DnsManager

DnsEditor is a multi-provider DNS zone editor for sysadmins, DevOps engineers, and anyone who manages DNS. Connect to Cloudflare, AWS Route 53, Google Cloud DNS, or your own BIND9 servers — all from one native app on your Mac, iPhone, or iPad. MULTI-PROVIDER SUPPORT Configure multiple providers and switch between them effortlessly. Mix cloud-hosted and self-hosted DNS in one app. API tokens and TSIG keys are stored securely in the system Keychain. - Cloudflare (API token) - AWS Route 53 (access key) - Google Cloud DNS (service account) - BIND9 / RFC 2136 (TSIG authentication) FULL RECORD EDITING Create and edit records with intuitive type-specific editors. Supported types: A, AAAA, CAA, CNAME, DNAME, DS, HINFO, HTTPS, LOC, MX, NAPTR, NS, PTR, RP, SRV, SSHFP, SVCB, TLSA, and TXT. AUTOMATIC REVERSE DNS When creating or editing A/AAAA records, DnsEditor detects matching reverse zones and offers to create PTR records automatically. Sibling records are cross-matched with toggles to select which mappings to create. Existing PTRs are shown as correct or flagged when they point elsewhere. IP CONFLICT DETECTION If a reverse PTR points to a different hostname with a matching forward record, the address is flagged with a red warning to prevent overwriting active reverse mappings. ZONE CLEANUP Scan any zone for dangling PTR records — reverse records without matching forward A/AAAA records. Results grouped by issue type. Bulk delete all dangling PTRs with one tap across multiple reverse zones. Undo support groups records by zone for proper multi-zone restoration. Export reports as plain text. REVERSE/FORWARD DNS VERIFICATION Every A/AAAA record is checked for a matching PTR, and vice versa. Results are color-coded: green for match, red for mismatch, orange when no record exists. Fix missing records with one tap. When deleting a matched record, DnsEditor offers to delete the paired record too. Private network lookups query your provider's nameserver directly. REVERSE ZONE TOOLS PTR records display the unreversed IP address next to the hostname. When editing PTRs, enter a normal IPv4/IPv6 address and the reversed name is generated automatically. DNSSEC AWARE View DNSSEC signing status at a glance. Inspect DS, DNSKEY, CDS, and CDNSKEY records. Verify delegation signer configurations against published DNSKEYs. Generate DS records from KSK DNSKEYs. DANE / TLSA Generate and verify TLSA records for DANE certificate association. Fetch TLS certificates from your servers with STARTTLS support for SMTP, IMAP, and POP3. Scan all hosts in a zone for any common TLSA port. SSHFP Generate and validate SSHFP records by fetching SSH host keys from your servers. Scan all hosts in a zone to detect new keys, orphaned records, and fingerprint changes. ZONE SANITY CHECK Verify all authoritative nameservers serve identical records. Queries each nameserver directly and compares NS delegation, SOA serials, and every record. Differences grouped by record with affected nameservers listed. Export as plain text. DS UPDATE SCANNER (BIND9) Scan all zones to detect KSK rollovers needing DS updates. Compares parent DS with child CDS records. Exclude TLDs with automated CDS scanning. When a zone's parent is also in your provider, apply the DS update directly with a safe two-phase approach. CONCURRENT UPDATE PROTECTION (BIND9) Every RFC 2136 update includes a prerequisite check verifying the server record still matches what was loaded. If DHCPD, an ACME client, or another editor changed the record, the update is rejected instead of silently overwriting. The check is evaluated atomically — no partial changes applied. ADDITIONAL FEATURES - Internationalized domain names (IDN) - LOC record editor with map preview - QuickLook record preview - Undo history with expandable bulk entries - IPv6 in compressed notation - Auto-hides DNSSEC chain records - Resizable editor windows on macOS