Ghost
released this
2026-09-13 03:16:16 +00:00
| 187 commits to master since this release
Added in 1.6.0-beta
- Per-zone DNSSEC chain checks, off by default. Turn on DNSSEC Chain Checks in Settings, Advanced, and a padlock appears beside every zone, on the DNSSEC page and on the DNS page's zone list. It answers the one question deSEC cannot: does the parent publish a DS whose digest matches a DNSKEY the zone really serves, anchored the whole way to the root? A stale DS after a key rollover leaves a zone perfectly signed at deSEC and unresolvable everywhere else. Hovering the padlock explains the verdict and says how old it is
- Three lookup methods, chosen in Settings and never switched automatically: the direct walk of root, TLD and authoritative servers (the default, which needs outbound port 53), this machine's own resolver, or DNS-over-HTTPS through Cloudflare, Google or OpenDNS. The setting takes effect immediately
- Verify all, or Verify (N) for just the domains picked out of the list, the same way the DNS page's Delete button already works
- A DNS-access preflight before each batch, and a breaker. A network that answers nothing is reported once, instead of timing out zone by zone; a run that collapses after it starts stops itself after eight consecutive transport failures and says so
- Results cached per profile in
cache/dnssec_status.json, with a recheck policy: broken, undelegated and error zones after 6 hours, secure and unsigned after 7 days, dropping to 6 hours when the last check failed so a stale padlock is never left for a week. Creating or completing a subdomain delegation in the wizard marks that zone due immediately
- Every check narrated in the log console, so a slow or failing lookup can be seen rather than guessed at
- A parent in the same deSEC account is settled by the API, because the wire cannot tell a delegated co-hosted child from an undelegated one: when both zones are served by the same nameservers, a leftover DS with no NS records looks exactly like a working delegation. The API's answer wins and is cached with the result
Fixed in 1.6.0-beta
- An empty non-terminal counted as a break in the chain. Labels like
2.ip6.arpa are not zones and cannot carry a DS, so proving nothing by not carrying one; reverse zones read as broken when they were fine. An NS query now tells a real delegation point from an empty label
- A zone could show a padlock it had not earned. A co-hosted parent with a DS but no NS records could read as secure through the background trickle or Verify all. A verdict is now stored only once the delegation is confirmed, the parent's records are trusted only while they are less than 5 minutes old, and a failed read never counts as confirmation
- Switching the lookup method could freeze the window for about 3 seconds and still return with the worker thread running; a check in flight is now cancelled where it waits
- A stop requested before the worker thread started was swallowed, leaving a worker that would not stop
- The breaker's error streak leaked between batches, so an earlier outage could stop a later healthy run
- Loading the stored setting looked like the user toggling it, which started a sweep nobody asked for
- Settings overflowed and clipped its dropdowns. The page is rearranged, the lookup dropdowns are sized to their contents, the DNS-over-HTTPS provider card appears only when that method is selected, and the lookup method greys out while checks are off
- The duplicate Token Manager card is gone from Settings; Tokens has had its own sidebar page since the Fluent rework
Technical Improvements in 1.6.0-beta
- Queue history no longer rewrites the whole file on every API call. Each entry is serialised once, when it enters the history; writes are coalesced to at most one every 3 seconds, with forced flushes on stop and on clear; and a single response is capped at 32 KB on disk. At the 5000-entry limit that was a 14.8 MB file and about 500 ms per request, 355 ms of it holding the lock the UI needs. It is now about 0.1 ms per request plus a periodic flush
dnspython added to the hash-locked dependencies- Four new modules:
dnssec_probe.py (the walk, with no Qt and no app state), dnssec_status.py (the per-profile cache), dnssec_worker.py (the background thread) and dnssec_icons.py (padlock painting and tooltip wording, shared by both zone lists)
- The feature is documented in
doc/ARCHITECTURE.md, doc/CONFIG.md and doc/UI-FEATURES.md; the queue history path (per profile, not shared) and the Settings layout were corrected in the docs at the same time
Downloads