# Changelog All notable changes to Jarl are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/). ## [Unreleased] ### Added - Certificates for other hosts: `jarl cert get NAME -d DOMAIN --dir DIR --hook CMD` on a mail server or proxy has jarld obtain the certificate (and renew it), waits, downloads it when it is newer than the host's copy, and runs the hook with the file paths in `JARL_CERT_*` variables. Its settings are saved, so `jarl cert get` alone refreshes them all; `jarl cert schedule` writes a daily systemd timer for that; `jarl cert saved` lists them with their expiry; `jarl cert forget` stops one. A certificate belongs to the user that asked for it (other users can't take the name), is obtained again only when a name is added or removed, and the Certificates page shows its owner and who downloaded it, flagging hosts that haven't fetched a renewal. A new `certificates` grant (`certificates:write names=*.adbraun.lol`) says which names a user may have; it is never part of `*`. Users may own `certificates.max_per_user` certificates (10), or their own `--cert-limit`. API: `POST /certificates/{name}/request`. - Certificates can be exported for use outside Jarl: **Export…** on the Certificates page (download, or copy to the clipboard), `jarl cert export NAME [--dir DIR | --part PART]` and `GET /certificates/{name}/pem?part=fullchain|cert|key|bundle`. Administrators only; every export of the private key is audited (`certificate.export_key`). - A reverse zone's "addresses have no PTR record" banner lists them, with the name each would get, instead of only counting them (`ptr_missing_list` in the zone API). - A zone's page links to the same zone in the other views ("also in external"), in each view's colour, keeping the tab you are on. It works for zones that aren't linked too, and the zone API's new `in_views` lists them. - `jarl.service` has the alias `jarld.service`, so `systemctl restart jarld` works too. The alias is linked when the unit is enabled; the package relinks a unit enabled by an older version on upgrade. ### Changed - The Statistics page's range buttons follow `stats.retention`: ranges longer than any data kept are left out, and **1y** and **2y** appear when `retention.day` (or `retention.hour`) covers them (with the default 730d, both do). The busiest-times heatmap says how far back it really goes (at most `retention.hour`), and links to the Explore page keep within `retention.queries` instead of assuming 7 days. `GET /stats/status` and `GET /stats/explore` add `retention_seconds`. - A reverse zone's missing PTR records count only its own view's A and AAAA records. An address only another view's records use (an internal host, seen from the vps view's copy of `10.0.10.in-addr.arpa`) is no longer reported as missing; it shows apart, as `Other views` in `jarl zone show`, `ptr_other_views` in the API and a note on the zone's page. Filling (`--fill`, `jarl zone fill-ptr`, the page's button) names those from the other view only when asked, with `--other-views` (`fill_other_views`, `?other_views=1`, a checkbox in the New reverse zone dialog), so one view's host names don't leak into another. When there is nothing else to fill, Jarl says how many there are and how to add them. The page and `jarl zone show` list those addresses with the name each would get, and the view it comes from (`ptr_other_views_list`); `jarl zone show` lists the missing ones too. - Records, zones and validation findings sort numeric labels by value, so `2.10.0.10.in-addr.arpa` comes before `101.10.0.10.in-addr.arpa` in the web UI, the CLI and the rendered zone files. Names still group by label from the right (subdomains stay under their parent); other labels keep the old byte order (`host10` before `host2`). Zone files are rewritten in the new order the next time they change; named doesn't care about record order. - `cname_chain` no longer warns about one CNAME pointing at another (a service name at a host alias is common, and named answers the chain at once). A chain of three or more CNAMEs gets an info note that shows it. - A certificate's private key is only exported over HTTPS, the local socket, or to the server itself (plain HTTP from another host is refused with `https_required`). - The Certificates page's "Used for" column says DoT and DoH for named, with the addresses in the tooltip, instead of listing every address. A certificate with no use says "not used by Jarl" rather than "nothing yet": it may well be used elsewhere. - Deleting a linked zone's local records (an override) removes that name and type from that view only. It used to bring the shared records back into the view, so a delete looked undone. The other views keep their records, local to each now; **Share** one view's version (`jarl record update ID --shared`) to have it everywhere again. - A linked zone's Compare views tab starts with a view it is linked to, not the first other view. - The New token form only offers templates within what the token's user may do. A token never does more than its user, so offering more only misled. - A zone update that changes nothing is no change: saving a zone's settings without changing them says "Nothing changed" instead of staging an empty change. Staging operations that change nothing (`POST /changesets/{id}/ops`, or `?stage=`) is a 400 "nothing to change". ### Fixed - The "query log is off" error named a setting that doesn't exist, `stats.query_retention`; it's `stats.retention.queries`. - `jarl zone show` for a reverse zone printed only "and 1 more" under "Other views:" when the server was older than the CLI (0.6.1-rc.2 sends the count but not the addresses). It now prints just the count line then. - `jarl changeset show` printed its Created and Applied times in UTC, while `jarl history` and `jarl status` print local time. It uses local time now too. - The statistics' "Busiest times" grid drew hours without data taller than the others (they picked up the page's padding for empty messages). - A token for one view of a linked zone (such as an ACME token with `views=external`) couldn't add records: a new record is shared, and that reached the other view. A new name and type is now local to the view when the user may not change it in the other views. - A zone name in several views had to be given with `--view` even when the user could see it in only one (`jarl record list adbraun.lol` with a one-view token), and the error named views the user can't see. Now the one they can see is used. - `jarl view list` was empty for a user without `views:read`, though they can see zones in views. It now lists those views by name, colour and visible zone count (marked `limited` in the API), without their settings. - The DNSSEC tab told you to give the DS record to your registrar for every zone whose parent isn't in Jarl in the same view. Now it (and `jarl zone dnssec status`, and the API's new `ds_at`, `ds_place` and `ds_note`) says where it really goes: the parent zone in Jarl (in any view now, the zone's own first), the registrar for a registered domain, the parent zone wherever it is hosted for a subdomain, your ISP or RIR for a reverse zone, and nowhere for a private name such as `home.lan` (signing it has no effect). - The Registrar tab (and `jarl zone registrar`, and the DNSSEC page's registrar button) was offered for every zone when `porkbun.domains` is empty, and always failed for subdomain zones (`lab.adbraun.lol`), reverse zones and private names (`home.lan`): Porkbun only knows registered domains. Only zones that are a registered domain (by the public suffix list) get it now; the others say what delegates them instead. - Auto-PTR in linked zones changed PTR records in every linked view, not just where the address record is. A record local to one view got PTR records in the other views too; deleting or changing the address in one view deleted or moved the PTR records of views that still had it. PTR records now follow each view's own address records, are local to their view in a linked reverse zone, and each zone's Reverse DNS setting counts for its own view. **Fill** also adds local PTR records now, not shared ones. The same applies to **Update PTR** (`--ptr`). - Saving the settings of a zone whose primary name server is outside it (`ns1.adbraun.lol.` for `wg.adbraun.lol`) changed the name server to `ns1.adbraun.lol.wg.adbraun.lol.`. The form showed the name without its final dot, which the server reads as relative to the zone. Names outside the zone now keep the dot, and the name server is only sent when it was changed. ### Upgrading - Tested: a 0.6.0 install with views, linked and reverse zones and statistics, opened by 0.6.1-rc.1: every zone, record and view kept, named answered as before, and the new grant and limits worked. - The database gains a migration (certificate owners, per-user certificate limits, certificate downloads). Going back to an older version afterwards means restoring a backup made before the upgrade. ## [0.6.0] - 2026-10-13 ### Added - Reverse zones made easy (docs/reverse.md): - **Missing reverse zones**: the Zones page and `jarl zone suggest-reverse` list the reverse zones the private views lack for their A and AAAA records' addresses: the /24 of a private IPv4 network, a /32 for a public address (the rest of its /24 belongs to others), the /48 of IPv6 addresses. Create one, or all (`--create`), filled. - **Fill**: `jarl zone create 10.0.10.0/24 --fill` (ticked in the New zone dialog) adds a PTR record for each address the view's records use there; `jarl zone fill-ptr` and the reverse zone's page add the ones missing later. An address with several names gets its mail or name server's name, else a host's. - **The right view**: a reverse zone created without a view goes to the private view whose records use its addresses. - **PTR records kept in step** per zone (`jarl zone update ZONE --auto-ptr`, zone settings → Reverse DNS): adding, changing, disabling or deleting an A or AAAA record does the same to its PTR record, as the Update PTR box does for one change. - Suggestions come in two groups: **yours** (private networks, a ULA or an IPv6 /48 this server has an address in), which Create all creates, and **public addresses**, each a /32 or /128 to create only if it is yours (not a web host's) or **Dismiss**. A view can turn suggestions off (`jarl view update vps --reverse-suggestions=false`), e.g. one only a VPS uses. - A zone created inside another in the same view (a /24 inside a /8, `lab.adbraun.lol` inside `adbraun.lol`) takes the parent's records under it, which named would no longer serve from the parent; a delegation and its glue stay. - Zone commands take a network for a reverse zone: `jarl zone show 10.0.10.0/24`. - **New reverse zone** (Zones page) lists the networks your records use without a reverse zone, in every view, also where nothing is suggested (suggestions off, dismissed, public views); pick one, change its size (/48, /56, /64, /128 for IPv6, around the records' address) and create it filled. With a view chosen, it also lists the addresses only other views' records use, and fill names them from there (a VPS's AAAA in external, its PTR in internal). `jarl zone suggest-reverse --all [--view V]`. Both lists have a search, so hundreds of addresses stay manageable: the public addresses fold away, show 25 at a time, and **Dismiss these N** dismisses everything a search found in one change (`--dismiss` takes several networks). - Encrypted DNS: **several host names** (one certificate for all; the health check says when the served certificate misses one), and **each listen address gets its own views** for the host names' records (`--address 10.0.10.5=internal`, a view checkbox per address in the form), local to the view, with a warning when a public view would get a private address. A view no longer ticked loses the address. The form starts from where the records are now. The Certificates page and `jarl cert show` say what named uses a certificate for (DNS over TLS or HTTPS, on which addresses and ports). - docs/encrypted-dns.md: forwarding to Quad9 or Cloudflare over TLS, how to check it works, and why not over HTTPS. - Comparing one name across views: `jarl zone diff adbraun.lol nas [A]`, and a **Compare** button on each record. - **Exploring the statistics**: jarld keeps every answer for a while (`stats.retention.queries`, default 7 days), and every client, name, view, record type, result and blocklist on the Statistics page leads to an explore page for it: answers over time, the top clients, names, views, types, results and blocklists among them (each a link that narrows it further), and the latest answers. "NXDOMAIN in external" → the clients asking → everything one of them asks. A filter bar types filters in, several values each (any of them), `!value` to leave one out and `*.example.com` for a domain and below; **hide** on a list entry leaves it out. **Explore the answers** opens the page from the Statistics page. `GET /stats/explore`. - **Storage** on the dashboard: the size of Jarl's databases (and how many answers the query log holds), and per disk Jarl uses a bar of how full it is and how much of it the databases take. The Statistics page shows the statistics database's size too, and its disk tiles get the same bar. ### Changed - `jarl option set tls NAME …` (and `key`, `remote-servers`, `http`, `dnssec-policy`, `server` …) replaces only the statement with that name: setting `tls cloudflare` used to replace `tls quad9`. `jarl option unset tls cloudflare` removes one by its name. - **Compare views** and `jarl zone diff` are rebuilt around the view you're on (docs/views.md#comparing-views): a summary per view, then what is answered differently (a view's own records in linked zones, drift otherwise) with **Use this everywhere**, the names only some views have, grouped, with **Add to VIEW**, and how many are the same. One line per record: the CLI cuts long TXT records to the terminal (`--wide` shows them whole). `--with` picks the views to compare with. `GET /zones/{zone}/compare` returns these sections instead of `rows`. ### Fixed - Encrypted DNS: the client hints tested with kdig (Knot's, often not installed) and with curl's JSON API, which named's DoH doesn't speak; they use BIND's `dig +tls` / `dig +https` now. - Server options → Added by Jarl: long statements didn't wrap, and the browser console reported a Content Security Policy violation (an inline style the page's policy blocks). ### Upgrading from 0.5 - Tested: 0.5.2 packages with views, a linked zone, a reverse zone, blocking, a `tls` statement and statistics, upgraded in place in Debian 13 (BIND 9.20.29): everything kept and answered as before, the new features worked on the upgraded data, and a 0.5.2 backup restored. - The database gets two new versions (12 and 13), applied when jarld starts; a 0.5 jarld can't open it afterwards, so take a backup first (`sudo jarld backup`). Nothing changes until you turn `auto_ptr` on for a zone. - The statistics database gets a new version too (the query log); 0.5 can't open it afterwards either. It starts empty and fills from then on. ## [0.5.2] - 2026-10-12 ### Added - Mail reverse DNS check: the addresses of the public zones' MX hosts and SPF records are looked up as the internet sees them, every 6 hours: a PTR record whose name resolves back to the address, which Gmail and Outlook require. It says who runs the reverse zone (your provider) and what to set there, and notes when Jarl has its own reverse zone for the address, which only your clients see. The Exposure page (Check now), `jarl exposure mail` and Prometheus `jarl_mail_reverse_dns_ok`. - Added by Jarl: the Server options page, `jarl option generated` and `GET /options/generated` list what Jarl writes into named.conf by itself (keys.conf, the statistics channel and logging, blocking's response-policy, the view keys), why, and what controls each. - `stats.rate_limit_log` (default true): `false` stops Jarl adding named's `query-errors` category to its log channel when rate limiting is set. ### Changed - Option values with a list of three or more elements (allow-query, forwarders, listen-on, ...) are shown one element per line. ## [0.5.1] - 2026-10-12 ### Added - Encrypted DNS health: jarld checks the DoT and DoH listeners every 10 minutes as a client would (the certificate is for the host name, current and the one Jarl last wrote; a question gets an answer) and says what is wrong: nothing listening, a firewall, the wrong or an older certificate. On the Encrypted DNS page (Check now), the dashboard, `jarl encrypted-dns health` and Prometheus `jarl_encrypted_dns_up`. - Comparing a zone's views: the Compare views tab and `jarl zone diff` show the names and types that differ between the views that have a zone, linked or not, with "Use this version" to share one view's version. `GET /zones/{zone}/compare`. ### Changed - `--local` (and `"local": true`) works on zones that aren't linked too: their records are local anyway. `--shared` there is still refused. - When `certificates.dir` changes, jarld points the `tls` statements encrypted DNS wrote at the new place when it starts; named kept the old copies before, which renewals no longer updated. ### Fixed - Sharing a view's version of a name that was shared already (Use this version on the shared side) didn't replace another view's override; it said there was nothing to do. ## [0.5.0] - 2026-10-12 ### Upgrading from 0.4 - The database gets three new versions (internet exposure, certificates, linked zones), applied when jarld starts; a 0.4 jarld can't open it afterwards, so take a backup first (`sudo jarld backup`). Backups made by 0.4 restore into this version. Tested: 0.4.0 packages with views, zones, records, blocking and statistics, upgraded in place and restored from a 0.4.0 backup. - Statistics per view start with this version: earlier figures are for all views together. - New exposure warnings (docs/exposure.md) appear for views reachable from the internet, e.g. "no rate-limit" or "version visible" on an external view: fix them from the Exposure page, or acknowledge them. A change that newly opens a public view up (an open resolver, say) now needs `--accept-risk`, or the checkbox on the Changes page. - Once you use address ranges, the database can't go back to 0.4: its parser doesn't know them. Remove the ranges first if you need to downgrade. ### Changed - The web UI's top bar had grown too long, and the user name, Users and Log out ended up on a second line on the left. The server's configuration and security pages (Server options, ACLs, TSIG keys, Exposure, Certificates, Encrypted DNS, Audit log) are now in a **Server** menu, and Account, Users and Log out in a menu under your name. On narrow screens the search box and your name stay together on the right. ### Fixed - "update PTR" when editing a record (`jarl record update ID --ptr`) did nothing unless the name or address changed too, and the web UI didn't even send it alone: a reverse zone created after the record never got its PTR. Alone, it now adds the PTR record if it is missing (or enables it). For records of linked zones, the reverse zones of every linked view count, not only the record's own view. - Option values in the web UI looked different from the editor: a long line wrapped back to the left edge, losing its indentation, and the column changed width when Edit opened. Values now keep their layout (a long line scrolls), with the same width and padding as the editor. The "{ } around the list are optional" hint only shows for options that end in a list (not rate-limit, which only has one inside). - Query statistics skipped every query signed with a TSIG key (named writes "/key NAME" after the client's port), such as queries with a view's key: they are counted now. - A changeset with a staged record delete could not be applied after that record was deleted elsewhere (e.g. with the CLI), and it was hard to see which operation to remove: the error only said "record 832 does not exist". A staged delete of a record that is already gone now counts as done (with a warning), and the other operations that no longer apply (an edit or disable of a deleted record, a change to an object changed since) are named with their number and summary. The Changes page marks that operation and offers to remove it right in the error. ### Added - Statistics per view ([docs/stats.md](docs/stats.md#views)): the Statistics page has a toggle per view, with All and None, remembered in the browser, to see some views only or several together (linked views, say). Answers, result codes, record types, zones, blocking, rate limiting and the top lists follow it; named's own counters stay for the whole server, and the page says so. `jarl stats --view`, API `?views=`. Per-view figures start with this version. - DNS over TLS and HTTPS ([docs/encrypted-dns.md](docs/encrypted-dns.md)): `jarl encrypted-dns setup --hostname NAME --address ADDR` (and the Encrypted DNS page) obtains a certificate for the host name if needed, checks that nothing else listens on port 853 and the DoH port (443 by default) at those addresses, offering a free port, and stages named's `tls` statement and listeners as one change, keeping port 53 where it was, plus the host name's records in your private views (local to the view in a linked zone). The page and `jarl encrypted-dns` say what to give Android, Linux, Firefox, Chrome and Windows. A `tls` statement whose files are missing is refused (`tls_file_missing`), and a certificate named uses can't be deleted. - Linked zones ([docs/views.md](docs/views.md#linked-zones)): zones of the same name in different views can be linked, and Jarl keeps their shared records in step: a change in one view reaches the others in the same changeset (diff, permissions, history and undo cover every view). Each view can still have records of its own (`--local`, "Only here"), which override the shared records of that name and type there, and keeps its own zone options. Linking existing zones changes no answer: what is the same everywhere becomes shared, the rest stays local, and a view's version can be shared later (`--shared`, "Share"). `jarl zone link` and `unlink`, `zone create --link-with VIEW`, `record add|set|update --local|--shared`, a LINK column in `record list`, "Keep them linked" when copying a zone in the web UI, `POST /zones/{zone}/link` and `/unlink`. ACME challenges are written once per link, and `--view all` changes a link once. - TLS certificates ([docs/certificates.md](docs/certificates.md)): Jarl obtains certificates from Let's Encrypt or any ACME CA (account set up in jarl.yaml under `acme.account`) and renews them itself, from the CA's renewal information (ARI) or two thirds into their lifetime, with back-off after failures. It answers the DNS-01 challenges in a zone it serves, or through Porkbun's DNS API while Porkbun serves the domain; `auto` decides from the domain's public name servers at every renewal, so moving the domain to your own name servers needs no change. A CNAME on `_acme-challenge` into a zone Jarl serves is followed, for domains hosted elsewhere. A certificate is used for jarld's HTTPS ("web") and/or written for named (`/tls/NAME/`, "dns"; named rereads it on renewal), and certificates you renew yourself can be used too (reread when their files change). Certificates page and dashboard card in the web UI, `jarl cert` (check, create, issue, update, delete, account), `/api/v1/certificates`, Prometheus `jarl_certificate_expiry_timestamp_seconds`, `jarl_certificate_failing`. - jarld serves HTTPS and plain HTTP on the same ports once it has a certificate (`tls.cert_file`, or one with the web use, which takes effect without a restart): plain HTTP from the server itself and from trusted proxies is served as before, browsers elsewhere are redirected to HTTPS and API requests get `https_required`. Before, with `tls.cert_file`, plain HTTP got an error even from localhost. - Internet exposure ([docs/exposure.md](docs/exposure.md)): Jarl works out which views are reachable from the internet (match-clients ending in a catch-all; for a server without views, open allow-query and a non-private listen address), with a per-view override, and checks them: response rate limiting, open resolvers, ANY answers (minimal-any), cache snooping, open NOTIFY and zone transfers, BIND version and host name, management interfaces. Fixes are staged like any change, including response rate limiting from ISC's example in log-only mode, with your secondaries exempt, and a later "start enforcing". With statistics on, Jarl reads named's rate limiting log lines and shows what was (or would have been) limited: counts, client networks and names (Exposure page, `jarl stats breakdown rrl`, top lists `ratelimited`, Prometheus `jarl_ratelimit_logged_total`). A change that newly opens a public view up must be confirmed (checkbox on the Changes page, `--accept-risk`, API `accept_risk`; 409 `confirm_risk` otherwise). Findings can be acknowledged with a reason: they stay visible as info, with who, when and why. Exposure page and dashboard card in the web UI, `jarl exposure` (fix, ack, unack), `GET /exposure`. - `jarl changeset show`, `diff`, `apply`, `discard` and `remove` take the changeset from `-C` or `JARL_CHANGESET` when no ID is given (`jarl changeset apply`). A changeset from `JARL_CHANGESET` is now checked before it is used, for staging too: it must exist, be open and be yours, so a stale export (an applied changeset, or an ID that later turned into someone else's web UI draft) can't silently take your changes; the error says what to do. Commands say on stderr which changeset from `JARL_CHANGESET` they use, and `apply`/`discard` remind you to `unset JARL_CHANGESET`. `-C` and ID arguments are used as given. - Address ranges such as `10.0.10.101-10.0.10.199` or `2001:db8::100-2001:db8::1ff` (also `!` negated, and with spaces around the dash) wherever an address match list is used: ACLs, views' match-clients and match-destinations, options such as allow-query, and blocking's client groups ([docs/concepts.md](docs/concepts.md)). Jarl keeps the range as written and writes the fewest prefixes that cover exactly that range to named.conf, with the range as a comment. The web UI shows what a range becomes while you type it (`GET /catalog/ranges`). Mistakes are refused when entered: an end that isn't a full address, the start after the end, IPv4 mixed with IPv6, a range in an option that takes no address match list (forwarders). A range covered by an earlier element is reported as never matching, a range of every address counts as "any" for the open resolver and open transfer checks, and an IPv6 range in the IPv4-mapped space gets a warning. ACL names can no longer look like a range. - Prometheus metrics at `/metrics` ([docs/metrics.md](docs/metrics.md)), set up in the new `metrics:` section of jarl.yaml (off by default). `metrics.allow` lists the addresses that may scrape (loopback by default), `metrics.token` lets anyone who sends it as a bearer token scrape, and `metrics.listen` adds addresses that serve only `/metrics` (for a Prometheus server elsewhere). Root and jarld's own user can also scrape on the local socket. - Health, always: named up, recursive and TCP clients against their limits, adopted, open changesets, last apply, validation problems by severity, drifted files, object counts, the last backup (and failure, and whether it is stale), blocking paused, each blocklist's entries, last check and change and whether it fails, the DNSSEC phase of every signed zone, and when API tokens expire. - With query statistics on: named's counters (queries, result codes, record types, UDP/TCP, authoritative/recursive, rate limiting, upstream round-trip times, DNSSEC validation, cache hits) and Jarl's (logged responses per view and zone, blocked queries per blocklist), as counters since jarld started, plus named's memory, CPU, threads, cache and sockets, and the collector's health. - Example queries and alert rules, checked with promtool. ## [0.4.0] - 2026-10-11 ### Upgrading from 0.3 - Back up first (`sudo jarld backup`). - When jarld first starts, it rewrites named's configuration: options move into their new fixed order, and every view gets its view key in `match-clients` and `keys.conf`. It is checked with named-checkconf before named reloads, like any apply. Files you changed by hand are left alone; the log then says to run `jarl resync`. - The systemd unit changed (it allows `AF_NETLINK`). The package replaces it; an override that adds `AF_NETLINK` (`systemctl edit jarl`) does no harm and can be removed. - The database moves to schema 8 (disabled zones, client groups) as jarld starts. - If statistics showed a spike after views were created or changed, see "Statistics" under Fixed: the bad minutes can be removed from `/var/lib/jarl/stats.db` (minute rows have `res = 'm'`; the hours and days that include them are `'h'` and `'d'`). ### Added - Different blocking for different devices (docs/blocking.md), like Pi-hole's groups, in one view and without loading any list twice. Client groups put devices (addresses, networks or ACLs of them) at a blocking step: `off` (only your rules), `normal` (the default), or steps you add above it, each including the lists of the steps below. Lists start at a step. Jarl puts a small "gate" policy zone in front of each step's lists that lets the devices below that step through. Web UI: a Devices panel on the Blocking page and a step on each list. CLI: `jarl block step`, `jarl block group`, `jarl blocklist update --step`. API: `/blocking/steps`, `/blocking/groups`. Database schema 8. - View keys: every view gets a TSIG key, `jarl-view-NAME`, at the front of its match-clients, so a query signed with it lands in that view from any address. Jarl signs its delegation check's queries to this server's own addresses with the key of the zone's view: before, they got whichever view matched the server's own address (usually internal), so the check could report the wrong serial for the external view. `jarl view key VIEW` shows a key, for `dig -k` (docs/views.md). The first apply after upgrading adds the keys to named.conf and keys.conf. - Server statistics: named's memory (resident, and its own count) and CPU use, its cache size, sockets, and recursive and TCP clients against their limits; the host's memory and load; free space where zone files, logs and Jarl's data are. Memory and CPU are kept over time like the other statistics. Statistics page → Server, `jarl stats server`, API `/stats/server`. Read from named's statistics channel, `rndc status` and /proc, with no extra privileges. - CLI: the record commands that change records take several views, `--view internal,external`, or `--view all`, and make the change in each, as one changeset (all views or none). - Blocking can be paused until resumed, like Pi-hole's "indefinitely": `jarl block pause indefinitely`, **Until I resume** on the Blocking page, `{"indefinitely": true}` in the API. - Disabled zones: a zone can be disabled instead of deleted. named stops loading it (its zone statement is left out of named.conf), while Jarl keeps it with its records, options and history, still editable; enabling it serves it as it is then. Disabling says what clients get instead (recursion, or REFUSED). Signed zones can't be disabled. Web UI: Disable/Enable on the zone page, a badge in the zone list. CLI: `jarl zone disable|enable`. API: `PATCH /zones/{zone}` with `{"disabled": true}`. Database schema 7. - Blocking (docs/blocking.md): named answers "doesn't exist" for ads, trackers and malware, using BIND's response policy zones. - Blocklists in Adblock, hosts or plain-domain format, downloaded by jarld and checked daily (`blocking.refresh`). A list is downloaded only when the server says it changed, checked with named-checkzone, and reloaded only when its content differs; a failed update keeps the previous version and shows on the dashboard. - Your own block and allow rules, for a domain and the names below it or the exact name. Rules take precedence over every list, and the most specific rule wins. - Lists and rules apply to chosen views, or to every view that offers recursion. They are configuration: staged, reviewed and reverted like any change. - Checking a name says whether it is blocked and by which rule or list entry, with an Allow button in the web UI. - Web UI: a Blocking page, with well-known lists to pick and named's memory per list. CLI: `jarl blocklist` and `jarl block`. API: `/blocking/lists`, `/blocking/rules`, `/blocking/check`. - Pausing: `jarl block pause [DURATION]` or the Blocking page lets every name through for a while (at most a day); blocking resumes by itself. The lists stay loaded, so it takes effect at once. - Statistics: blocked queries over time (a line on the queries chart) and their share, blocked per list, the most blocked names and the clients with the most blocked queries (`jarl stats top blocked`, `top blocked-clients`). Blocked answers no longer count as names that don't exist. - The view choice in the web UI's forms is a compact dropdown, however many views there are. - A `blocking` permission; database schema 6. ### Changed - Web UI: each view has its own page, like a zone: Settings (match lists, comment, colour), Options and Zones tabs (with **New zone in VIEW**), and Delete. The Views page lists them in order, with the arrows that reorder them; view links everywhere open the view's page. - Web UI: A and AAAA records have a **+ CNAME** button that fills in the add form with a CNAME pointing to the record's name, leaving only the alias's name to type. It shows when the row is hovered or focused (always on touch screens). - Blocking page: how many queries each blocklist blocked in the last 24 hours, and your rules together, with statistics on (linking to the Statistics page). - Options are kept in one fixed order, in named.conf, the web UI and the CLI: grouped by topic (files, listening, access control, recursion and forwarding, DNSSEC, transfers and notify, then the rest), alphabetical within a group. The same option is now in the same place in every view and zone. The first apply after upgrading reorders named.conf (a diff that only moves lines). Top-level statements keep their order. - Options that end in a list (`allow-transfer`, `forwarders`, `listen-on`, ...) can be given without their braces, in the web UI, CLI and API: `10.0.10.53; key xfer` becomes `{ 10.0.10.53; key xfer; }`. Before, only some server options (those edited one element per line) added them. - The dashboard's configuration checks include named-checkconf's own warnings about the running configuration (such as `both "recursion no;" and "allow-recursion" active`), which before only showed while applying. The CLI now prints them after an apply too. - Statistics page: cards and tiles fill their rows instead of leaving one alone beside an empty space, and the queries and failed answers charts have the same margins, so their time axes line up. - Dashboard: options have their own tile; "0 TSIG keys · 22 options" read as if the options belonged to the keys. - Web UI times use the 24-hour clock. - Diffs of named.conf say which block each change is in, after the `@@` line numbers (`@@ -50,6 +49,8 @@ view "internal" {`), like git does with function names. Moving an option from the server's options into a view no longer looks like two unrelated edits. - Web UI options (server, top-level, view and zone): values with blocks, such as logging, are shown and edited laid out as in named.conf, over several lines with indentation. The editor grows with its content, Tab indents and Enter keeps the indentation (Esc, then Tab, moves on). With a draft open, the tables show the draft's values, so a staged edit stays visible after Save. - The pending-changes banner has an Apply now button: it applies your draft without going to the Changes page, and stays on the page you're on. If the changes are refused, a dialog says why and links to Changes. - Blocking page: blocklists and rules have an Edit button (name, URL, views, comment; a rule's action and scope). The list button that downloads now is called Refresh, like `jarl blocklist refresh`. - Records table: disabled records are hatched and have a "disabled" badge next to their name, instead of only a muted colour and a badge in the comment column. ### Fixed - Reverting a changeset added needless "restore" operations for blocklists, rules and views that hadn't changed: copying the state turned their empty view lists into missing ones. - Under the shipped systemd unit, jarld couldn't list the host's addresses (it needs a netlink socket, which `RestrictAddressFamilies` didn't allow), so the name server checks didn't recognize this server's own addresses. The Name servers tab then queried them like another server's, and the delegation check didn't sign those queries with the view's key: with views, both got the view matching the server's own address (usually internal) and reported a wrong serial. The unit now allows `AF_NETLINK`, and without it jarld reads the addresses from /proc. - Statistics: after a reconfig that added, removed or recreated views (creating the first view, for instance), a minute could count everything since named started: millions of queries in an hour. A per-view counter (cache, upstream times, validation) going down was taken for a restart of named. Now only a new boot time means a restart, and a counter that goes down counts 0 for that minute. - Blocking page, checking a name: when your own block rule is for that very name, it offers to remove the rule instead of an allow rule, which was refused as a second rule for the same name. It also names the rule that matched rather than the policy zone entry. - docs/validation.md lacked the `disabled_conflict` warning added in 0.3.0. ## [0.3.0] - 2026-10-09 ### Added - Disabled records: a record can be disabled instead of deleted. It stays in Jarl with its ID, TTL and comment but is left out of the zone (the zone file lists it as a comment), and enabling it puts it back exactly as it was. Web UI: a Disable/Enable button on each record, disabled records greyed out with a badge, a filter for them, and a count in the zone list. CLI: `jarl record disable|enable` (by ID or by name, type and data, `--ptr` for the PTR record, `--missing-ok`), `record list --disabled`, and `disable:`/`enable:` entries for `jarl apply -f`. API: `POST /records/{id}/disable|enable`, `POST /zones/{zone}/records/disable|enable`, a `disabled` field on records, `?disabled=` on record lists and `record.disable|enable` operations. Validation checks the zone as it is served: the last NS record can't be disabled, enabling a record is checked like adding it, and a disabled record that a CNAME now blocks gets a warning. Database schema 5. - DNSSEC for a zone whose parent zone is in Jarl: the DNSSEC tab gives the `jarl record add PARENT NAME DS ...` command to copy and an "Add to PARENT" button (staged like any change), links to the parent zone, and says when the parent has the DS record. `jarl zone dnssec status` prints the command too, and turning signing off gives the matching `jarl record delete`. - CLI output for scripts: `-o id` prints just the IDs of what a command shows or lists (`jarl zone show adbraun.lol -o id`), `-o field=view,soa.serial` just those fields, tab separated. `-q` on `show` and `list` prints the IDs too. With a change (`jarl record add ... -o id`) they apply to the changed object. - Statistics: client lists (busiest and refused clients, in the web UI, `jarl stats top clients|refused` and `jarl stats summary`) show the host name Jarl's records have for each address: the PTR record's target, or else the name of an A/AAAA record. Looked up in Jarl's own data, so no DNS queries; an address without a record shows as before. - Zones list: a padlock after each signed zone's name, linking to its DNSSEC tab (open and amber while signing is being turned off). ### Changed - The web UI and API can listen on ports below 1024, such as 443: `jarl.service` now gives jarld the `CAP_NET_BIND_SERVICE` capability (and only that). With a unit that doesn't, jarld's error says what's missing. See docs/configuration.md, "HTTPS on port 443". - Records table: names are no longer greyed out when they repeat the row above (it made those records look inactive). Records of the same name are separated by a faint line instead, and a full line marks where the next name starts. ### Fixed - `jarl record list`: one long value (a DKIM key) padded every row to its length, so on a terminal each row wrapped onto a second, blank-looking line. Long data is now shortened to fit the terminal; `--wide` shows it in full, as does output to a pipe or file. ## [0.2.0] - 2026-10-09 ### Added - DNSSEC signing per zone (docs/dnssec.md): `jarl zone dnssec enable|status|check-ds|disable|wipe` and the zone page's DNSSEC tab, or the zone's new `dnssec_policy` field in the API. named signs the zone with BIND's `default` policy (one ECDSA P-256 key that is never replaced) or a custom one, using inline signing, with keys in a per-view directory under `/var/lib/bind/jarl/dnssec-keys`. Jarl shows the keys and the DS record to give the registrar, says when it's safe to publish it, and checks the parent's DS records (`check-ds`, which also tells named with `rndc dnssec -checkds`). It refuses steps that would break a signed domain: switching straight to unsigned (it goes through BIND's `insecure` policy instead, and finishes only once named is done), deleting a signed zone or moving it to another view, and TTLs above the policy's `max-zone-ttl`. `wipe` starts over with a clean slate once the parent has no DS. Each step in the web UI opens a dialog that says what it needs first. `jarl zone delegation` now also compares the parent's DS records with the zone's keys. - Porkbun support (optional, docs/dnssec.md#porkbun): with an API key in the new `porkbun:` section of jarl.yaml (and nowhere else), `jarl zone registrar status|sync-glue|set-ns|publish-ds|remove-ds` and the zone page's Registrar tab show and change the domain's name servers, glue records (one per name server inside the domain, with all its IPv4 and IPv6 addresses) and DS records at Porkbun. Every change first checks that it won't take the domain offline (the name servers answer for the zone, glue matches, a DS goes out only once the domain is delegated to servers that serve the signed zone, DS records match the zone's keys before the name servers change); `--dry-run` shows the checks and `--force` skips them. Administrators only. - Backups include the DNSSEC keys (private keys too), stored inside the backup file, and `jarld restore` puts them back for named (`bind.named_user`, default `bind`). `jarl-backup.service` has `CAP_DAC_READ_SEARCH` to read them; `--without-keys` skips them. - Jarl raises a zone's serial above the one named has loaded whenever it writes a zone file whose serial isn't higher (after restoring an older database, say), so named loads it (it refuses otherwise for a signed zone) and secondaries pick it up. - Two-factor login to the web UI with an authenticator app (TOTP: SHA-1, 6 digits, 30 s, as every app supports). Users turn it on under Account (password, QR code, a code to confirm) and get 10 one-time recovery codes. Logging in then asks for a code (or a recovery code) after the password; each code works once. In a session with two-factor login, creating or rotating API tokens, changing users and resetting someone's two-factor login need a code from the last 5 minutes: the web UI asks for one, API clients send `X-Jarl-TOTP`. API tokens and the local socket are not affected. - `totp.require` in jarl.yaml (`none`, `admins`, `all`) makes two-factor login compulsory; such a user who hasn't set it up can only set it up after logging in. `totp.issuer` names the server in authenticator apps (default `Jarl `). - Resetting a user's two-factor login (lost phone): Users → Reset 2FA, `jarl user totp reset NAME`, or on the server `jarld user totp reset NAME` (also with jarld stopped). - The dashboard and `jarl status` list users who must use two-factor login but haven't set it up, and suggest disabling the first `admin` account when it is still active next to personal administrator accounts. `jarl user list`/`show` and the Users page show who uses it. - API: `POST /auth/login/totp`, `/me/totp` (`setup`, `enable`, `disable`, `recovery-codes`), `DELETE /users/{id}/totp`; database migration 4. - `scripts/testenv.sh`: turns a fresh Debian/Ubuntu machine into a test bed. It installs BIND and the build tools (Go from go.dev), writes a hand-made style configuration with internal and external views, a split-horizon zone (`example.com` or `JARL_TEST_ZONE`) and a reverse zone, starts named and prints the steps to install Jarl and adopt the configuration (docs/development.md). - View colours. Give a view a colour (Views → Edit, `jarl view color`, or `PUT /views/{id}/color`) and the zone list, the zone page and the views list show its name in that colour. The colours are muted, and pastel in dark mode. The default is the link colour. A colour isn't configuration, so setting one needs no changeset or deploy. - A "← Zones" link above a zone, back to the zone list, and "← History" above a changeset. The zone list keeps its filter, view and type in the address, so going back to it (with that link or the browser's back button) restores them. A view opened from a zone or the zone list has a "← example.com (external)" or "← Zones" link back. ### Changed - The version moved from the header to a footer: "Powered by Jarl v0.1.0", linking to the release on Gitea. A build that isn't of a release tag shows its commit instead, linked to the commit and marked `-modified` with uncommitted changes. Before, every build of a commit after a release still showed the release's version. `GET /status` and `/auth/whoami` report the build as `build` (docs/development.md). - `jarld version`, `jarl --version`, `jarl status` and `jarl whoami` give a version number only for release builds. Other builds say they are development builds and how far past the last tag they are: `dev ca0f148b78b6 (3 commits after v0.2.0-rc.1)`. Before, they printed the version and the commit (`0.2.0-rc.1 (ca0f148b78b6)`), which read like a release. - `make deb` gives development builds their own package version after the last tag (`0.2.0~rc.1+git3.gca0f148`, plus the build time with uncommitted changes). Installing one over the RC or an older build is an upgrade: no more `apt install --reinstall`. It also removes older packages from `dist/` (docs/development.md). - The view in the zone list, and on the zone page, links to that view, and the views page highlights it. It used to be plain text, and the zone page linked to the views page as a whole. - The zone's Name servers tab shows at once and follows the check as it happens. Each query is listed as a dig command line (`dig @192.0.2.1 example.org. SOA +norec`) with a "waiting 1.8 s" counter until it is answered. The finished result then replaces the progress, and the queries stay under "Queries sent". Results, the delegation check's included, are kept for 10 minutes, so returning to the tab shows them at once; "Check again" asks anew. A check keeps running if you leave the tab. Behind it, `GET /zones/{zone}/serials?stream=1` streams the queries as newline-delimited JSON (docs/api.md). - The delegation check streams its queries the same way, every one of them: finding the parent zone, its servers' addresses, the NS and DS queries to each parent server and the SOA from each delegated server. Each shows a short answer ("referral to katelyn.ns.cloudflare.com., …", "DS 2371", "NXDOMAIN"). The serials check now lists its address lookups as separate A and AAAA queries. `GET /zones/{zone}/delegation?stream=1` streams them. - Switching a zone's tabs (Records, Settings, …) no longer blanks the page while the tab loads: the page changes once the tab is ready, and "Loading…" appears only if a page takes a while. - `jarl zone serials` compares the serial named serves, which for a signed zone is the signed zone's (ahead of Jarl's). - `jarld import` turns `dnssec-policy` in an existing configuration into the zones' DNSSEC setting, and warns that their keys must be moved into Jarl's key directory before adopting. - `dnssec-policy` is no longer accepted as a zone, view or server option (zones have a DNSSEC setting instead), nor `key-directory` as a zone option. - Deleting a zone also removes the journal and signed files named kept next to it. - Release candidates (tags like `v0.2.0-rc.1`) publish their `.deb`s to a separate `testing` distribution of the package registry instead of `stable`. Servers that follow `stable` can't pick up an RC with `apt upgrade`. An RC may also take its release notes from the `## [0.2.0]` or `## [Unreleased]` section of the CHANGELOG instead of needing its own (docs/development.md, "Release candidates"). ### Fixed - Publishing a release candidate failed: `scripts/gitea-release.sh` rejected its `.deb`s, whose names carry the Debian version (`0.2.0~rc.1`) instead of `0.2.0-rc.1`. - `jarld init -u` and the install guide recommend naming the first administrator after yourself (one account per person). - `jarld import` no longer warns that a zone with `allow-update { none; }` uses dynamic updates (validation already allowed it). - docs/cli.md gives the CLI configuration file's location on macOS (`~/Library/Application Support/jarl/config.yaml`) and Windows (`%AppData%\jarl\config.yaml`). It was documented only as `~/.config/jarl/config.yaml`. ## [0.1.0] - 2026-10-09 The first version. ### Added - Daily database backups: the `jarl-backup.timer` systemd timer (turned on by the Debian package) runs `jarld backup`, which writes `jarl-.db` into `backup.dir` (`/var/backups/jarl`), checks it with SQLite's integrity check before giving it that name, and deletes backups older than `backup.retention` (30d) while always keeping the newest `backup.keep_at_least` (7). Ages come from the names, and only files named like backups are ever deleted. Settings are in the new `backup:` section of jarl.yaml; the schedule is the timer's. The dashboard and `jarl status` show the newest backup, and warn when it is older than `backup.warn_after` (2d) or the last attempt failed. `backup.stats` also backs up the statistics database. - `jarld restore [FILE | latest]`: lists backups, or checks one, shows what it holds next to the current database, and after confirmation replaces the database with it, keeping the current one as `jarl.db.before-restore-