 +461,10 @@ func ZoneFile(s *model.State, z *model.Zone) string {
 		if r.Comment != "" {
 			line += "\t; " + oneLine(r.Comment)
 		}
+		if r.Disabled {
+			// Kept in Jarl, left out of the zone.
+			line = "; disabled: " + line
+		}
 		sb.WriteString(line + "\n")
 	}
 	return sb.String()
@@ -478,7 +482,7 @@ func ZoneContentHash(s *model.State, z *model.Zone) string {
 	h := sha256.New()
 	soa := z.SOA
 	fmt.Fprintf(h, "%s|%d|%s|%s|%d|%d|%d|%d\n", z.Name, z.DefaultTTL, soa.MName, soa.RName, soa.Refresh, soa.Retry, soa.Expire, soa.Minimum)
-	for _, r := range s.ZoneRecords(z.ID) {
+	for _, r := range s.ServedRecords(z.ID) {
 		fmt.Fprintf(h, "%s|%d|%s|%s\n", r.Name, r.EffectiveTTL(z), r.Type, r.Data)
 	}
 	return hex.EncodeToString(h.Sum(nil))

internal/server/clientnames_test.go

@@ -0,0 +1,38 @@
+package server
+
+import (
+	"net/netip"
+	"testing"
+
+	"jarl/internal/model"
+)
+
+func TestClientNames(t *testing.T) {
+	st := model.NewState()
+	add := func(id int64, name, typ, data string, disabled bool) {
+		st.Records[id] = &model.Record{ID: id, ZoneID: 1, Name: name, Type: typ, Data: data, Disabled: disabled}
+	}
+	add(1, "nas.adbraun.lol.", "A", "192.168.1.20", false)
+	add(2, "20.1.168.192.in-addr.arpa.", "PTR", "storage.adbraun.lol.", false) // PTR wins over A
+	add(3, "web.adbraun.lol.", "A", "192.168.1.30", false)                     // no PTR: the A record's name
+	add(4, "alias.adbraun.lol.", "A", "192.168.1.30", false)                   // first in name order wins
+	add(5, "old.adbraun.lol.", "A", "192.168.1.40", true)                      // disabled: ignored
+	add(6, "secret.adbraun.lol.", "A", "192.168.1.50", false)                  // not readable
+	add(7, "v6.adbraun.lol.", "AAAA", "2001:db8::7", false)
+	add(8, "printer.adbraun.lol.", "A", "192.168.1.60", false) // not asked for
+
+	want := map[netip.Addr]bool{}
+	for _, a := range []string{"192.168.1.20", "192.168.1.30", "192.168.1.40", "192.168.1.50", "2001:db8::7", "10.0.0.1"} {
+		want[netip.MustParseAddr(a)] = true
+	}
+	got := clientNames(st, want, func(r *model.Record) bool { return r.ID != 6 })
+	exp := map[string]string{"192.168.1.20": "storage.adbraun.lol", "192.168.1.30": "alias.adbraun.lol", "2001:db8::7": "v6.adbraun.lol"}
+	if len(got) != len(exp) {
+		t.Errorf("got %v", got)
+	}
+	for a, n := range exp {
+		if got[netip.MustParseAddr(a)] != n {
+			t.Errorf("%s = %q, want %q", a, got[netip.MustParseAddr(a)], n)
+		}
+	}
+}

internal/server/disable_test.go

@@ -0,0 +1,61 @@
+package server
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestDisableRecords(t *testing.T) {
+	e := newAPIEnv(t)
+	e.do("POST", "/zones", e.token, map[string]any{"name": "example.com", "records": []map[string]any{{"name": "ns1", "type": "A", "data": "192.0.2.1"}}}, 201)
+	www := e.do("POST", "/zones/example.com/records", e.token, map[string]any{"name": "www", "type": "A", "data": "192.0.2.10"}, 201)["object"].(map[string]any)
+	id := itoa(int64(www["id"].(float64)))
+
+	// By ID: the record comes back disabled.
+	if r := e.do("POST", "/records/"+id+"/disable", e.token, nil, 201)["object"].(map[string]any); r["disabled"] != true {
+		t.Errorf("disabled record = %v", r)
+	}
+	if _, status := e.req("POST", "/records/"+id+"/disable", e.token, nil); status != 409 {
+		t.Errorf("disabling twice = %d, want 409", status)
+	}
+	if z := e.do("GET", "/zones/example.com", e.token, nil, 200); z["disabled_count"] != 1.0 || z["record_count"] != 3.0 {
+		t.Errorf("zone counts = %v / %v", z["record_count"], z["disabled_count"])
+	}
+	off := e.list("/zones/example.com/records?disabled=1", e.token)
+	on := e.list("/zones/example.com/records?disabled=0", e.token)
+	if len(off) != 1 || off[0]["name"] != "www.example.com." || len(on) != 2 {
+		t.Errorf("filtered: %d disabled, %d enabled", len(off), len(on))
+	}
+	file := e.do("GET", "/zones/example.com/file", e.token, nil, 200)
+	if s, _ := file["_raw"].(string); !strings.Contains(s, "; disabled: www") {
+		t.Errorf("zone file = %v", file)
+	}
+
+	// Staged: listing with the changeset marks the record.
+	cs := itoa(int64(e.do("POST", "/changesets", e.token, map[string]any{"description": "back"}, 201)["id"].(float64)))
+	e.do("POST", "/records/"+id+"/enable?changeset="+cs, e.token, nil, 202)
+	for _, r := range e.list("/zones/example.com/records?changeset="+cs, e.token) {
+		if r["name"] == "www.example.com." && (r["pending"] != "enable" || r["disabled"] == true) {
+			t.Errorf("staged record = %v", r)
+		}
+	}
+	e.do("POST", "/changesets/"+cs+"/discard", e.token, nil, 204)
+
+	// By match.
+	e.do("POST", "/zones/example.com/records/enable?name=www&type=A", e.token, nil, 201)
+	if _, status := e.req("POST", "/zones/example.com/records/disable?name=nope&type=A", e.token, nil); status != 404 {
+		t.Errorf("no match = %d", status)
+	}
+	if _, status := e.req("POST", "/zones/example.com/records/disable?name=www", e.token, nil); status != 400 {
+		t.Errorf("no type = %d", status)
+	}
+	e.do("POST", "/zones/example.com/records/disable?name=www&type=A&data=192.0.2.10", e.token, nil, 201)
+	if r := e.do("GET", "/records/"+id, e.token, nil, 200); r["disabled"] != true {
+		t.Errorf("after match disable = %v", r)
+	}
+	// And in a batch.
+	e.do("POST", "/apply", e.token, map[string]any{"ops": []map[string]any{{"op": "record.enable", "id": www["id"]}}}, 201)
+	if r := e.do("GET", "/records/"+id, e.token, nil, 200); r["disabled"] == true {
+		t.Errorf("after batch enable = %v", r)
+	}
+}

internal/server/h_dnssec.go

@@ -37,7 +37,12 @@ func (s *Server) zoneDNSSEC(w http.ResponseWriter, r *http.Request, p *auth.Prin
 	}
 	resp := api.DNSSECResponse{Zone: z.Name, View: st.ViewName(z), Type: z.Type, Status: s.eng.DNSSEC(r.Context(), st, z), Registrar: s.registrarFor(z)}
 	if pz := parentInJarl(st, z); pz != nil {
-		resp.ParentZone = pz.Name
+		resp.ParentZone, resp.ParentZoneID, resp.ParentView = pz.Name, pz.ID, st.ViewName(pz)
+		for _, rec := range st.ServedRecords(pz.ID) {
+			if rec.Name == z.Name && rec.Type == "DS" {
+				resp.ParentDS = append(resp.ParentDS, rec.Data)
+			}
+		}
 	}
 	writeJSON(w, http.StatusOK, resp)
 	return nil

internal/server/h_nscheck.go

@@ -169,7 +169,7 @@ func (s *Server) zoneDelegation(w http.ResponseWriter, r *http.Request, p *auth.
 		c.Resolver = net.JoinHostPort(a.String(), "53")
 	}
 	var ns []string
-	for _, rec := range st.ZoneRecords(z.ID) {
+	for _, rec := range st.ServedRecords(z.ID) {
 		if rec.Type == "NS" && rec.Name == z.Name {
 			ns = append(ns, rec.Data)
 		}
@@ -226,7 +226,7 @@ func (s *Server) localSerial(ctx context.Context, st *model.State, z *model.Zone
 // addresses Jarl has for them in the same view (or nil, to be looked up).
 func nsTargets(st *model.State, z *model.Zone) []nscheck.Target {
 	var out []nscheck.Target
-	for _, rec := range st.ZoneRecords(z.ID) {
+	for _, rec := range st.ServedRecords(z.ID) {
 		if rec.Type != "NS" || rec.Name != z.Name {
 			continue
 		}
@@ -244,7 +244,7 @@ func jarlAddresses(st *model.State, viewID int64, name string) []string {
 		if !z.HasRecords() || !dnsname.IsSubdomain(name, z.Name) {
 			continue
 		}
-		for _, rec := range st.ZoneRecords(z.ID) {
+		for _, rec := range st.ServedRecords(z.ID) {
 			if rec.Name == name && (rec.Type == "A" || rec.Type == "AAAA") {
 				out = append(out, rec.Data)
 			}

internal/server/h_registrar.go

@@ -73,7 +73,7 @@ func lowerNoDot(n string) string { return strings.ToLower(strings.TrimSuffix(n,
 // trailing dots.
 func zoneNS(st *model.State, z *model.Zone) []string {
 	var out []string
-	for _, rec := range st.ZoneRecords(z.ID) {
+	for _, rec := range st.ServedRecords(z.ID) {
 		if rec.Type == "NS" && rec.Name == z.Name {
 			out = append(out, lowerNoDot(rec.Data))
 		}

internal/server/h_stats.go

@@ -2,10 +2,14 @@ package server
 
 import (
 	"net/http"
+	"net/netip"
+	"slices"
 	"strings"
 	"time"
 
 	"jarl/internal/auth"
+	"jarl/internal/dnsname"
+	"jarl/internal/model"
 	"jarl/internal/stats"
 )
 
@@ -53,6 +57,9 @@ func (s *Server) statsSummary(w http.ResponseWriter, r *http.Request, p *auth.Pr
 	if err != nil {
 		return err
 	}
+	if err := s.nameClients(r, p, sum.Tops[stats.KindClient]); err != nil {
+		return err
+	}
 	writeJSON(w, http.StatusOK, sum)
 	return nil
 }
@@ -75,6 +82,11 @@ func (s *Server) statsTop(w http.ResponseWriter, r *http.Request, p *auth.Princi
 	if err != nil {
 		return badRequest("%v", err)
 	}
+	if kind == stats.KindClient || kind == stats.KindRefused {
+		if err := s.nameClients(r, p, es); err != nil {
+			return err
+		}
+	}
 	writeJSON(w, http.StatusOK, es)
 	return nil
 }
@@ -145,3 +157,86 @@ func (s *Server) statsBreakdown(w http.ResponseWriter, r *http.Request, p *auth.
 	writeJSON(w, http.StatusOK, es)
 	return nil
 }
+
+// nameClients gives client entries the host name Jarl's records have for
+// the address: the PTR record's target, or else the name of an A/AAAA
+// record with the address. It sends no DNS queries, and uses only records
+// the user may read. Anonymized clients (prefixes) get no name.
+func (s *Server) nameClients(r *http.Request, p *auth.Principal, es []stats.Entry) error {
+	if len(es) == 0 {
+		return nil
+	}
+	want := map[netip.Addr]bool{}
+	for _, e := range es {
+		if a, err := netip.ParseAddr(e.Key); err == nil {
+			want[a.Unmap()] = true
+		}
+	}
+	if len(want) == 0 {
+		return nil
+	}
+	st, err := s.state(r)
+	if err != nil {
+		return err
+	}
+	names := clientNames(st, want, func(rec *model.Record) bool { return canReadRecord(p, st, rec) })
+	for i, e := range es {
+		if a, err := netip.ParseAddr(e.Key); err == nil {
+			es[i].Name = names[a.Unmap()]
+		}
+	}
+	return nil
+}
+
+// clientNames finds names for the addresses in want (see nameClients).
+// Where several records match, the first in name order wins.
+func clientNames(st *model.State, want map[netip.Addr]bool, readable func(*model.Record) bool) map[netip.Addr]string {
+	ptr, host := map[netip.Addr]string{}, map[netip.Addr]string{}
+	var recs []*model.Record
+	for _, rec := range st.Records {
+		if !rec.Disabled && (rec.Type == "PTR" || rec.Type == "A" || rec.Type == "AAAA") {
+			recs = append(recs, rec)
+		}
+	}
+	slices.SortFunc(recs, func(a, b *model.Record) int {
+		if a.Name != b.Name {
+			if model.CanonicalLess(a.Name, b.Name) {
+				return -1
+			}
+			return 1
+		}
+		return strings.Compare(a.Data, b.Data)
+	})
+	for _, rec := range recs {
+		var a netip.Addr
+		var name string
+		if rec.Type == "PTR" {
+			var ok bool
+			if a, ok = dnsname.AddrFromReverse(rec.Name); !ok {
+				continue
+			}
+			name = rec.Data
+		} else {
+			var err error
+			if a, err = netip.ParseAddr(rec.Data); err != nil {
+				continue
+			}
+			name = rec.Name
+		}
+		a = a.Unmap()
+		m := host
+		if rec.Type == "PTR" {
+			m = ptr
+		}
+		if !want[a] || m[a] != "" || !readable(rec) {
+			continue
+		}
+		m[a] = dnsname.Display(name)
+	}
+	for a, n := range host {
+		if ptr[a] == "" {
+			ptr[a] = n
+		}
+	}
+	return ptr
+}

internal/server/h_zones.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"reflect"
 	"sort"
 	"strconv"
 	"strings"
@@ -44,10 +45,17 @@ func (s *Server) zoneByPath(r *http.Request, st *model.State, p *auth.Principal)
 	return z, nil
 }
 
-func recordCounts(st *model.State) map[int64]int {
-	counts := map[int64]int{}
+type recordCount struct{ all, disabled int }
+
+func recordCounts(st *model.State) map[int64]recordCount {
+	counts := map[int64]recordCount{}
 	for _, r := range st.Records {
-		counts[r.ZoneID]++
+		c := counts[r.ZoneID]
+		c.all++
+		if r.Disabled {
+			c.disabled++
+		}
+		counts[r.ZoneID] = c
 	}
 	return counts
 }
@@ -190,10 +198,14 @@ func (s *Server) listRecords(w http.ResponseWriter, r *http.Request, p *auth.Pri
 	}
 	typ := strings.ToUpper(q.Get("type"))
 	search := strings.ToLower(q.Get("q"))
+	disabled := q.Get("disabled") // "1": only disabled records, "0": only enabled ones
 	match := func(rec *model.Record) bool {
 		if name != "" && rec.Name != name || typ != "" && rec.Type != typ {
 			return false
 		}
+		if disabled != "" && rec.Disabled != (disabled == "1" || disabled == "true") {
+			return false
+		}
 		return search == "" || strings.Contains(rec.Name, search) || strings.Contains(strings.ToLower(rec.Data), search) || strings.Contains(strings.ToLower(rec.Comment), search)
 	}
 	recs := st.ZoneRecords(z.ID)
@@ -229,6 +241,13 @@ func (s *Server) listRecords(w http.ResponseWriter, r *http.Request, p *auth.Pri
 				ro.Pending = "add"
 			case old.Version != rec.Version:
 				ro.Pending = "change"
+				if only := *old; only.Disabled != rec.Disabled {
+					// Just disabled or enabled: say which.
+					only.Disabled, only.Meta = rec.Disabled, rec.Meta
+					if reflect.DeepEqual(only, *rec) {
+						ro.Pending = map[bool]string{true: "disable", false: "enable"}[rec.Disabled]
+					}
+				}
 			}
 		}
 		out = append(out, ro)
@@ -380,6 +399,56 @@ func (s *Server) deleteRecordsByMatch(w http.ResponseWriter, r *http.Request, p
 	return s.mutate(w, r, p, "", []engine.Request{engine.NewRequest(engine.OpRecordDelete, 0, in)}, nil)
 }
 
+// setRecordDisabled: POST /records/{id}/disable or /enable [?ptr=1]
+func (s *Server) setRecordDisabled(disabled bool) func(http.ResponseWriter, *http.Request, *auth.Principal) error {
+	op := disableOp(disabled)
+	return func(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+		st, err := s.state(r)
+		if err != nil {
+			return err
+		}
+		rec, err := s.recordByPath(r, st, p)
+		if err != nil {
+			return err
+		}
+		req := engine.NewRequest(op, rec.ID, engine.RecordInput{PTR: queryBool(r, "ptr")})
+		id := rec.ID
+		return s.mutate(w, r, p, "", []engine.Request{req}, func(st *model.State, _ int64) any { return recordObject(st, id) })
+	}
+}
+
+// setRecordsDisabled: POST /zones/{zone}/records/disable or /enable
+// ?name=&type=[&data=][&missing_ok=1][&ptr=1]
+func (s *Server) setRecordsDisabled(disabled bool) func(http.ResponseWriter, *http.Request, *auth.Principal) error {
+	op := disableOp(disabled)
+	return func(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+		st, err := s.state(r)
+		if err != nil {
+			return err
+		}
+		z, err := s.zoneByPath(r, st, p)
+		if err != nil {
+			return err
+		}
+		q := r.URL.Query()
+		if q.Get("name") == "" || q.Get("type") == "" {
+			return badRequest("give name and type (and optionally data) of the records")
+		}
+		in := engine.RecordInput{ZoneID: z.ID, Name: model.Ptr(q.Get("name")), Type: model.Ptr(q.Get("type")), MissingOK: queryBool(r, "missing_ok"), PTR: queryBool(r, "ptr")}
+		if d := q.Get("data"); d != "" {
+			in.Data = &d
+		}
+		return s.mutate(w, r, p, "", []engine.Request{engine.NewRequest(op, 0, in)}, nil)
+	}
+}
+
+func disableOp(disabled bool) string {
+	if disabled {
+		return engine.OpRecordDisable
+	}
+	return engine.OpRecordEnable
+}
+
 func (s *Server) putRRSet(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
 	st, err := s.state(r)
 	if err != nil {

internal/server/present.go

@@ -14,8 +14,8 @@ import (
 	"jarl/internal/version"
 )
 
-func (s *Server) presentZone(st *model.State, z *model.Zone, counts map[int64]int) api.Zone {
-	out := api.Zone{Zone: *z, Display: dnsname.Display(z.Name), View: st.ViewName(z), Records: counts[z.ID]}
+func (s *Server) presentZone(st *model.State, z *model.Zone, counts map[int64]recordCount) api.Zone {
+	out := api.Zone{Zone: *z, Display: dnsname.Display(z.Name), View: st.ViewName(z), Records: counts[z.ID].all, Disabled: counts[z.ID].disabled}
 	out.ZoneFile = render.ZoneFilePath(st, z, s.eng.Config().Paths)
 	if z.Type == model.ZonePrimary {
 		out.RName = dnsname.EmailFromMailbox(z.SOA.RName)

internal/server/routes.go

@@ -88,11 +88,15 @@ func (s *Server) routes() {
 	m.HandleFunc("GET "+p+"/zones/{zone}/records", s.authed(s.listRecords))
 	m.HandleFunc("POST "+p+"/zones/{zone}/records", s.authed(s.createRecord))
 	m.HandleFunc("DELETE "+p+"/zones/{zone}/records", s.authed(s.deleteRecordsByMatch))
+	m.HandleFunc("POST "+p+"/zones/{zone}/records/disable", s.authed(s.setRecordsDisabled(true)))
+	m.HandleFunc("POST "+p+"/zones/{zone}/records/enable", s.authed(s.setRecordsDisabled(false)))
 	m.HandleFunc("PUT "+p+"/zones/{zone}/rrsets/{name}/{type}", s.authed(s.putRRSet))
 	m.HandleFunc("DELETE "+p+"/zones/{zone}/rrsets/{name}/{type}", s.authed(s.deleteRRSet))
 	m.HandleFunc("GET "+p+"/records/{id}", s.authed(s.getRecord))
 	m.HandleFunc("PATCH "+p+"/records/{id}", s.authed(s.updateRecord))
 	m.HandleFunc("DELETE "+p+"/records/{id}", s.authed(s.deleteRecord))
+	m.HandleFunc("POST "+p+"/records/{id}/disable", s.authed(s.setRecordDisabled(true)))
+	m.HandleFunc("POST "+p+"/records/{id}/enable", s.authed(s.setRecordDisabled(false)))
 	// Options and settings
 	m.HandleFunc("GET "+p+"/options", s.authed(s.listOptions))
 	m.HandleFunc("POST "+p+"/options", s.authed(s.createOption))

internal/server/server.go

@@ -12,8 +12,10 @@ import (
 	"net/http"
 	"net/netip"
 	"os"
+	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 
 	"jarl/internal/api"
@@ -116,6 +118,16 @@ func New(cfg Config, eng *engine.Engine, log *slog.Logger, web fs.FS) *Server {
 }
 
 // Handler returns the server's HTTP handler with all middleware.
+// lowPort reports whether addr ("host:port") has a port below 1024.
+func lowPort(addr string) bool {
+	_, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return false
+	}
+	n, err := strconv.Atoi(port)
+	return err == nil && n > 0 && n < 1024
+}
+
 func (s *Server) Handler() http.Handler {
 	return s.recoverer(s.securityHeaders(s.logRequests(s.mux)))
 }
@@ -142,6 +154,9 @@ func (s *Server) Serve(ctx context.Context, ready func()) error {
 			for _, l := range listeners {
 				l.Close()
 			}
+			if errors.Is(err, syscall.EACCES) && lowPort(addr) {
+				return fmt.Errorf("listening on %s: %w (ports below 1024 need the CAP_NET_BIND_SERVICE capability; Jarl's jarl.service grants it, so check that the installed unit is current and no drop-in removes it: systemctl cat jarl)", addr, err)
+			}
 			return fmt.Errorf("listening on %s: %w", addr, err)
 		}
 		listeners = append(listeners, ln)

internal/server/stats_test.go

@@ -58,6 +58,17 @@ func TestStatsAPI(t *testing.T) {
 	if len(tops) != 2 || tops[0]["key"] != "www.example.com" {
 		t.Errorf("top names = %v", tops)
 	}
+	// Clients get the host name of Jarl's record for their address.
+	if c := e.list("/stats/top?kind=client&since=2h", e.token); len(c) != 1 || c[0]["name"] != nil {
+		t.Errorf("unnamed client = %v", c)
+	}
+	e.do("POST", "/zones", e.token, map[string]any{"name": "example.com", "records": []map[string]any{{"name": "ns1", "type": "A", "data": "192.0.2.1"}, {"name": "laptop", "type": "A", "data": "10.0.0.7"}}}, 201)
+	if c := e.list("/stats/top?kind=client&since=2h", e.token); len(c) != 1 || c[0]["name"] != "laptop.example.com" {
+		t.Errorf("named client = %v", c)
+	}
+	if sum := e.do("GET", "/stats/summary?since=2h", e.token, nil, 200); sum["tops"].(map[string]any)["client"].([]any)[0].(map[string]any)["name"] != "laptop.example.com" {
+		t.Errorf("summary clients = %v", sum["tops"])
+	}
 	if b := e.list("/stats/breakdown?group=zone&since=1h", e.token); len(b) != 2 || b[0]["key"] != "example.com" {
 		t.Errorf("zones = %v", b)
 	}

internal/stats/collector.go

@@ -528,7 +528,7 @@ func (c *Collector) updateWarnings() {
 func top(m map[string]int64, n int) []Entry {
 	out := make([]Entry, 0, len(m))
 	for k, v := range m {
-		out = append(out, Entry{k, v})
+		out = append(out, Entry{Key: k, Count: v})
 	}
 	slices.SortFunc(out, func(a, b Entry) int {
 		if a.Count != b.Count {

internal/stats/collector_test.go

@@ -118,7 +118,7 @@ func TestCollector(t *testing.T) {
 		}
 	}
 	names, _ := store.TopsAt(ctx, ResHour, m, KindName)
-	if len(names) != 3 || names[0] != (Entry{"nas.adbraun.lol", 2}) {
+	if len(names) != 3 || names[0] != (Entry{Key: "nas.adbraun.lol", Count: 2}) {
 		t.Errorf("hour names = %v", names)
 	}
 	if nx, _ := store.TopsAt(ctx, ResHour, m, KindNXDomain); len(nx) != 1 || nx[0].Key != "nope.adbraun.lol" {
@@ -133,7 +133,7 @@ func TestCollector(t *testing.T) {
 	clk.t = time.Date(2026, 10, 5, 11, 0, 2, 0, loc)
 	c.flush(ctx, false)
 	day := time.Date(2026, 10, 5, 0, 0, 0, 0, loc).Unix()
-	if d, _ := store.TopsAt(ctx, ResDay, day, KindName); len(d) == 0 || d[0] != (Entry{"nas.adbraun.lol", 3}) {
+	if d, _ := store.TopsAt(ctx, ResDay, day, KindName); len(d) == 0 || d[0] != (Entry{Key: "nas.adbraun.lol", Count: 3}) {
 		t.Errorf("day names after the hour = %v", d)
 	}
 	if v, _ := store.sums(ctx, ResDay, day, day+1, "queries"); v["queries"] != 7 {
@@ -149,14 +149,14 @@ func TestCollector(t *testing.T) {
 	c2.readLog()
 	clk.t = time.Date(2026, 10, 5, 11, 3, 2, 0, loc)
 	c2.flush(ctx, false)
-	if h, _ := store.TopsAt(ctx, ResHour, m, KindName); len(h) == 0 || h[0] != (Entry{"nas.adbraun.lol", 4}) {
+	if h, _ := store.TopsAt(ctx, ResHour, m, KindName); len(h) == 0 || h[0] != (Entry{Key: "nas.adbraun.lol", Count: 4}) {
 		t.Errorf("hour 10 after late line = %v", h)
 	}
-	if d, _ := store.TopsAt(ctx, ResDay, day, KindName); d[0] != (Entry{"nas.adbraun.lol", 4}) {
+	if d, _ := store.TopsAt(ctx, ResDay, day, KindName); d[0] != (Entry{Key: "nas.adbraun.lol", Count: 4}) {
 		t.Errorf("day after late line = %v", d)
 	}
 	h11 := time.Date(2026, 10, 5, 11, 0, 0, 0, loc).Unix()
-	if h, _ := store.TopsAt(ctx, ResHour, h11, KindName); len(h) != 1 || h[0] != (Entry{"printer.adbraun.lol", 2}) {
+	if h, _ := store.TopsAt(ctx, ResHour, h11, KindName); len(h) != 1 || h[0] != (Entry{Key: "printer.adbraun.lol", Count: 2}) {
 		t.Errorf("hour 11 continued after restart = %v", h)
 	}
 
@@ -198,7 +198,7 @@ func TestCollector(t *testing.T) {
 		t.Errorf("heatmap Monday 10h=%v 11h=%v Thu 3h=%v", hm.Avg[0][10], hm.Avg[0][11], hm.Avg[3][3])
 	}
 	b, _ := q.Breakdown(ctx, "zone", 24*time.Hour)
-	if len(b) != 2 || b[0] != (Entry{"adbraun.lol", 7}) || b[1] != (Entry{OtherZone, 1}) {
+	if len(b) != 2 || b[0] != (Entry{Key: "adbraun.lol", Count: 7}) || b[1] != (Entry{Key: OtherZone, Count: 1}) {
 		t.Errorf("zone breakdown = %v", b)
 	}
 

internal/stats/query.go

@@ -128,7 +128,7 @@ func sorted(m map[string]int64, prefix string) []Entry {
 	out := []Entry{}
 	for k, v := range m {
 		if strings.HasPrefix(k, prefix) && v != 0 {
-			out = append(out, Entry{strings.TrimPrefix(k, prefix), v})
+			out = append(out, Entry{Key: strings.TrimPrefix(k, prefix), Count: v})
 		}
 	}
 	slices.SortFunc(out, func(a, b Entry) int {

internal/stats/store.go

@@ -135,6 +135,9 @@ type topsWrite struct {
 type Entry struct {
 	Key   string `json:"key"`
 	Count int64  `json:"count"`
+	// Name is a client's host name, from Jarl's own records (set by the
+	// API for client lists).
+	Name string `json:"name,omitempty"`
 }
 
 // AddCounters adds values to the counters of a bucket.

internal/store/state.go

@@ -110,7 +110,7 @@ func loadState(ctx context.Context, e execer) (*model.State, error) {
 		return nil, err
 	}
 
-	rows, err = e.QueryContext(ctx, `SELECT id, zone_id, name, type, ttl, data, comment, version, created_at, updated_at, created_by, updated_by FROM records`)
+	rows, err = e.QueryContext(ctx, `SELECT id, zone_id, name, type, ttl, data, comment, disabled, version, created_at, updated_at, created_by, updated_by FROM records`)
 	if err != nil {
 		return nil, err
 	}
@@ -118,7 +118,7 @@ func loadState(ctx context.Context, e execer) (*model.State, error) {
 		r := &model.Record{}
 		var ttl sql.NullInt64
 		var ca, ua string
-		if err := rows.Scan(&r.ID, &r.ZoneID, &r.Name, &r.Type, &ttl, &r.Data, &r.Comment, &r.Version, &ca, &ua, &r.CreatedBy, &r.UpdatedBy); err != nil {
+		if err := rows.Scan(&r.ID, &r.ZoneID, &r.Name, &r.Type, &ttl, &r.Data, &r.Comment, &r.Disabled, &r.Version, &ca, &ua, &r.CreatedBy, &r.UpdatedBy); err != nil {
 			rows.Close()
 			return nil, err
 		}
@@ -220,8 +220,8 @@ func saveState(ctx context.Context, e execer, old, new *model.State) error {
 		if r.TTL != nil {
 			ttl = int64(*r.TTL)
 		}
-		_, err := e.ExecContext(ctx, `INSERT OR REPLACE INTO records (id, zone_id, name, type, ttl, data, comment, version, created_at, updated_at, created_by, updated_by) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`,
-			r.ID, r.ZoneID, r.Name, r.Type, ttl, r.Data, r.Comment, r.Version, ts(r.CreatedAt), ts(r.UpdatedAt), r.CreatedBy, r.UpdatedBy)
+		_, err := e.ExecContext(ctx, `INSERT OR REPLACE INTO records (id, zone_id, name, type, ttl, data, comment, disabled, version, created_at, updated_at, created_by, updated_by) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`,
+			r.ID, r.ZoneID, r.Name, r.Type, ttl, r.Data, r.Comment, r.Disabled, r.Version, ts(r.CreatedAt), ts(r.UpdatedAt), r.CreatedBy, r.UpdatedBy)
 		return err
 	}, func(id int64) error { return del(ctx, e, "records", id) }); err != nil {
 		return err

internal/store/store.go

@@ -259,6 +259,10 @@ CREATE TABLE recovery_codes (
 	used_at TEXT,
 	PRIMARY KEY (user_id, code_hash)
 );
+`,
+	// 5: disabled records, kept but left out of the zone.
+	`
+ALTER TABLE records ADD COLUMN disabled INTEGER NOT NULL DEFAULT 0;
 `,
 }
 

internal/validate/records.go

@@ -103,6 +103,31 @@ func (c *checker) zoneLimit(z *model.Zone, name string, def int) int {
 	return n
 }
 
+// checkDisabledRecords warns about disabled records that couldn't be
+// enabled again as the zone is now: the CNAME rules are the usual way a
+// name changes while one of its records is disabled.
+func (c *checker) checkDisabledRecords(z *model.Zone) {
+	served := map[string]map[string]bool{}
+	for _, r := range c.zoneRecords[z.ID] {
+		if served[r.Name] == nil {
+			served[r.Name] = map[string]bool{}
+		}
+		served[r.Name][r.Type] = true
+	}
+	for _, r := range c.allRecords[z.ID] {
+		if !r.Disabled {
+			continue
+		}
+		types := served[r.Name]
+		switch {
+		case r.Type != "CNAME" && types["CNAME"]:
+			c.recProblem(z, r, Warning, "disabled_conflict", "the disabled record %s %s %s can't be enabled again while %s has a CNAME (a CNAME must be the only record at its name)", disp(r.Name), r.Type, r.Data, disp(r.Name))
+		case r.Type == "CNAME" && len(types) > 0:
+			c.recProblem(z, r, Warning, "disabled_conflict", "the disabled CNAME %s → %s can't be enabled again while %s has other records (a CNAME must be the only record at its name)", disp(r.Name), r.Data, disp(r.Name))
+		}
+	}
+}
+
 func (c *checker) checkZoneRecords(z *model.Zone) {
 	ix := &zoneIndex{
 		z:      z,

internal/validate/validate.go

@@ -115,13 +115,14 @@ type checker struct {
 	opts     Options
 	problems []Problem
 	// indexes
-	zoneRecords map[int64][]*model.Record
+	zoneRecords map[int64][]*model.Record // served records (not disabled)
+	allRecords  map[int64][]*model.Record
 	keyNames    map[string]bool
 }
 
 // State validates the complete state.
 func State(s *model.State, opts Options) []Problem {
-	c := &checker{s: s, opts: opts, zoneRecords: s.RecordsByZone(), keyNames: map[string]bool{}}
+	c := &checker{s: s, opts: opts, zoneRecords: s.ServedRecordsByZone(), allRecords: s.RecordsByZone(), keyNames: map[string]bool{}}
 	for _, k := range s.Keys {
 		c.keyNames[k.Name] = true
 	}

internal/validate/zones.go

@@ -105,8 +105,8 @@ func (c *checker) checkZones() {
 				}
 			}
 		}
-		if !z.HasRecords() && len(c.zoneRecords[z.ID]) > 0 {
-			c.zoneProblem(z, Error, "zone_records_unmanaged", "%s zones can't have records managed by Jarl (they get their data from elsewhere); delete the %d records or change the type to primary", z.Type, len(c.zoneRecords[z.ID]))
+		if !z.HasRecords() && len(c.allRecords[z.ID]) > 0 {
+			c.zoneProblem(z, Error, "zone_records_unmanaged", "%s zones can't have records managed by Jarl (they get their data from elsewhere); delete the %d records or change the type to primary", z.Type, len(c.allRecords[z.ID]))
 		}
 	}
 }
@@ -188,6 +188,7 @@ func (c *checker) checkPrimary(z *model.Zone) {
 		c.zoneProblem(z, Info, "zone_name_slash", "zone names with '/' (RFC 2317) are supported, but the file name is escaped")
 	}
 	c.checkZoneRecords(z)
+	c.checkDisabledRecords(z)
 }
 
 // humanSeconds formats a duration in seconds as e.g. "1 day" or "12 hours".

internal/web/static/assets/charts.js

@@ -324,9 +324,11 @@ export function barList(entries, { total, label = (k) => k, empty = "No data yet
     const share = sum ? (e.count / sum) * 100 : 0;
     const name = label(e.key);
     const link = href ? href(e.key) : null;
-    return h("li", { title: name + ": " + e.count.toLocaleString() + " (" + share.toFixed(1) + "%)" },
+    // Clients Jarl has a host name for: the name, then the address.
+    const shown = e.name ? [e.name, h("span", { class: "muted" }, " " + name)] : name;
+    return h("li", { title: (e.name ? e.name + " (" + name + ")" : name) + ": " + e.count.toLocaleString() + " (" + share.toFixed(1) + "%)" },
       h("div", { class: "bar-text" },
-        link ? h("a", { href: link, class: "bar-label" }, name) : h("span", { class: "bar-label" }, name),
+        link ? h("a", { href: link, class: "bar-label" }, shown) : h("span", { class: "bar-label" }, shown),
         h("span", { class: "bar-value" }, compact(e.count), h("span", { class: "muted" }, " · " + share.toFixed(share < 10 ? 1 : 0) + "%"))),
       h("div", { class: "bar-track" }, h("div", { class: "bar-fill", style: { width: Math.max(0.5, (e.count / peak) * 100) + "%" } })));
   }));

internal/web/static/assets/pages/dnssec.js

@@ -71,10 +71,34 @@ function stateBadge(st) {
   return badge(st, { omnipresent: "ok", rumoured: "accent", unretentive: "warn" }[st] || "");
 }
 
+// parentName is the zone's name relative to its parent zone in Jarl
+// ("sectest" for sectest.adbraun.lol in adbraun.lol).
+function parentName(zone, s) {
+  return zone.name.slice(0, -(s.parent_zone.length + 1));
+}
+
+// jarlCmd is the jarl command for a record change in the parent zone.
+function jarlCmd(zone, s, verb, data) {
+  return ["jarl record", verb, display(s.parent_zone), parentName(zone, s), "DS", data, s.parent_view ? "--view " + s.parent_view : ""].filter(Boolean).join(" ");
+}
+
+const dsData = (k) => [k.ds.key_tag, k.ds.algorithm, k.ds.digest_type, k.ds.digest].join(" ");
+
+// inParent reports whether the parent zone in Jarl has the key's DS record.
+const inParent = (s, k) => (s.parent_ds || []).some((d) => d.toUpperCase() === dsData(k).toUpperCase());
+
+async function addToParent(zone, s, k) {
+  try {
+    const r = await change("POST", "/zones/" + s.parent_zone_id + "/records", { name: parentName(zone, s), type: "DS", data: dsData(k) });
+    toast(describeResult(r));
+    rerender();
+  } catch (e) { toast(e.message, "err", 8000); }
+}
+
 function dsPanel(zone, s, keys) {
   const ph = s.phase;
   const where = s.parent_zone
-    ? ["The parent zone ", h("a", { href: "#/zones" }, display(s.parent_zone)), " is in Jarl: add this as a DS record there (name ", h("code", null, display(zone.name)), ")."]
+    ? ["The parent zone ", h("a", { href: "#/zones/" + s.parent_zone_id + "/records" }, display(s.parent_zone)), " is in Jarl: add this as a DS record there (name ", h("code", null, parentName(zone, s)), "), with the button or the jarl command below."]
     : "Give this to your registrar (at Porkbun: the domain's DNSSEC settings). Registrars ask either for the whole record or for its four fields.";
   return h("div", { class: "panel" },
     h("h2", null, "DS record for the parent zone"),
@@ -90,6 +114,13 @@ function dsPanel(zone, s, keys) {
     keys.map((k) => h("div", { class: "ds-record" },
       h("label", { class: "small muted" }, "Key " + k.tag + " — DS record"),
       copyBox(k.ds.record.replace(/\t/g, " ")),
+      s.parent_zone ? [
+        h("label", { class: "small muted" }, "jarl command"),
+        copyBox(jarlCmd(zone, s, "add", dsData(k))),
+        inParent(s, k)
+          ? h("p", { class: "small" }, badge("in " + display(s.parent_zone), "ok"), " ", display(s.parent_zone) + " has this DS record.")
+          : h("p", null, h("button", { class: ph.can_publish_ds ? "primary" : "", disabled: !ph.can_publish_ds, title: ph.can_publish_ds ? "" : "Not yet: see above", onclick: () => addToParent(zone, s, k) }, "Add to " + display(s.parent_zone))),
+      ] : null,
       h("dl", { class: "kv small" },
         h("dt", null, "Key tag"), h("dd", null, copyBox(String(k.ds.key_tag))),
         h("dt", null, "Algorithm"), h("dd", null, copyBox(String(k.ds.algorithm)), h("span", { class: "muted" }, " " + (k.algorithm_name || ""))),
@@ -142,7 +173,9 @@ async function disableDialog(zone, s) {
     h("p", null, "Signing is turned off in steps, so the zone is never unsigned while the parent zone still has its DS record (validating resolvers would then reject the whole domain):"),
     steps([
       [h("strong", null, "Now: "), "the zone switches to BIND's insecure policy. named keeps it signed and publishes a CDS \"delete\" record. Nothing breaks."],
-      [h("strong", null, "You: "), "remove the DS record at your registrar (", s.registrar ? "the Registrar tab can do that at Porkbun" : "at Porkbun: the domain's DNSSEC settings", "), then click Check DS at parent so named knows it's gone."],
+      s.parent_zone
+        ? [h("strong", null, "You: "), "remove the DS record from ", display(s.parent_zone), " (", h("code", null, jarlCmd(zone, s, "delete", "")), ", or on its Records page), then click Check DS at parent so named knows it's gone."]
+        : [h("strong", null, "You: "), "remove the DS record at your registrar (", s.registrar ? "the Registrar tab can do that at Porkbun" : "at Porkbun: the domain's DNSSEC settings", "), then click Check DS at parent so named knows it's gone."],
       [h("strong", null, "named: "), "waits until resolvers have forgotten the DS (the parent's DS TTL, often a day), then removes the keys and signatures."],
       [h("strong", null, "Then: "), "this page lets you finish, which switches DNSSEC off."],
     ]),

internal/web/static/assets/pages/zone.js

@@ -436,6 +436,8 @@ async function recordsTab(el, zone, query) {
   // Filters and table
   const filter = input({ type: "search", placeholder: "Filter by name or data…", value: query.get("q") || "" });
   const typeFilter = select([["", "All types"], ...[...new Set(records.map((r) => r.type))].sort()], "");
+  // Shown once the zone has disabled records.
+  const stateFilter = select([["", "Enabled and disabled"], ["on", "Enabled only"], ["off", "Disabled only"]], "");
   const list = h("div");
   let editing = null;
   let current = records;
@@ -445,18 +447,30 @@ async function recordsTab(el, zone, query) {
   };
   const draw = () => {
     const q = filter.value.trim().toLowerCase();
-    const rows = current.filter((r) => (!q || r.name.includes(q) || r.data.toLowerCase().includes(q) || (r.comment || "").toLowerCase().includes(q)) && (!typeFilter.value || r.type === typeFilter.value));
-    let prevName = null;
+    const off = current.filter((r) => r.disabled).length;
+    stateFilter.style.display = off || stateFilter.value ? "" : "none";
+    stateFilter.options[2].textContent = "Disabled only (" + off + ")";
+    const rows = current.filter((r) => (!q || r.name.includes(q) || r.data.toLowerCase().includes(q) || (r.comment || "").toLowerCase().includes(q)) && (!typeFilter.value || r.type === typeFilter.value) &&
+      (!stateFilter.value || !!r.disabled === (stateFilter.value === "off")));
     mount(list, table([
-      { label: "Name", render: (r) => reverse && addressOf(r.name) ? [r.relative_name, " ", h("span", { class: "muted small" }, addressOf(r.name))] : r.relative_name, tdClass: (r) => { const rep = r.name === prevName; prevName = r.name; return "name" + (rep ? " repeat" : ""); } },
+      { label: "Name", render: (r) => reverse && addressOf(r.name) ? [r.relative_name, " ", h("span", { class: "muted small" }, addressOf(r.name))] : r.relative_name, tdClass: "name" },
       { label: "TTL", render: (r) => r.ttl !== undefined && r.ttl !== null ? String(r.ttl) : h("span", { class: "muted", title: "zone default" }, String(r.effective_ttl)), tdClass: "mono" },
       { label: "Type", render: (r) => h("strong", null, r.type) },
       { label: "Data", render: (r) => r.data, tdClass: "data" },
-      { label: "Comment", render: (r) => [r.pending ? [pendingBadge(r.pending), " "] : null, h("span", { class: "muted" }, r.comment || "")] },
+      { label: "Comment", render: (r) => [r.disabled && r.pending !== "disable" ? [badge("disabled"), " "] : null, r.pending ? [pendingBadge(r.pending), " "] : null, h("span", { class: "muted" }, r.comment || "")] },
       { label: "", render: (r) => r.pending === "delete" ? "" : h("span", null,
         h("button", { class: "small", title: "Edit", onclick: () => edit(r) }, "Edit"), " ",
+        r.disabled
+          ? h("button", { class: "small toggle", title: "Put the record back in the zone", onclick: () => toggle(r) }, "Enable")
+          : h("button", { class: "small toggle", title: "Leave the record out of the zone, but keep it here", onclick: () => toggle(r) }, "Disable"), " ",
         h("button", { class: "small danger", title: "Delete", onclick: () => del(r) }, "Delete")), tdClass: "actions-cell" },
-    ], rows, { empty: current.length ? "No records match." : "No records yet.", rowClass: (r) => r.pending ? "pending-" + r.pending : "" }));
+    ], rows, { empty: current.length ? "No records match." : "No records yet.", rowClass: (r, i) => [
+      r.pending ? "pending-" + r.pending : "",
+      r.disabled ? "disabled" : "",
+      // A record followed by more of the same name: a faint line, so the
+      // full line marks where the next name starts.
+      rows[i + 1] && rows[i + 1].name === r.name ? "same-name-next" : "",
+    ].filter(Boolean).join(" ") }));
     if (editing) mountEdit();
   };
   const del = async (r) => {
@@ -474,6 +488,17 @@ async function recordsTab(el, zone, query) {
       await redraw();
     } catch (e) { toast(e.message, "err", 8000); }
   };
+  // toggle disables or enables a record, and the PTR record that goes
+  // with an address record.
+  const toggle = async (r) => {
+    const verb = r.disabled ? "enable" : "disable";
+    const ptr = r.type === "A" || r.type === "AAAA";
+    try {
+      const res = await change("POST", "/records/" + r.id + "/" + verb, undefined, { query: ptr ? { ptr: 1 } : undefined });
+      toast(describeResult(res));
+      await redraw();
+    } catch (e) { toast(e.message, "err", 8000); }
+  };
   const edit = (r) => { editing = r; draw(); };
   const mountEdit = () => {
     const r = editing;
@@ -521,12 +546,13 @@ async function recordsTab(el, zone, query) {
   };
   filter.addEventListener("input", draw);
   typeFilter.addEventListener("change", draw);
+  stateFilter.addEventListener("change", draw);
   mount(el,
     h("div", { class: "panel" },
       reverse && rinfo ? h("div", { class: "muted small", style: { marginBottom: "6px" } }, "Reverse zone for " + rinfo.network + ": name records by address (e.g. " + rinfo.example + ") and give the host name as data.") : null,
       form, willAdd, suggest, hint, err),
     h("div", { class: "panel" },
-      h("div", { class: "actions", style: { marginBottom: "8px" } }, filter, typeFilter,
+      h("div", { class: "actions", style: { marginBottom: "8px" } }, filter, typeFilter, stateFilter,
         h("span", { class: "muted small" }, "Highlighted rows are pending changes (not live until applied). " +
           (reverse ? "Names are the last part of the address within " + zone.display_name + "." : "Names are relative to " + zone.display_name + "; end a name with '.' to make it absolute."))),
       list));

internal/web/static/assets/pages/zones.js

@@ -23,10 +23,10 @@ export async function render(el, params, query) {
     lastList.zones = hash;
     const rows = zones.filter((z) => (!q || z.name.includes(q)) && (!viewSel.value || z.view === viewSel.value) && (!typeSel.value || z.type === typeSel.value));
     mount(list, table([
-      { label: "Zone", render: (z) => [z.pending === "delete" ? h("span", null, z.display_name) : h("a", { href: "#/zones/" + z.id }, z.display_name), z.pending ? [" ", pendingBadge(z.pending)] : null], tdClass: "name" },
+      { label: "Zone", render: (z) => [z.pending === "delete" ? h("span", null, z.display_name) : h("a", { href: "#/zones/" + z.id }, z.display_name), dnssecLock(z), z.pending ? [" ", pendingBadge(z.pending)] : null], tdClass: "name" },
       views.length ? { label: "View", render: (z) => viewLink(viewsById.get(z.view_id), z.view, hash) } : null,
       { label: "Type", render: (z) => badge(z.type, z.type === "primary" ? "accent" : "") },
-      { label: "Records", render: (z) => z.type === "primary" ? String(z.record_count) : "", class: "right", tdClass: "right" },
+      { label: "Records", render: (z) => z.type === "primary" ? [String(z.record_count), z.disabled_count ? h("span", { class: "muted small", title: z.disabled_count + " disabled (left out of the zone)" }, " (" + z.disabled_count + " off)") : null] : "", class: "right", tdClass: "right" },
       { label: "Serial", render: (z) => z.type === "primary" ? String(z.soa.serial) : "", tdClass: "mono" },
       { label: "Comment", render: (z) => h("span", { class: "muted" }, z.comment || "") },
     ].filter(Boolean), rows, { empty: zones.length ? "No zones match." : "No zones yet. Create one, or import your existing BIND configuration with 'jarld import'.", rowClass: (z) => z.pending ? "pending-" + z.pending : "" }));
@@ -236,6 +236,24 @@ export function emailOf(rname) {
   return m[1].replace(/\\\./g, ".") + "@" + m[2];
 }
 
-export function pendingBadge(kind) {
-  return badge({ add: "pending: new", change: "pending: changed", delete: "pending: delete" }[kind] || kind, kind === "delete" ? "err" : "warn");
+// dnssecLock marks a signed zone with a padlock linking to its DNSSEC tab:
+// closed while signed, open while signing is being turned off (BIND's
+// insecure policy).
+function dnssecLock(z) {
+  if (!z.dnssec_policy) return null;
+  const off = z.dnssec_policy === "insecure";
+  const a = h("a", {
+    class: "dnssec-lock" + (off ? " off" : ""),
+    href: "#/zones/" + z.id + "/dnssec",
+    title: off ? "DNSSEC: signing is being turned off" : "DNSSEC: signed (policy " + z.dnssec_policy + ")",
+    "aria-label": off ? "DNSSEC being turned off" : "DNSSEC signed",
+  });
+  a.innerHTML = '<svg viewBox="0 0 16 16" width="13" height="13" aria-hidden="true"><path d="' +
+    (off ? "M5 7V5a3 3 0 0 1 5.8-1.1" : "M5 7V5a3 3 0 0 1 6 0v2") +
+    '" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"/><rect x="3" y="7" width="10" height="7.5" rx="1.5" fill="currentColor"/></svg>';
+  return a;
+}
+
+export function pendingBadge(kind) {
+  return badge({ add: "pending: new", change: "pending: changed", delete: "pending: delete", disable: "pending: disable", enable: "pending: enable" }[kind] || kind, kind === "delete" ? "err" : "warn");
 }

internal/web/static/assets/style.css

@@ -141,12 +141,16 @@ th { font-size: 12px; color: var(--muted); font-weight: 600; text-transform: upp
 tr:hover td { background: var(--info-soft); }
 td.data { font-family: var(--mono); font-size: 13px; word-break: break-all; }
 td.name { font-family: var(--mono); font-size: 13px; white-space: nowrap; }
-td.name.repeat { color: var(--muted); }
+a.dnssec-lock { display: inline-flex; vertical-align: -1px; margin-left: 6px; color: var(--ok); text-decoration: none; }
+a.dnssec-lock.off { color: var(--warn); }
+tr.same-name-next td { border-bottom-color: color-mix(in srgb, var(--border) 40%, transparent); }
 td.actions-cell { white-space: nowrap; text-align: right; width: 1%; }
 tr.editing td { background: var(--accent-soft); }
 tr.pending-add td { background: var(--add); }
-tr.pending-change td { background: var(--warn-soft); }
+tr.pending-change td, tr.pending-disable td, tr.pending-enable td { background: var(--warn-soft); }
 tr.pending-delete td { background: var(--del); text-decoration: line-through; color: var(--muted); }
+tr.disabled td:not(.actions-cell), tr.disabled td strong { color: var(--muted); }
+button.toggle { min-width: 5.2em; }
 .empty { color: var(--muted); padding: 18px; text-align: center; }
 
 /* Forms */

scripts/e2e.sh

@@ -162,6 +162,22 @@ contains "adbraun.test"
 run "record add with PTR" 0 $J record add adbraun.test web A 192.168.1.30 --ptr --ttl 300
 expect_dig "web A" "192.168.1.30" web.adbraun.test A
 expect_dig "PTR 30" "web.adbraun.test." 30.1.168.192.in-addr.arpa PTR
+run "record disable with PTR" 0 $J record disable adbraun.test web A --ptr
+expect_dig "disabled web A gone" "" web.adbraun.test A
+expect_dig "disabled PTR 30 gone" "" 30.1.168.192.in-addr.arpa PTR
+run "record list marks it" 0 $J record list adbraun.test --disabled
+contains "\[disabled\]"
+run "disabling twice says so (exit 5)" 5 $J record disable adbraun.test web A
+contains "already disabled"
+run "record enable with PTR" 0 $J record enable adbraun.test web A --ptr
+run "record list -o id" 0 $J record list adbraun.test --name web -t A -o id
+if echo "$OUT" | grep -qx '[0-9][0-9]*'; then ok "-o id is just the ID"; else bad "-o id gave '$OUT'"; fi
+run "disable by the listed ID" 0 $J record disable --id "$OUT"
+run "zone show -o field" 0 $J zone show adbraun.test -o field=name,record_count,disabled_count
+contains "^adbraun.test.	[0-9]*	1$"
+run "enable by ID" 0 $J record enable --id "$($J record list adbraun.test --name web -t A -o id)"
+expect_dig "enabled web A back" "192.168.1.30" web.adbraun.test A
+expect_dig "enabled PTR 30 back" "web.adbraun.test." 30.1.168.192.in-addr.arpa PTR
 run "CNAME conflict rejected (exit 6)" 6 $J record add adbraun.test www A 192.168.1.99
 contains "CNAME"
 run "record add TXT with spaces" 0 $J record add adbraun.test @ TXT "v=spf1 mx -all"
@@ -374,6 +390,25 @@ contains "removed .*Kadbraun.test"
 run "dnssec status: clean" 0 $J zone dnssec status adbraun.test --view external
 contains "Status:.*DNSSEC is off.$"
 
+# DNSSEC for a zone whose parent is in Jarl: the DS goes in as a record.
+run "child zone" 0 $J zone create sub.adbraun.test --view external --ns ns1.adbraun.test.
+run "delegate the child" 0 $J record add adbraun.test sub NS ns1.adbraun.test. --view external
+run "dnssec enable the child" 0 $J zone dnssec enable sub.adbraun.test --view external
+for i in $(seq 50); do $J zone dnssec status sub.adbraun.test --view external 2>/dev/null | grep -q "signed serial" && break; sleep 0.2; done
+run "child status gives the jarl command" 0 $J zone dnssec status sub.adbraun.test --view external
+contains "in the parent zone adbraun.test, which is in Jarl"
+contains "jarl record add adbraun.test sub DS [0-9]* 13 2 [0-9A-F]* --view external"
+DSCMD=$(echo "$OUT" | grep -o "jarl record add adbraun.test sub DS .*")
+run "the printed command adds the DS" 0 $J ${DSCMD#jarl }
+run "the parent's zone file has the DS" 0 $J zone file adbraun.test --view external
+contains "^sub.*IN.DS.$(echo "$DSCMD" | sed 's/.* DS \(.*\) --view.*/\1/')"
+run "child status: parent has it" 0 $J zone dnssec status sub.adbraun.test --view external
+contains "adbraun.test has it."
+run "remove the child's DS" 0 $J record delete adbraun.test sub DS --view external --yes
+run "wipe the child" 0 $J zone dnssec wipe sub.adbraun.test --view external --yes --force --resolver 127.0.0.1
+run "delete the child" 0 $J zone delete sub.adbraun.test --view external --yes
+run "remove the delegation" 0 $J record delete adbraun.test sub NS --view external --yes
+
 run "status at the end" 0 $J status
 contains "Drift:.*none"