DNSControl

v4.41.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1d Infrastructure as Code

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

dns dnscontrol go iac

ReleasePort's take

Light signal

editorial:auto 1d

DNSControl v4.41.0 adds several provider features and a breaking change to the REV() function.

Why it matters: The upcoming v5.0 release will switch REV() from RFC2317 to RFC4183, affecting all configurations that rely on the current behavior; plan migrations before adoption.

Summary

AI summary

Broad release touches Provider-specific changes, macOS and Linux, @TomOnTime, and Other changes and improvements.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	REV() will switch from RFC2317 to RFC4183 in v5.0 (breaking change) REV() will switch from RFC2317 to RFC4183 in v5.0 (breaking change) Source: llm_adapter@2026-06-02 Confidence: high	—
Feature
Feature	Medium	Adds Netnod provider support Adds Netnod provider support Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Medium	Adds AZURE_PRIVATE_DNS support for `dnscontrol init` command Adds AZURE_PRIVATE_DNS support for `dnscontrol init` command Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Medium	Adds HEDNS support for RP record type Adds HEDNS support for RP record type Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Medium	Extends ROUTE53 R53_ALIAS to support all AWS target record types Extends ROUTE53 R53_ALIAS to support all AWS target record types Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Medium	Adds ROUTE53 support for AWS European Sovereign Cloud Adds ROUTE53 support for AWS European Sovereign Cloud Source: llm_adapter@2026-06-02 Confidence: high	—
Dependency	Low	Updates dependencies (chore update) Updates dependencies (chore update) Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Fixes CAA_BUILDER type declaration issues Fixes CAA_BUILDER type declaration issues Source: llm_adapter@2026-06-02 Confidence: high	—

Full changelog

Greetings DNS fans!

Release highlights:

NEW PROVIDER: DNSControl now supports Netnod! Thanks and welcome to @vilhelmprytz who joins the project as its maintainer. We look forward to great things!
dnscontrol init now supports AZURE_PRIVATE_DNS!
HEDNS now supports the RP record type!
ROUTE53's R53_ALIAS custom record now supports all the record types AWS supports!
ROUTE53 adds support for accessing the AWS European Sovereign Cloud!
...and much, much, more!

Thanks to all contributors involved in this release! This is a community project and we couldn't do it without all of your contributions! We hope to see you at the June 9 DNSControl monthly video call! (see below)

Sincerely,
--Tom Limoncelli

Monthly video call!

Everyone is invited to the Monthly DNSControl Community Video Conference Call on the 2nd Tuesday of each month. Join whether you are a new user with questions or an experienced developer that wants to discuss DNSControl internals... or anything in between! Meeting details on
GitHub Discussions.

Changelog

Major features:

df8e1f3f7eef80ab19a312230e64239de888378d: NEW PROVIDER: Netnod primary DNS (#4191) (@vilhelmprytz)

Provider-specific changes:

7a079bc2a3201df47b4c6969d6231b91a950375f: AZURE_PRIVATE_DNS: Fix more tests (#4336) (@TomOnTime)
5c73b3c69439c6446182430a9300a1ed2c215655: AZURE_PRIVATE_DNS: support init command (#4274) (@TomOnTime)
ce473340c161542d5a75ec485b678358a771beca: HEDNS: Add RP record support (#4343) (@rblenkinsopp)
23004ec292d68d034fa82d91d12dc702360eca5f: ROUTE53: Add missing R53_ALIAS target record types (#4337) (@tresni)
900ad67ba108424d65211ecfc20d336fbbf08eb1: ROUTE53: Initial AWS European Sovereign Cloud support (#4342) (@istenrot)

Documentation:

bc84a47746599fbded813a20cf3b378f8b563988: DOCS: Use the "-args" flag with "go test" when appropriate (#4341) (@TomOnTime)

Dependencies:

db01b642aa1d885907954edca976007807acf7da: CHORE: Update dependencies (#4344) (@TomOnTime)

Other changes and improvements:

e6f22cbbacb99307f58546e5c2862e7a85d4329c: BUG: Fix CAA_BUILDER type declarations (#4339) (@thelegy)
480a6f4c4daf773a1381050dbf17fd29215e5635: CHORE: Linting (#4338) (@TomOnTime)

Deprecation warnings

[!WARNING]

REV() will switch from RFC2317 to RFC4183 in v5.0. This is a breaking change. Warnings are output if your configuration is affected. No date has been announced for v5.0. See https://docs.dnscontrol.org/language-reference/top-level-functions/revcompat

NAMEDOTCOM, OPENSRS and SOFTLAYER need maintainers! These providers have no maintainer. Maintainers respond to PRs and fix bugs in a timely manner, and try to stay on top of protocol changes.

Install

macOS and Linux

Install with Homebrew (recommended)

brew install DNSControl/tap/dnscontrol

Using with Docker

You can use the Docker image from Docker hub or GitHub Container Registry.

docker run --rm -it -v "$(pwd):/dns" ghcr.io/dnscontrol/dnscontrol preview

Anywhere else

Alternatively, you can install the latest binary (or the apt/rpm/deb/archlinux package) from this page.

Or, if you have Go installed, you can install the latest version of DNSControl with the following command:

go install github.com/DNSControl/dnscontrol/v4@main

Update

Update to the latest version depends on how you choose to install dnscontrol on your machine.

Update with Homebrew

brew upgrade DNSControl/tap/dnscontrol

Alternatively, you can grab the latest binary (or the apt/rpm/deb package) from this page.

Breaking Changes

REV() function will switch from RFC2317 to RFC4183 in v5.0 (breaking change)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track DNSControl

Get notified when new releases ship.

About DNSControl

Infrastructure as code for DNS!

All releases →

Related context

Related tools

Earlier breaking changes

v4.40.0 REV() will switch from RFC2317 to RFC4183 in upcoming v5.0 (breaking change)
v4.39.0 REV() will switch from RFC2317 to RFC4183 in v5.0, a breaking change.
v4.38.0 `dnscontrol get-zones` drops older syntax support, changing behavior
v4.38.0 REV() will switch from RFC2317 to RFC4183 in v5.0, a breaking change for affected configurations