Poweradmin Files

The interface adapts to your PowerDNS server.

Until now, Poweradmin showed the same interface no matter which PowerDNS ran behind it. You could pick a record type your server does not support, or set a metadata kind it ignores, and the only feedback was a server error - or silence. 4.4.0 fixes that: when the PowerDNS API is configured, Poweradmin detects the server version and adjusts itself.

⚠️ Before upgrading: run the database migration for your database type - this release needs it on all three backends, and the zone template pages will fail without it. Coming from 4.2.x, run the 4.3.0 migration first, then this one.

🔌 PowerDNS version awareness

When the PowerDNS API is configured, Poweradmin asks the server what it is and adapts:

• The dashboard shows the connected PowerDNS version.
• Record types the server doesn't support disappear from the selectors, and metadata kinds it doesn't know get a "Requires X.Y+" hint instead of failing.
• Terminology follows the server: zone kinds are labeled Primary/Secondary on 4.5+, Producer/Consumer kinds appear on 4.7+, and Supermasters becomes Autoprimaries on 4.6+.
• On PowerDNS 4.9+ the record list can show last-modified timestamps, and on 5.0 you can manage views and network mappings straight from the UI.
• PowerDNS API errors are surfaced to admins as a banner with the HTTP status and actionable guidance, the API request timeout is configurable (pdns_api.timeout, default 10s), and GET requests are retried once on transient failures.

If the version can't be detected (API down, or not configured), nothing is hidden - you get the same full interface as before. Classic direct-database installs are not affected by any of this.

📁 Zone ownership modes

Poweradmin has always had two ownership models - zones owned by users directly, and zones owned through groups - and every installation carried both. The new dns.zone_ownership_mode setting lets you pick: users_only, groups_only, or both. The default is both, the old behavior; when you restrict the mode, the UI and APIs follow it. In every mode, the APIs now refuse to remove a zone's last owner, so zones can no longer be left without one.

⚙️ New settings

All off or neutral by default, documented in the configuration docs:

• Default zone template (#973) - superusers can mark a template as the default for the add-zone forms, from the template list or via dns.default_zone_template.
• Pinned record types (#984) - dns.top_record_types keeps your most-used types at the top of every record type selector.
• Reverse zone TTL (#1032) - dns.ttl_reverse sets a separate default TTL for PTR records created through the reverse-record helpers.
• Zone owner in the PowerDNS account field - dns.sync_zone_owner_to_account writes the zone's oldest owner into PowerDNS's account field for other tooling to read.
• Custom branding - interface.favicon_path and interface.logo_path point to your own files.
• OIDC/SAML group mapping (#1148) - a mapping value can now be a list, so one IdP group can add a user to several Poweradmin groups; existing string mappings keep working.

✨ More features

• Group-ownership sorting in the zone list (#1051) and zone health markers - disabled zones and zones with a missing SOA are marked directly in the list (#805).
• Manual PowerDNS sync - in API-backend mode, a button on the Forward Zones page refreshes the zone list from PowerDNS on demand.
• Zone owners can view audit logs for their own zones (#1136) - previously admin-only.
• DNSSEC - PEM private key import/export on PowerDNS 4.7+, copy-to-clipboard for DS and DNSKEY records (#1177), and the CSK guidance alert only appears on legacy pre-4.0 servers.
• Records and search - matching-only mode for IPv6 batch PTR creation, and IP-aware search: paste a bare IP and it searches record content and anchors reverse lookups to the right PTR zone (#1306).
• Per-user preferences - hostname-only display of record names (#1181) and a timezone for MFA emails (#718) moved from global config to per-user settings; the old config values act as the default.
• 8 new languages - Croatian, Estonian, Finnish, Hungarian, Latvian, Romanian, Serbian, Slovak; all 28 locales fully translated.

🐛 Fixes

4.4.0 includes every fix shipped in the 4.3.1 through 4.3.4 patch releases (and their 4.2.x counterparts). New fixes on top of those:

Authentication and accounts

• Password reset no longer guesses which account to use when several share an email address - the reset is declined, the preflight response stays neutral, and the rejection is logged.
• SAML/OIDC provider configuration errors are surfaced at startup instead of failing silently (#1218).
• External-auth users have fullname and email read-only on the profile page (#1246), while LDAP identity fields stay editable in the web UI.
• Login allow/deny lists now match IPv6 addresses.
• OIDC endpoint discovery honors HTTPS_PROXY/http_proxy (refs #1188).

API

• HTTP status codes for zone and user operations come from the service layer, so clients get 404/409/500 where a blanket 400 was returned before.
• Group member rosters are limited to administrators.

DDNS

• Standard dyndns2 responses - unchanged updates return nochg and auth failures return badauth; an IPv6 address supplied in the standard myip parameter is accepted.

Zones, records, and templates

• Reverse zones are matched on a label boundary, not a substring.
• Global zone templates can only be managed by superusers.
• Bulk record import filters record types by PowerDNS capabilities, matching the add/edit forms.
• Supermaster account lookups work on MariaDB installations with mixed collations.
• Per-zone permission checks are memoized in bulk-record loops (#1245).

Interface and URLs

• Absolute links in emails and SSO URLs are built from interface.application_url (falling back to the server name) instead of the request's Host header; a dashboard notice appears when password reset is enabled but the URL is unset.
• Language parameter validation is hardened.
• Non-admin users get a simpler flat dashboard layout.

📦 Upgrading

• Back up your database, then replace the files (keep your config/settings.php) and run the migration for your database type before starting the new version:
• sql/poweradmin-mysql-update-to-4.4.0.sql
• sql/poweradmin-pgsql-update-to-4.4.0.sql
• sql/poweradmin-sqlite-update-to-4.4.0.sql
• Coming from 4.2.x, run the 4.3.0 migration first, then this one - don't skip versions.
• Set interface.application_url to your public base URL if you use password reset, SSO, or email notifications - reset emails are not sent without it.
• Custom themes that fork edit.html must re-sync it - zone saves now depend on new hidden marker fields, and an outdated fork will save no records.
• API clients that branch on status codes should review the changes (404/409/500 where a blanket 400 used to be), and omitting permissions on a template PUT now leaves permissions untouched instead of clearing them.
• DDNS clients that string-match responses: unchanged updates now return nochg and auth failures return badauth, per the dyndns2 convention.
• PHP 8.2+ required (unchanged); tested on 8.2 through 8.5. PowerDNS 4.x through 5.x supported; the capability features need the PowerDNS HTTP API configured.
• Docker: poweradmin/poweradmin:4.4.0. The :stable tag now tracks the 4.3.x line; :latest follows the master branch.
• Full step-by-step guide: https://docs.poweradmin.org/upgrading/v4.4.0/

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.3.3...v4.4.0