# DnsManager — DNS editor using RFC 2136 > DNS editor using RFC 2136 (iPhone/iPad app by Ivar Hosteng.) - Source: https://appshunter.io/ios/app/dnsmanager/id6758127395 (this page in markdown: same URL + `.md`) - Developer: [Ivar Hosteng](https://appshunter.io/developer/1799632700) - Category: Utilities - Price: $5.99 - Age rating: 4+ - Requires: iOS 17.0 · 14 MB - Languages: American English - Released: 2026-02-01 - Data updated: 2026-08-20 - User reviews in markdown: https://appshunter.io/ios/app/dnsmanager/id6758127395/reviews.md ## What is DnsManager? DnsEditor is a multi-provider DNS zone editor for sysadmins, DevOps engineers, and anyone who manages DNS. Connect to Cloudflare, AWS Route 53, Google Cloud DNS, or your own BIND9 servers — all from one native app on your Mac, iPhone, or iPad. MULTI-PROVIDER SUPPORT Configure multiple providers and switch between them effortlessly. Mix cloud-hosted and self-hosted DNS in one app. API tokens and TSIG keys are stored securely in the system Keychain. - Cloudflare (API token) - AWS Route 53 (access key) - Google Cloud DNS (service account) - BIND9 / RFC 2136 (TSIG authentication) FULL RECORD EDITING Create and edit records with intuitive type-specific editors. Supported types: A, AAAA, CAA, CNAME, DNAME, DS, HINFO, HTTPS, LOC, MX, NAPTR, NS, PTR, RP, SRV, SSHFP, SVCB, TLSA, and TXT. AUTOMATIC REVERSE DNS When creating or editing A/AAAA records, DnsEditor detects matching reverse zones and offers to create PTR records automatically. Sibling records are cross-matched with toggles to select which mappings to create. Existing PTRs are shown as correct or flagged when they point elsewhere. IP CONFLICT DETECTION If a reverse PTR points to a different hostname with a matching forward record, the address is flagged with a red warning to prevent overwriting active reverse mappings. ZONE CLEANUP Scan any zone for dangling PTR records — reverse records without matching forward A/AAAA records. Results grouped by issue type. Bulk delete all dangling PTRs with one tap across multiple reverse zones. Undo support groups records by zone for proper multi-zone restoration. Export reports as plain text. REVERSE/FORWARD DNS VERIFICATION Every A/AAAA record is checked for a matching PTR, and vice versa. Results are color-coded: green for match, red for mismatch, orange when no record exists. Fix missing records with one tap. When deleting a matched record, DnsEditor offers to delete the paired record too. Private network lookups query your provider's nameserver directly. REVERSE ZONE TOOLS PTR records display the unreversed IP address next to the hostname. When editing PTRs, enter a normal IPv4/IPv6 address and the reversed name is generated automatically. DNSSEC AWARE View DNSSEC signing status at a glance. Inspect DS, DNSKEY, CDS, and CDNSKEY records. Verify delegation signer configurations against published DNSKEYs. Generate DS records from KSK DNSKEYs. DANE / TLSA Generate and verify TLSA records for DANE certificate association. Fetch TLS certificates from your servers with STARTTLS support for SMTP, IMAP, and POP3. Scan all hosts in a zone for any common TLSA port. SSHFP Generate and validate SSHFP records by fetching SSH host keys from your servers. Scan all hosts in a zone to detect new keys, orphaned records, and fingerprint changes. ZONE SANITY CHECK Verify all authoritative nameservers serve identical records. Queries each nameserver directly and compares NS delegation, SOA serials, and every record. Differences grouped by record with affected nameservers listed. Export as plain text. DS UPDATE SCANNER (BIND9) Scan all zones to detect KSK rollovers needing DS updates. Compares parent DS with child CDS records. Exclude TLDs with automated CDS scanning. When a zone's parent is also in your provider, apply the DS update directly with a safe two-phase approach. CONCURRENT UPDATE PROTECTION (BIND9) Every RFC 2136 update includes a prerequisite check verifying the server record still matches what was loaded. If DHCPD, an ACME client, or another editor changed the record, the update is rejected instead of silently overwriting. The check is evaluated atomically — no partial changes applied. ADDITIONAL FEATURES - Internationalized domain names (IDN) - LOC record editor with map preview - QuickLook record preview - Undo history with expandable bulk entries - IPv6 in compressed notation - Auto-hides DNSSEC chain records - Resizable editor windows on macOS ## Version history (last 5 releases) ### 5.4.0 — 2026-08-16 New - View Sync Enforcement — keep split-horizon records aligned automatically: mark any synced record to report drift between views by email, or have the daemon repair it on the spot. - Secondary Nameserver Watch — get an email when a secondary stops answering DNS queries, including its service status and recent logs collected over SSH, plus a recovery notice when it's back. - AXFR IP Locking — optionally restrict each secondary's transfer key to that secondary's own IP addresses. A stolen key becomes useless anywhere else; your management keys keep working from any location. - Bulk Record Editing — select multiple records and change TTL, sync status, and drift enforcement in a single pass, with a per-record results report. Improved - All notification emails now use a clean HTML layout, with a plain-text version included for older mail clients. Fixed - Long TXT records (such as DKIM keys) could be duplicated when edited or synced. - Certificate subject appeared twice in shared TLSA scan reports. ### 5.3.2 — 2026-07-30 Completed the name change in all emails and alerts, also fixed a crash caused from a race condition displaying the main app window on rare occasion's after reloading a zone ### 5.3.1 — 2026-07-19 After being bitten by an expired certificate on a webserver I had a TLSA record for I added checking for expired certificates. Now you will be warned if there is less than a configurable numbers days left on the certificate giving you time to fix the problem before it becomes an outage event. ### 5.3.0 — 2026-07-07 A lot of changes the the companion daemon. - It does now support validating it's own self using TLSA/DANE if it's hostname lives in a DNSSEC signed zone. In that case no need for a letsencrypt certificate any more - It also have improvement's when deploying to a freshly installed bind setup. - The helper script the daemon deploys on the secondary nameservers have had their initial migration speed increased drastically for secondaries with many existing zones - The app now supports editing SOA records - Bugs have been squashed in both the daemon and the app itself ### 5.2.0 — 2026-06-24 - DNSSEC key history cached in SQLite — instant loading regardless of log size - DNSSEC signature health scanner — daemon AXFRs all zones, flags expired/expiring RRSIGs, unsigned RRsets, broken DNSKEYs; email alerts + in-app results - DNSSEC scan per-zone include/exclude with explicit zone picker sheet - Signature expiry badges in zone viewer (yellow clock icon with time remaining) - Signature expiry shown in checkmark tooltip and record view sheet - Records with both bad signature and approaching expiry list both problems - DNSSEC key history cached in SQLite — instant loading regardless of log size - Daily background scan keeps cache fresh with delta reads - Rescan button in Key History to force full cache rebuild from raw logs Bugs fixed: - iOS: fix Back button snapping back to detail from zone records - iOS: preload DNSSEC validation before navigating to zone detail (badge reliability fix) ## More apps by Ivar Hosteng - [DnsQuery](https://appshunter.io/ios/app/dnsquery/id6762698643) All apps by Ivar Hosteng: https://appshunter.io/developer/1799632700 --- *Data collected daily from the US App Store and indexed by [AppsHunter](https://appshunter.io/). User reviews are verbatim App Store reviews. Ratings, prices and chart positions refresh continuously; this snapshot is from 2026-08-20.*