What's New in 4.2.0¶

Released 19 March 2026.

4.2.0 answers a question that gets asked as soon as more than a handful of people share an installation: how do you manage access by team rather than by individual? User groups, group permission templates and group-based zone ownership are the answer. Alongside that, the module system made several features optional, and BIND zone files became importable.

Note: The generated release notes for 4.2.0 on GitHub are cumulative rather than incremental, because 4.1.0 and 4.2.0 were developed on parallel branches. Several features listed there - SAML, OIDC, avatars, forgot username, database SSL, the zone deletion permission split and DNS wizards - actually shipped in 4.1.0, and WHOIS and RDAP go back to 4.0.0. This page lists only what 4.2.0 genuinely added.

Highlights¶

User groups¶

Groups are first-class. A group has its own permission template, its own members, and its own set of zones. Members inherit the group's permissions on top of whatever they hold individually.

Five group permission templates ship out of the box: Administrators, Zone Managers, Editors, Viewers and Guests. The existing user templates were renamed at the same time, so DNS Editor became Editor, Read Only became Viewer, and No Access became Guest.

See User Groups.

Group-based zone ownership¶

A zone can be owned by a group instead of, or in addition to, individual users. The owner column became nullable, so a zone can belong purely to a group and stay accessible when the person who created it leaves.

A dedicated ownership page manages both kinds of owner for a zone.

See Zone Management and User Groups.

The module system¶

WHOIS, RDAP, DNS wizards, CSV export, email previews and zone import/export became modules. Each can be enabled or disabled independently, and each can be restricted to administrators, through a modules block in the configuration or through PA_MODULE_* environment variables in Docker.

This is how you strip the interface down to what your users actually need.

See Basic Configuration.

BIND zone file import and export¶

Upload a zone file to create a zone, or merge it into an existing zone with a conflict strategy that decides what happens when a record already exists. Zones can be exported back out as BIND files.

See Zone Import/Export.

MFA enforcement¶

Multi-factor authentication stopped being purely opt-in. The user_enforce_mfa permission and the security.mfa.enforced setting let you require it for particular users or for whole groups, and the user list gained an MFA status column so you can see who has enrolled.

See Multi-Factor Authentication.

API v2 expansion¶

Three new endpoint families: zone owners (including batch assignment through a user_ids array), zone templates with full CRUD over their records, and groups with their members and zones.

See Endpoints.

Also in this release¶

Feature	What it does	Where
Per-record comments	Comments attach to a single record rather than the whole RRset	Zone Management
Group activity log	An audit page for group creation, membership and zone changes	Database Logging
User list improvements	Pagination, group membership and MFA columns, username shown alongside full name	Users and Roles
Collapsible sidebar	Sidebar sections can be collapsed in the modern theme	Themes
Deprecated record type warnings	The record type selector flags types that are no longer recommended	Record Type Customization
Two-column zone creation	The add-zone forms were reorganised	Zone Management
IPv6 display shortening	Long IPv6 addresses and reverse zone names are abbreviated in listings	Reverse DNS
Custom CA certificates	`TRUSTED_CA_FILE` mounts a CA bundle into the container	Docker Installation
Five new locales	Indonesian, Korean, Swedish, Ukrainian and Vietnamese	Basic Configuration

Patch releases¶

Release	Added
v4.2.1	IDN and punycode conversion for record names and content; IPv6 batch PTR with correct nibble expansion; database logging of user creation, deletion and SSO logins; rootless containers
v4.2.2	`TRUSTED_PROXIES` for real client IPs behind a proxy; the API Keys menu shown to holders of `api_manage_keys`; a `.za` WHOIS server
v4.2.3	Forwarded-IP headers trusted only from private and loopback peers
v4.2.4	OIDC and SAML URLs preferred from `interface.application_url` over the request host; SOA, NS and apex records pinned to the top of the record list; CSV export quotes values that spreadsheets would treat as formulas
v4.2.5	A per-zone Logs button on the zone editor; large forms handled correctly when they exceed PHP's `max_input_vars`
v4.2.6	`interface.application_url` now required for OIDC, SAML and password reset, with the `SERVER_NAME` fallback removed; the container refuses to start when SSO is enabled without a URL source; API user creation defaults to the least-privileged template instead of administrator; deactivating a user revokes their API keys; second-factor lockout after repeated wrong codes; zone template records validated against their record type; installer honours `X-Forwarded-For` only from listed proxies; five confirmation flows moved to POST with CSRF; CAA `;` label corrected; sendmail transport uses `-t -i`

Warning: v4.2.5 changed the zone edit form. If you maintain a forked theme, re-sync your edit.html against the shipped version. The new hidden _complete and form_complete fields let the server detect a form truncated by PHP's max_input_vars; without them a truncated save is not reported and the missing rows are silently dropped.

Warning: v4.2.6 changed more templates. Five confirmation pages became POST forms with a CSRF token - delete_perm_templ.html, delete_zone_templ.html, delete_zone_templ_record.html, delete_supermaster.html and dnssec_edit_key.html. A fork still using the old ?confirm=1 link renders the confirmation page again instead of performing the action, with no error shown. index.html also gained a dashboard warning block. Re-sync forks of those files.