Four Poweradmin releases
4.4.0 adapts the UI to your PowerDNS server, plus fixes in 4.2.5, 4.3.4 and 3.9.11
Four releases are out today: 4.2.5, 4.3.4, 4.4.0 and 3.9.11 for the old LTS line. The first two are patch releases sharing the same fixes. 4.4.0 is new and brings the features I have been building on master for the last couple of months.
Sorry these took longer than usual - it’s summer, and I kept delaying to add a few more fixes that make the system safer and more stable. I think the wait was worth it.
📌 Branch status
I’m slowly moving away from 4.2.x. 4.3.x is now the stable line - it has had three patch releases and I would use it for new installs and upgrades. 4.2.x still gets the same fixes for now, but 4.2.5 may be its last release unless something forces another.
4.4.0 is fresh. It had a longer review than usual, but it’s big and may still have small problems. If you find one, please report it - that is the fastest way to get 4.4.x to where 4.3.x is now.
Whatever line you run, please keep your installation up to date. Several fixes in this batch are security-related (the 🔒 items, with advisories to follow), so if you are a few versions behind, please upgrade soon. An older release runs with known problems that are already fixed here.
🔧 4.2.5 and 4.3.4
Patch releases for the 4.2.x and 4.3.x lines. Both carry the same changes; 4.3.4 adds a few extra 4.3-specific fixes.
Changes since v4.2.4 / v4.3.3:
🔒 User management tightening - changing another user’s password now requires the right permission in both web and API, delegated admins can no longer modify superuser accounts, and template assignment through the API is properly authorized.
🔒 OIDC/SAML account matching - subject identifiers are compared byte-for-byte when linking accounts (MySQL migration included), and the session ID is regenerated after SSO login.
🐛 OIDC logout - uses the standard
post_logout_redirect_uriparameter #1367 and sendsid_token_hintfor providers that require it #1382.🐛 Large zone saves - forms that exceed PHP’s
max_input_varsno longer silently drop records; affected rows are skipped with a warning and the SOA serial stays untouched when nothing was saved #1334.🐛 Record and template binding - record edits, their log entries, and zone template records are all bound to the zone or template they actually belong to.
🐛 Duplicate emails - creating a user with an email another account already uses is rejected; existing accounts that share an address stay editable as long as the email isn’t changed.
🐛 Reverse zones - entering a network like
192.168.1.0/24on the reverse tab now creates the properin-addr.arpazone instead of a literal forward zone #1323.🐛 Group-owned zones (4.2.5 only) without direct owner rows show up in the zone list for group members #1329; the 4.3.x line already behaved correctly.
🐛 Permission templates - renaming a template no longer wipes its permissions.
🐛 4.3.4 only: record searches work on MariaDB 11.6+ #1350, the API-backend mode no longer logs null-record warnings #1326, and non-admin users get a simpler flat dashboard.
✨ Small addition on both lines: a per-zone logs button on the zone edit page #1331.
Both releases need one small MySQL migration (poweradmin-mysql-update-to-4.2.5.sql / -4.3.4.sql); PostgreSQL and SQLite need nothing. If you run a custom theme with a forked edit.html, re-sync it - zone saves now depend on new hidden marker fields.
PHP 8.2+ required, unchanged.
🗄️ 3.9.11
A small maintenance release for those still on the 3.x LTS line. It picks up the same record-binding fixes as the 4.x patches: record edits and their log entries are bound to the zone the record actually belongs to, deleting a non-existent record ID is rejected, and creating a user with an email another account already uses is rejected. Drop-in replacement for 3.9.10, no migration needed.
✨ 4.4.0
The headline feature: Poweradmin now knows which PowerDNS version it is connected to.
Until now, Poweradmin showed the same interface no matter which PowerDNS ran behind it. You could pick a record type your server does not support, set a metadata kind it ignores, or look for a feature it does not have - and the only feedback was a server error, or worse, silence. PowerDNS changed a lot between 4.2 and 5.0, but the interface acted as if nothing had.
4.4.0 fixes that. When the PowerDNS API is configured, Poweradmin asks the server what it is and adjusts itself:
The dashboard shows the connected PowerDNS version.
Record types the server doesn’t support disappear from the selectors, and metadata kinds it doesn’t know get a “Requires X.Y+” hint instead of failing.
Terminology follows the server: zone kinds are labeled Primary/Secondary on 4.5+, Producer/Consumer kinds show up on 4.7+, and Supermasters becomes Autoprimaries on 4.6+.
On PowerDNS 4.9+ the record list can show last-modified timestamps, and on 5.0 you can manage views and network mappings straight from the UI.
If the version can’t be detected (API down, or not configured), nothing is hidden - you get the same full interface as before. Classic direct-database installs are not affected by any of this.
Zone ownership modes
Poweradmin has always had two ownership models - zones owned by users directly, and zones owned through groups - and every installation had both, even if it only needed one. The new dns.zone_ownership_mode setting lets you pick: users_only, groups_only, or both. The default is both, the old behavior, so nothing changes unless you choose otherwise; when you restrict the mode, the UI and APIs follow it. And no matter which mode you use, the APIs now refuse to remove a zone’s last owner, so zones can no longer be left without one.
Other new settings
Most of the smaller features come with a setting, all off or neutral by default. Each one is documented in full in the configuration docs:
✨ Default zone template #973 - superusers can mark a template as the default for the add-zone forms, either from the template list or via
dns.default_zone_templatein config (the UI setting takes priority when both are set); unset keeps the old “none” behavior.✨ Pinned record types #984 -
dns.top_record_typeslists the types you use most (say['A', 'AAAA', 'CNAME', 'TXT']) and keeps them at the top of every record type selector instead of alphabetical order.✨ Reverse zone TTL #1032 -
dns.ttl_reversesets a separate default TTL for PTR records created through the reverse-record helpers; unset falls back to the normaldns.ttl.✨ Zone owner in the PowerDNS account field - with
dns.sync_zone_owner_to_accountenabled, Poweradmin writes the zone’s oldest owner into PowerDNS’saccountfield, useful when other tooling reads it. Off by default.✨ Custom branding -
interface.favicon_pathandinterface.logo_pathpoint to your own files; empty keeps the bundled ones.✨ PowerDNS API timeout -
pdns_api.timeout(seconds, default 10) for slow or distant API endpoints.✨ OIDC/SAML group mapping #1148 - a mapping value can now be a list, so one IdP group can add a user to several Poweradmin groups. Existing single-group string mappings keep working as before.
And the rest
✨ Group-ownership sorting in the zone list #1051 and zone health markers - disabled zones and zones with a missing SOA are marked directly in the list #805.
✨ Manual PowerDNS sync - in API-backend mode, a button on the Forward Zones page refreshes the zone list from PowerDNS on demand (reporting zones added, updated, and removed).
✨ Zone owners can see audit logs for their own zones #1136 - previously admin-only; owners see only their zones’ entries.
✨ DNSSEC - PEM key import/export on PowerDNS 4.7+, copy-to-clipboard for DS/DNSKEY records #1177.
✨ Records - matching-only mode for IPv6 batch PTR creation, and IP-aware search: paste a bare IP into search and it looks through record content and anchors reverse lookups to the right PTR zone #1306.
✨ Per-user preferences - hostname-only display of record names #1181 and a timezone for MFA emails #718 moved from global config to per-user settings; the old config values act as the default until a user picks their own.
✨ Languages - 8 new interface languages (Croatian, Estonian, Finnish, Hungarian, Latvian, Romanian, Serbian, Slovak); all 28 locales are fully translated.
🐛 Plus everything from 4.2.5/4.3.4, more accurate API error status codes, standard dyndns2 response tokens for DDNS, and a password reset that no longer guesses which account to use when several share the same email address.
Upgrading to 4.4.0
Back up your database first. Then the usual routine: replace the files (keep your config/settings.php) and run the migration script for your database type - this release needs it on all three backends, and the zone template pages will fail without it:
sql/poweradmin-mysql-update-to-4.4.0.sqlsql/poweradmin-pgsql-update-to-4.4.0.sqlsql/poweradmin-sqlite-update-to-4.4.0.sql
Coming from 4.2.x, run the 4.3.0 migration first, then this one - don’t skip versions.
Things that changed behavior and are worth checking before you upgrade:
Set
interface.application_urlto your public base URL if you use password reset, SSO, or email notifications. Reset emails are not sent without it (a dashboard notice will remind you), and OIDC/SAML URLs and links in notification emails are built from it (falling back to the server name) instead of the request’s Host header.Custom themes that fork
edit.htmlmust re-sync it - zone saves now depend on new hidden marker fields, and an outdated fork will save no records.API clients that branch on status codes should review the changes (404/409/500 where a blanket 400 used to be), and omitting
permissionson a template PUT now leaves permissions untouched instead of clearing them.DDNS clients that string-match responses: unchanged updates now return
nochgand auth failures returnbadauth, per the dyndns2 convention.
PHP 8.2+ required (unchanged), tested on 8.2 through 8.5. PowerDNS 4.x through 5.x supported; the new capability features need the PowerDNS HTTP API configured.
Full step-by-step guide: https://docs.poweradmin.org/upgrading/v4.4.0/
🔮 What’s next
I have already started work on 4.5.0 on the develop branch. So far it focuses on DNSSEC and serial handling: managing SOA-EDIT/SOA-EDIT-API serial policies from the UI, showing the signed serial when it is different from the stored one, serial placeholders like [UNIXTIME] for templates, presigned zone support, and dedicated DS/DNSKEY record editors. After that, I plan to add more detailed permissions (delegated log viewing, separate view-only rights for zone metadata), per-request API logging, trusted proxy support for setups behind a CDN or load balancer, and LDAP user-info sync. I will share more when it is closer.
🐳 Docker tags
4.2.5,4.3.4,4.4.0- exact versions, plus the usual4.2/4.3/4.4line tags.:stable- now points to the 4.3.x line (4.3.4 with this release). If you want to stay on 4.2.x for a while longer, pin the4.2tag instead.:latest- follows the master branch, not release tags.
🙏 Thanks
Thanks to everyone who reported bugs and suggested features that went into these releases:
Fixes in 4.2.5 / 4.3.4: Protogen187 (#1323), MiKuBB (#1329, #1331), lovilak (#1326, #1327, #1332), ramondelee (#1334), droszler (#1350), wastez (#1367), gjherbiet (#1382).
Features in 4.4.0: akops76 (#805), wxtewx (#973), snimshchikov (#984), bnchdan (#1032), dginhoux (#1110), kuhball (#1148), michielvisser (#1181).
A special thank you to the researchers who responsibly reported the issues behind the 🔒 items above: SaifSalah (user management and record authorization) and whale120 (@whale120_tw) of the DEVCORE Internship Program (OIDC/SAML account matching). The corresponding advisories will be published on the project’s security advisories page shortly after the releases.
If you run into problems - especially on 4.4.0, which is still fresh - please open an issue at https://github.com/poweradmin/poweradmin/issues. Bug reports are the best way to make 4.4.x stable quickly.
Full changelogs: