Ghost
released this
2026-09-13 16:36:57 +00:00
| 176 commits to master since this release
Added in 1.7.0-beta
- A delegation indicator beside each zone's padlock. A chain link, drawn in front of it, saying whether the parent actually delegates the zone to deSEC's nameservers. The two findings are independent: changing a domain's nameservers at a registrar does not touch its DS, and a clean migration to another provider removes the DS on the way out, so with the padlock alone a zone that has left the account reads as an unremarkable grey "unsigned", identical to a domain that was never signed. Four states: at deSEC (joined, green), partly at deSEC (joined, amber, for deSEC's nameservers with a stranger's alongside them or only one of the two), elsewhere (broken, amber), not delegated (broken, red)
- The delegation costs no extra query in the default lookup method: the referral the walk already follows carries the parent's NS RRset. The resolver and DNS-over-HTTPS methods have no referral, so they send one NS query per zone and read the zone's own RRset instead, which the tooltip says plainly: it catches a domain that has moved away, but not a parent listing deSEC alongside a stranger. A zone whose parent is in the same account is answered from the parent's own records through the API
- Checks now run in the background. Before, nothing was checked unless the DNSSEC page was open, and then five zones at a time, so a padlock on the DNS page was as old as the last visit there. A pass now runs every 10 minutes whatever page is in front, taking up to 25 zones whose answers have expired, oldest first, with the first pass shortly after startup rather than during it
- A zone is checked the moment it is created, instead of carrying no icon until something happened to reach it
- The zone you select is checked first when its answer has expired, on both pages, and costs nothing when it has not
- Recheck Interval setting: how long a healthy answer is kept, 1, 3, 7 (default), 14 or 30 days, from a dropdown rather than a number to type, since a DS record does not change hourly. The 6 hours a broken, undelegated or erroring zone waits is deliberately not offered: that one belongs to somebody mid-fix. Changing it rewrites nothing and takes effect at once
- An icon legend, from the info button beside the domain list: every icon next to what it means, in one popup
- Tooltips lead with the verdict. "Nameservers OK, DNSSEC verified" in colour and bold, joining both findings, then the evidence, then how old it is in grey. The headline takes the colour of the worse half, so a green delegation cannot dress up a broken chain beside it
- doc/DNSSEC-CHECKS.md, a document of its own for the feature: the icons, every trigger that starts a check, how long answers are kept, the lookup methods, and the one case the check cannot settle
Fixed in 1.7.0-beta
- A tooltip about a zone appeared over the records pane. Qt shows an item view's tooltip wherever the pointer is, so hovering the right-hand end of a long zone name put it past the splitter, where it read as though it belonged to whatever was under it. Tooltips are now anchored under their row, in both lists
- Tooltips used the system's pale yellow styling on a dark window. They now follow the app's theme, and the status icons repaint when the theme changes rather than keeping the colours they were painted with
- A zone whose delegation had just been fixed could keep a red padlock until the next background pass, while the Chain of Trust card beside it already read "NS: in place". Lifting that verdict now asks for the recheck it just made due
- A delegation finding could outlive what it rested on, in three places: lifting an override carried through its own "publishes no NS records", the wizard writing a delegation left the same claim behind, and a co-hosted zone with a leftover DS could read as delegated to deSEC in the resolver modes while resolving nowhere. All three are now settled against the parent's own records
- A walk that failed after seeing a referral discarded the delegation it had already established, which is exactly the lame-delegation case where it matters
- Settings showed three dead dropdowns while the feature was off. The lookup method, provider and recheck interval are details of that feature and now go away with it, as the provider card already did when a method that does not use it was selected
- A new zone's result could be discarded seconds after it was checked, if the DNSSEC page was opened before the zone list finished syncing: the page rebuilt its list from the cache, which did not know about the zone yet, and dropped the entry its own check had just stored
- Walking the zone list with the arrow keys could queue the whole account. Selecting a zone checks it when its answer has expired, and on a cold cache that is every zone; the check now waits for the selection to settle, so only the row stopped on is checked
- The "DNSSEC checks unavailable" warning could appear over an unrelated page twenty seconds after launch, with nothing on screen to connect it to. It now interrupts only when its own page is in front; the log line and the note under the domain list record it either way
- The broken link's outer round caps were clipped square by the edge of the canvas
Technical Improvements in 1.7.0-beta
- Each status icon carries a 2x pixmap, so a HiDPI row is painted for its screen rather than stretched
- Entries written before the delegation finding existed are due at once, so they fill in after an upgrade instead of waiting up to a week. Absent, not False: a check that ran and could not settle the delegation waits its ordinary turn, which keeps those zones out of every sweep for ever
- After a batch finds DNS unreachable, the background pass waits an hour and tries again on its own. The page-show path still waits to be asked, which is right where somebody is present to press Verify all
delegation.classify_ns() decides what a set of nameservers means, beside DESEC_NAMESERVERS, so this feature and the subdomain wizard cannot disagree; dnssec_probe reports the names it found and nothing more- The cache stores those names rather than a verdict about them, so a file written today still reads correctly if the provider's nameserver list ever changes
- 355 tests across 9 scripts, up from 315
Downloads