PowerDNS AdminAuthoritative DNS, one command away

PowerDNS Authoritative, PostgreSQL and a Tabler-themed admin panel — wired together in a single compose file, with local, LDAP, OAuth 2.0 and SAML sign-in.

Set it up

Read the guide

See the panel

📦

Four services, one file

A PostgreSQL 18 database, PowerDNS Authoritative 4.9, PowerDNS Recursor and the Flask panel. Health-gated start-up order, secrets as files, no manual schema loading.

Quick start

🔌

The panel never touches the DNS tables

Every zone and record change goes through the PowerDNS HTTP API, so serial bumping, DNSSEC signing and record validation stay where they belong.

How it fits together

🔑

Sign in the way you already do

Local accounts, LDAP / Active Directory, OAuth 2.0 and OpenID Connect, and SAML 2.0 — added in the panel at runtime or declared in .env, with group-to-role mapping for each.

Add a provider

🛡️

Separated by schema and by role

No application role is a superuser, and neither can read the other's tables — CI asserts it. The PowerDNS API port is never published to the host.

The security model

🧭

Forwarding, from the same panel

Global forwarders and per-zone forward rules on a bundled PowerDNS Recursor. Your own zones stay answerable automatically, and the resolver is not open to the internet by default.

Set up forwarding

🔁

Reverse DNS that keeps itself honest

Create a zone together with the in-addr.arpa/ip6.arpa zones for its networks, link them on the zone settings page, and give an A or AAAA record a PTR that follows it — repointed, renamed, disabled or deleted, the reverse side keeps up.

Linking a PTR

⚙️

The zone itself, not just its records

Nameservers, the administrator's address and the SOA timers on one settings page, stored as the records DNS expects — with the serial left to PowerDNS, where it belongs.

Zone settings

🔏

DNSSEC without the ceremony

Enable signing on a zone and a combined signing key is created for you. The DS records to hand your registrar are shown ready to copy.

Signing a zone

📋

Every change is on the record

An append-only audit log records who changed what, from which address — and entries survive the deletion of the user who made them.

What gets logged

Try it in two minutes

bash

git clone https://github.com/timothestoifl24/powerdns.git
cd powerdns
./scripts/generate-secrets.sh
docker compose up -d --build

Open http://localhost:9191, sign in as admin with the password the script printed, and check that DNS is actually answering:

bash

dig @127.0.0.1 example.com SOA

That is the whole install. The setup page covers what the script created, how to move the panel behind a reverse proxy, and what to do when something already owns port 53.

What this is, and what it is not

This is a small, self-contained authoritative DNS stack for people who would rather run their own nameservers than click through a registrar's control panel — a homelab, an internal network, a handful of public zones.

It is not a recursive resolver: it answers only for the zones you create, and it will not resolve the rest of the internet for your clients. It is also not a fork of the PowerDNS project's own admin tool; the panel here is a purpose-built Flask application that speaks the same public HTTP API.

New here? Start with the guide for the concepts, then setup to get it running.

PowerDNS AdminAuthoritative DNS, one command away

Four services, one file

The panel never touches the DNS tables

Sign in the way you already do

Separated by schema and by role

Forwarding, from the same panel

Reverse DNS that keeps itself honest

The zone itself, not just its records

DNSSEC without the ceremony

Every change is on the record

Try it in two minutes ​

What this is, and what it is not ​

Try it in two minutes

What this is, and what it is not