The DNSSEC tab and 'jarl zone dnssec status' give the jarl record add command (and an Add to parent button) when the parent zone is in Jarl. jarl.service grants CAP_NET_BIND_SERVICE so the web UI can listen on 443. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>