Five releases today: 4.5.0, 4.4.2, 4.3.6, 4.2.7 and 3.9.13. The patch releases fix three reported security issues, so please update even if you skip 4.5.0.
📌 Which version to run
4.4.x stays the line I recommend for production. Use 4.4.2.
4.5.0 is the new feature release. It’s well tested but big, so try it on a separate instance first. Its fixes go to the new
release/4.5.xbranch.4.3.x and 4.2.x get fixes until 2027-01-31. Plan your move to 4.4.x.
3.x is supported until December 2027.
masteris unstable from now on. It carries the 4.6.0 work, so don’t run it in production.
🔒 Security fixes (4.4.2, 4.3.6, 4.2.7)
MFA bypass - the second factor could be checked against the wrong account during login. Fixed, and every login now starts from a clean session.
Password reset - on some database collations a reset could match another account’s email. Emails are now matched exactly and the mail goes to the address on file.
Mail headers - sendmail delivery now refuses line breaks in the recipient, subject and headers.
Access checks - new users can’t get a permission template with more rights than their creator, and record comments are no longer copied into zones the user can’t edit. The patch releases also refuse a zone inside another user’s zone.
Details are on the advisories page.
The patch releases also carry the usual bug fixes: MFA no longer asks for a code again right after setup, zone search no longer repeats zones across pages, IPv6 supermasters work on the status page, DB_PORT is passed through in Docker, and more. 3.9.13 has small auth, DDNS, permission and record validation fixes.
✨ 4.5.0
This one is about knowing what happened and controlling who can do what.
Record change log - every record and zone change is stored with a before and after snapshot, and bulk edits are grouped with an optional reason.
Granular API keys - keys can be read-only, limited to some operations, or scoped to specific zones.
Serial policy - manage
SOA-EDITandSOA-EDIT-APIper zone, and use[UNIXTIME],[COUNTER]and[SERIAL]in zone templates.Eleven new permissions - things that used to need superuser can now be delegated.
Secondary zone import over AXFR, LDAP sync and provisioning, and default TTLs per record type.
IDN zones get one IDN entry in the letter filter, and lists and search show the punycode name next to the Unicode one.
Health and ping endpoints for load balancers and monitoring, off by default, with an optional token and result cache.
API v1 is gone. It answers 410 now. If you still have scripts on v1, move them to v2 before upgrading, or stay on 4.4.x, which keeps v1.
Upgrading: back up your database, run the 4.5.0 migration for your database type, and read the upgrade notes.
If you run PowerDNS 5.1.x in API backend mode, read the known issue in the README about backslash escaping (PowerDNS issue 18159). It’s fixed upstream but not released yet.
🔮 What’s next
4.6.0 work moves to master, and the separate develop branch goes away. Coordinating two development branches turned out to be too complicated.
🐳 Docker tags
4.5.0,4.4.2,4.3.6,4.2.7- exact versions4.5,4.4,4.3,4.2- follow a linestable- moves from 4.3.x to 4.4.x (4.4.2), the line recommended for productionlatest- the newest 4.5.x release4.5.x- the latest build of therelease/4.5.xbranchdev-master, 4.6.0 development, not for productionlts- the 3.x line
On 4.5.0 and 4.4.2 the container waits for the database before it sets up the schema (DB_WAIT_TIMEOUT, 30 seconds by default), so it no longer exits when the database starts slowly.
🙏 Thanks
Bugs and ideas for these releases came from bessone, gjherbiet, pomland-94, lovilak, nf-brentsaner, NTS15576, ynnsn1, 2K-ZONE, hlarc, MrClock8163, glomazdov, iram-computer, lukasdebaum, alsyundawy, bbabich, bnchdan, Ekkisleif, frenkye, iamnumlock, NocDerEchte, pgo-nu, righter83, Deeefje, JonasGroeger, michielvisser and Verestchagin.
Security reports: thanks to ba-am, Buggs777 and xhydraxOffSec for reporting the issues above privately and giving me time to fix them.
And thank you to the companies and people who sponsor development. It really helps.
🛠 Stuck on an old version?
If you still run 2.1.x, 3.x or a 4.x release older than 4.2, the upgrade guides go through each step. Jumping several versions at once can be tricky, so if you’d rather have help, I can do the upgrade with you or for you as paid work, with an invoice for companies. Get in touch privately. Please don’t post your configs or logs in public threads.
💙 Support
Poweradmin is a side project I maintain mostly alone. If it saves you time, please consider chipping in:
Need a feature your team depends on? It can be sponsored, and then it gets built sooner. Just get in touch. Companies can get a proper invoice: through Open Collective from anywhere, or directly from me if you’re in the EU.