DNSControl

v4.40.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 7d Infrastructure as Code

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

dns dnscontrol go iac

ReleasePort's take

Light signal

editorial:auto 7d

DNSControl v4.40.0 adds several provider integrations and fixes while preparing for a breaking change in the REV() function scheduled for v5.0.

Why it matters: The upcoming v5.0 release will switch REV() from RFC2317 to RFC4183, affecting all scripts that rely on its current behavior; plan migrations before adoption of v5.0.

Summary

AI summary

Broad release touches @TomOnTime, Provider-specific changes, CI/CD, and Other changes and improvements.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	REV() will switch from RFC2317 to RFC4183 in upcoming v5.0 (breaking change) REV() will switch from RFC2317 to RFC4183 in upcoming v5.0 (breaking change) Source: llm_adapter@2026-05-27 Confidence: high	—
Feature
Feature	Medium	Adds Tencent Cloud DNS provider TENCENTDNS Adds Tencent Cloud DNS provider TENCENTDNS Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Medium	Enables ORACLE NO_PURGE and IGNORE() support via diff2 upgrade Enables ORACLE NO_PURGE and IGNORE() support via diff2 upgrade Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Medium	Adds GIDINET support to dnscontrol init command Adds GIDINET support to dnscontrol init command Source: llm_adapter@2026-05-27 Confidence: high	—
Feature	Medium	Improves ROUTE53 init command support for named AWS profiles including SSO Improves ROUTE53 init command support for named AWS profiles including SSO Source: llm_adapter@2026-05-27 Confidence: high	—
Dependency	Low	Updates dependencies via CHORE commits (multiple updates) Updates dependencies via CHORE commits (multiple updates) Source: llm_adapter@2026-05-27 Confidence: high	—
Bugfix	Medium	Fixes NAMECHEAP zone listing pagination for >20 zones/domains Fixes NAMECHEAP zone listing pagination for >20 zones/domains Source: llm_adapter@2026-05-27 Confidence: high	—
Bugfix	Low	Fixes maintainer name typo for TenCent in metadata Fixes maintainer name typo for TenCent in metadata Source: llm_adapter@2026-05-27 Confidence: high	—

Full changelog

Greetings DNS fans!

Release highlights:

NEW PROVIDER: DNSControl now supports Tencent Cloud DNS (TENCENTDNS)! Thanks and welcome to @cylonchau who joins the project as its maintainer. We look forward to great things!
Automated testing now includes: AZURE_PRIVATE_DNS, CLOUDFLAREAPI!
NAMECHEAP now supports more than 20 zones/domains!
ORACLE now reliably supports NO_PURGE and IGNORE*()
dnscontrol init now supports GIDINET and ROUTE53 support is improved!

Thanks to all contributors involved in this release! This is a community project and we couldn't do it without all of your contributions!

Sincerely,
--Tom Limoncelli

Monthly video call!

Everyone is invited to the Monthly DNSControl Community Video Conference Call on the 2nd Tuesday of each month. Join whether you are a new user with questions or an experienced developer that wants to discuss DNSControl internals... or anything in between! Meeting details on
GitHub Discussions.

Changelog

Major features:

918f7956e3a7e5bc2b8dfb888c62afe3b195c30b: NEW PROVIDER: Tencent Cloud DNS (TENCENTDNS/DNSPOD) provider and registrar (#4237) (@cylonchau)

Provider-specific changes:

a38f323be1bc5056e21ac4c3c07ef105548d2a60: AXFRDDNS: Support for Technitium Conditional Forwarder Zones (Ignore TYPE65281) (#4333) (@jadorno)
c2819a82c0fd8034e100cd3b582d118be1488bd4: AZURE_PRIVATE_DNS: Enable automated testing (#4332) (@TomOnTime)
b86a51fc08ff7e2eda9ada505ffae135b63d3345: CLOUDFLAREAPI: Reduce integration tests to match the free tier (#4325) (@TomOnTime)
515461722f911a0331d3a37fab7b6fd305d54bc7: GIDINET: support init command (#4288) (@TomOnTime)
3bd6aa30b9113a4cdf6742cd3946db452afc51f4: HEDNS: Re-enable HTTPS/SVCB test that was failing (#4331) (@TomOnTime)
315073df44b1d60e79d01d0f55b5582d9592964f: NAMECHEAP: Fix paginate zone listing to work with more than 20 items (#4330) (@ajkavanagh)
a196675cee3b071f3ae7742a9a82a32ce0c04ef6: ORACLE: Enable NO_PURGE and IGNORE*() by upgrading to diff2 (#4310) (@fabienmazieres)
3fd02feba3149c6e5a13a57009f2101a64e06e63: ROUTE53: support named AWS profiles (including SSO) and init command (#4312) (@tresni)

CI/CD:

5ada75d7a6ec6c45b7b06207fa4b626f7d597155: Build(deps): Bump actions/checkout from 4 to 6 (#4321) (@dependabot[bot])
2006de49d6ba5e1cbfc98974678e531b8e84801b: Build(deps): Bump actions/labeler from 5 to 6 (#4320) (@dependabot[bot])
ec2f91f3724eb72cf530712b33653782dfd25ee1: Build(deps): Bump ws from 8.20.0 to 8.20.1 (#4314) (@dependabot[bot])
37624724c7c7b925459272a6f98a90d3305d71b5: CICD: Enable "pipefail" to catch more errors (2nd try) (#4327) (@TomOnTime)
b52fcd2313c84dcbb1bf8489f721a2b8ef3b7ea4: CICD: Skip failing HEDNS test (#4329) (@TomOnTime)

Dependencies:

aee8769ce5557eae6833c00c44ac6e82f95ab9d2: CHORE: Update dependencies (#4319) (@TomOnTime)
4393182f68a723f10fab6b2e3d0521e12f6b9481: CHORE: Update dependencies (#4334) (@TomOnTime)

Other changes and improvements:

29a1eb98731efdadf66a217b408fdb06d5ed74f0: BUG: Fix maintainer name of TenCent (#4318) (@TomOnTime)
306d6bc7a23d9e64dfa93a045a40218950f83223: BUGFIX: ech=s (#4324) (@TomOnTime)
5d9726d52f9d02516e0fc678de614be17a5d1725: CHORE: generate-all.sh (#4323) (@TomOnTime)
c5d796036519be20eb9d39bef88cd02fee37ddd9: TXTUTIL: accept adjacent quoted chunks without a separator (#4315) (@tresni)

Deprecation warnings

[!WARNING]

REV() will switch from RFC2317 to RFC4183 in v5.0. This is a breaking change. Warnings are output if your configuration is affected. No date has been announced for v5.0. See https://docs.dnscontrol.org/language-reference/top-level-functions/revcompat

NAMEDOTCOM, OPENSRS and SOFTLAYER need maintainers! These providers have no maintainer. Maintainers respond to PRs and fix bugs in a timely manner, and try to stay on top of protocol changes.

Install

macOS and Linux

Install with Homebrew (recommended)

brew install DNSControl/tap/dnscontrol

Using with Docker

You can use the Docker image from Docker hub or GitHub Container Registry.

docker run --rm -it -v "$(pwd):/dns" ghcr.io/dnscontrol/dnscontrol preview

Anywhere else

Alternatively, you can install the latest binary (or the apt/rpm/deb/archlinux package) from this page.

Or, if you have Go installed, you can install the latest version of DNSControl with the following command:

go install github.com/DNSControl/dnscontrol/v4@main

Update

Update to the latest version depends on how you choose to install dnscontrol on your machine.

Update with Homebrew

brew upgrade DNSControl/tap/dnscontrol

Alternatively, you can grab the latest binary (or the apt/rpm/deb package) from this page.

Breaking Changes

REV() function will switch from RFC2317 to RFC4183 in v5.0 (breaking change).

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track DNSControl

Get notified when new releases ship.

About DNSControl

Infrastructure as code for DNS!

All releases →

Related context

Related tools

Earlier breaking changes

v4.41.0 REV() will switch from RFC2317 to RFC4183 in v5.0 (breaking change)
v4.39.0 REV() will switch from RFC2317 to RFC4183 in v5.0, a breaking change.
v4.38.0 `dnscontrol get-zones` drops older syntax support, changing behavior
v4.38.0 REV() will switch from RFC2317 to RFC4183 in v5.0, a breaking change for affected configurations