Fixed a bug that would default to overwrite a valid ptr record when adding or editing an A or AAAA record

Bugfix release

SOA Signing Key Display DS chain validation now shows which DNSKEY signs each zone's SOA record, including the key tag, algorithm, and signature validity window. If the signing key is a ZSK, the KSK(s) that signed the DNSKEY RRset are also displayed — giving you a complete view of the trust path from DS through KSK to ZSK to signed records. Early KSK Rollover Detection A new "New KSK Published" indicator appears when a KSK is present in the DNSKEY set but has no matching DS record in the parent zone. This catches the earliest phase of a key rollover — before the CDS record is updated — so you can track the full rollover lifecycle from start to finish. Record TTLs in Chain Validation DS, CDS, DNSKEY, and CDNSKEY records in the chain validation view and export report now display their TTL values. This helps identify TTL mismatches across nameservers and verify that caching behaviour is consistent throughout the delegation chain. Improved Record Sorting Metadata records like _443._tcp.host, _dmarc.host, and _domainkey.host are now sorted next to their parent host record instead of being grouped at the top of the zone. This makes it much easier to see all records related to a particular host at a glance.

Concurrent Update Protection (BIND9) - RFC 2136 updates now include prerequisite checks to guard against race conditions - If a record was changed by DHCPD, an ACME client, or another DNS editor since you loaded the zone, the update is rejected instead of silently overwriting - The server evaluates prerequisites atomically while holding the zone lock — no partial changes are applied - Clear error messages tell you exactly what happened and to reload the zone Expandable Bulk Undo Entries - Bulk delete entries in undo history can now be expanded inline with a disclosure chevron - See all individual records without opening a separate sheet - Record count shown alongside the timestamp for quick reference Improved Error Messages - Prerequisite failure errors now show user-friendly messages instead of cryptic RFC codes - "Record was modified or deleted by another client — reload the zone and try again"

Selectable Text in Zone View - Record rows now support text selection for easy copy and paste - Select and copy record names, values, and other details directly from the zone view ## Version 2.3.2 Concurrent Scanning - SSHFP and TLSA zone scanners now run multiple scans simultaneously - Configurable concurrency limit (1–50, default 10) in Settings - Real-time in-flight scan counter shown during scanning - Up to 3x faster scanning for large zones Adaptive Network Timeouts - Automatically detects cellular connections on iOS - Doubles verification timeouts on cellular to reduce false failures - WiFi connections use standard timeouts for fast results DNS Failure Detection - Scanners detect and warn when the DNS resolver is unreachable - Prevents misleading results caused by network issues ## Version 2.3.1 Bug Fixes - Fix stale reverse/forward lookup cache showing incorrect red results after zone switching - Fix zone switching regression after cleanup operations - Fix Zone Cleanup export report sometimes appearing empty - Fix "PTR record not found" errors during cleanup scanning - Fix "Failed to update PTR record" when applying fixes - Fix "No reverse zone found" for IPv6 addresses - Fix NOTZONE errors from BIND9 during PTR operations - Surface actual provider error messages in fix failure alerts

Zone Cleanup Tool - New Zone Cleanup view scans any zone for dangling PTR records - Detects reverse records pointing to hostnames without matching forward A or AAAA records - Results grouped by issue type with full record details - Access from zone detail view toolbar on macOS or action menu on iOS/iPadOS Bulk PTR Deletion - Delete all dangling PTR records with one tap - Optimized batch operations — single zone reload per reverse zone instead of per-record - Works across multiple reverse zones simultaneously (IPv4 and IPv6) - Significantly faster for large-scale cleanup operations Multi-Zone Undo Support - Bulk delete operations create a single consolidated undo entry - Restoring undo intelligently groups records by zone for proper multi-zone operations - IPv6 reverse zones (ip6.arpa) are correctly matched for restoration - View all records in bulk undo entries via context menu Bulk Record Viewer - Right-click any bulk undo entry to view all included records - Shows full details: record name, type, value, and TTL - Helpful for reviewing what was deleted before restoring Performance Improvements - Zone reloads reduced by ~90% during bulk delete operations - Faster scanning of zones with many reverse records - More responsive UI during large cleanup operations Exportable Cleanup Reports - Export Zone Cleanup results as plain-text reports - Share findings with team members or keep for documentation - Includes all detected issues with full record details ## Version 2.2.0 DS Update Scanner (BIND9) - Scan all zones in a BIND9 provider to detect KSK rollovers needing DS updates - Compares parent DS records with child CDS records across your entire infrastructure - Pre-scan configuration with per-zone toggles and TLD quick-exclude buttons - Auto-CDS TLDs (e.g. .cz, .se, .ch) are excluded by default — these registries handle CDS updates automatically - Reverse zones (in-addr.arpa, ip6.arpa) can be excluded with one tap - Exclusion preferences are saved per provider Direct DS Updates - When a zone's parent is also in your BIND9 provider, apply the DS update directly - Safe two-phase update: new DS is added first, then old DS is removed - Chain of trust is never broken, even if interrupted mid-update - Zones under public TLDs show the new DS data for manual registrar update DNSKEY Keytag Display - DNSKEY and CDNSKEY records now show the computed keytag in parentheses - Calculated from the key data using the RFC 4034 Appendix B algorithm - Makes it easy to identify keys without cross-referencing DS records Shareable DS Update Report - Export scan results as a plain-text report - Includes current DS, new CDS, and parent zone information for each zone - Zones updated directly are marked with [UPDATED] - Internationalized domain names are displayed decoded in reports

Reverse/Forward DNS Verification - A and AAAA records now show their PTR lookup result with a color-coded badge - PTR records show the forward lookup result for the hostname they point to - Green indicates a confirmed bidirectional match, red a mismatch, orange no record found - Private networks (RFC 1918) are resolved against your provider's nameserver directly One-Tap Fix for Missing Records - When a PTR or forward record is missing, a fix button appears next to the badge - Creates the missing record in the correct managed zone with one tap - Only shown for zones managed by a configured RFC 2136 provider Paired Record Deletion - Deleting an A, AAAA, or PTR record with a confirmed green match offers to delete the paired record - Only offered when both directions confirm — the PTR points to the hostname and the hostname resolves back to the same IP - Both records are removed in a single operation across zones Toggle in Settings - Reverse/forward verification can be disabled in Settings → Display - When disabled, no lookups are performed and fix buttons are hidden ## Version 2.2.0 DS Update Scanner (BIND9) - Scan all zones in a BIND9 provider to detect KSK rollovers needing DS updates - Compares parent DS records with child CDS records across your entire infrastructure - Pre-scan configuration with per-zone toggles and TLD quick-exclude buttons - Auto-CDS TLDs (e.g. .cz, .se, .ch) are excluded by default — these registries handle CDS updates automatically - Reverse zones (in-addr.arpa, ip6.arpa) can be excluded with one tap - Exclusion preferences are saved per provider Direct DS Updates - When a zone's parent is also in your BIND9 provider, apply the DS update directly - Safe two-phase update: new DS is added first, then old DS is removed - Chain of trust is never broken, even if interrupted mid-update - Zones under public TLDs show the new DS data for manual registrar update DNSKEY Keytag Display - DNSKEY and CDNSKEY records now show the computed keytag in parentheses - Calculated from the key data using the RFC 4034 Appendix B algorithm - Makes it easy to identify keys without cross-referencing DS records Shareable DS Update Report - Export scan results as a plain-text report - Includes current DS, new CDS, and parent zone information for each zone - Zones updated directly are marked with [UPDATED] - Internationalized domain names are displayed decoded in reports

DS Update Scanner (BIND9) - Scan all zones in a BIND9 provider to detect KSK rollovers needing DS updates - Compares parent DS records with child CDS records across your entire infrastructure - Pre-scan configuration with per-zone toggles and TLD quick-exclude buttons - Auto-CDS TLDs (e.g. .cz, .se, .ch) are excluded by default — these registries handle CDS updates automatically - Reverse zones (in-addr.arpa, ip6.arpa) can be excluded with one tap - Exclusion preferences are saved per provider Direct DS Updates - When a zone's parent is also in your BIND9 provider, apply the DS update directly - Safe two-phase update: new DS is added first, then old DS is removed - Chain of trust is never broken, even if interrupted mid-update - Zones under public TLDs show the new DS data for manual registrar update DNSKEY Keytag Display - DNSKEY and CDNSKEY records now show the computed keytag in parentheses - Calculated from the key data using the RFC 4034 Appendix B algorithm - Makes it easy to identify keys without cross-referencing DS records Shareable DS Update Report - Export scan results as a plain-text report - Includes current DS, new CDS, and parent zone information for each zone - Zones updated directly are marked with [UPDATED] - Internationalized domain names are displayed decoded in reports

Automatic Reverse DNS - When creating or editing A/AAAA records, matching reverse zones are detected automatically - Inline toggles let you select which PTR records to create alongside the forward record - Sibling A and AAAA records for the same hostname are cross-matched - Existing PTR records are checked: green if already correct, orange if pointing elsewhere IP Conflict Detection - Addresses with an existing PTR that has a matching forward record are flagged as in use - Red warning and disabled toggle prevent overwriting active reverse mappings - Catches accidental IP reuse and mistyped addresses PTR Editor IP Input - Enter a normal IPv4 or IPv6 address when editing PTR records in reverse zones - The reversed record name is generated automatically - Editing an existing PTR shows the derived IP address Reverse Zone Display - PTR records now show the unreversed IP address in parentheses next to the hostname - IPv6 addresses displayed in compressed notation STARTTLS Support for TLSA - TLSA record verification and generation now supports STARTTLS for email protocols - Fetch certificates from SMTP (ports 25, 587), IMAP (143), and POP3 (110) servers - Direct TLS ports (443, 465, 993, 995) continue to work as before TLSA Scanner Port Selection - Scan all hosts in a zone for any common TLSA port from a toolbar picker - Supported ports: 443 (HTTPS), 25 (SMTP), 587 (Submission), 465 (SMTPS), 143 (IMAP), 993 (IMAPS), 110 (POP3), 995 (POP3S) - TLSA record names are generated with the correct port prefix (e.g. _25._tcp for SMTP)

Zone Sanity Check Verify that all your public nameservers are serving identical records. The sanity check queries each authoritative nameserver directly (non-recursive) and compares: • NS delegation consistency between parent and zone • SOA serial numbers across all nameservers • Every record in the zone, grouped by name and type Differences are colour-coded and grouped by record with affected nameservers listed. Export results as a plain-text report using the share button. Also new: • TCP fallback when UDP responses are truncated • Full support for Cloudflare, Route 53, and Google Cloud DNS hosted zones • Improved toolbar labels for macOS and iOS overflow menus

Removed DNS record from provider types that do not support them (Like google and amazon do not support LOC records). Also when creating, editing or viewing a LOC record the map view will show the location on a map. There is also a fuzz button that allows the user to make the gps location less accurate to make the location less accurate for privacy reasons. Pressing the fuzz button multiple times will add more fuzziness with each press.