v5.8.1

Greetings DNS fans!

Small release... mostly testing the new SLSA provenance and release signing. You should see a checksums.txt.sigstore.json
and multiple.intoto.jsonl file as artifacts. Thanks to @chicks for putting that together! Enjoy!

Thanks to all contributors involved in this release! This is a community project and we couldn't do it without all of your contributions!

Sincerely,
--Tom Limoncelli

Monthly video call!

Everyone is invited to the Monthly DNSControl Community Video Conference Call on the 2nd Tuesday of each month. Join whether you are a new user with questions or an experienced developer that wants to discuss DNSControl internals... or anything in between! Meeting details on
GitHub Discussions.

Experimental: Try the new D() syntax!

Select credential entries directly with REGISTRAR() and SERVICE() in dnsconfig.js. The legacy syntax remains supported; this revision replaces the experimental PROVIDER()/DNS_SERVICE() syntax from v5.3.0. See the examples in the conversion guide. Please test it and share feedback!

Changelog

New features:

• 69d4bee: feat(MIGADU_BUILDER): add a builder for Migadu mail records (#5071) (@fgerling)

Bug fixes:

• 148df96: fix(release): grant contents:write to the SLSA provenance job (#5077) (@TomOnTime)

CI/CD:

• 7182148: build(release): sign releases with cosign and add SLSA provenance (#5011) (@chicks-net)

Refactoring:

• c42c4fa: refactor: share one builderOptions() for the options-object builders (#5072) (@fgerling)

Deprecation warnings

Warning

• REV() will switch from RFC2317 to RFC4183 sometime after v5.0 is released. This is a breaking change. Warnings are output if your configuration is affected. See https://docs.dnscontrol.org/language-reference/top-level-functions/revcompat
• NAMEDOTCOM, OPENSRS and SOFTLAYER need maintainers! These providers have no maintainer. Maintainers respond to PRs and fix bugs in a timely manner, and try to stay on top of protocol changes.

Install

macOS and Linux

Install with Homebrew (recommended)

brew trust --formula dnscontrol/tap/dnscontrol
brew install DNSControl/tap/dnscontrol

Using with Docker

You can use the Docker image from Docker hub or GitHub Container Registry.

docker run --rm -it -v "$(pwd):/dns" ghcr.io/dnscontrol/dnscontrol preview

Anywhere else

Alternatively, you can install the latest binary (or the apt/rpm/deb/archlinux package) from this page.

Or, if you have Go installed, you can install the latest version of DNSControl with the following command:

go install github.com/DNSControl/dnscontrol/v4@main

Update

Update to the latest version depends on how you choose to install dnscontrol on your machine.

Update with Homebrew

brew upgrade DNSControl/tap/dnscontrol

Alternatively, you can grab the latest binary (or the apt/rpm/deb package) from this page.

Verify downloads

This release ships two supply-chain guarantees:

• checksums.txt.sigstore.json — a keyless cosign Sigstore bundle (signature, signing certificate, and transparency-log entry in one file) over checksums.txt, issued to this repo's release workflow. Since checksums.txt covers every release artifact, verifying it verifies your download transitively.
• multiple.intoto.jsonl — SLSA Level 3 provenance for all release artifacts, generated by slsa-github-generator.

# Verify the checksums.txt signature (download checksums.txt and
# checksums.txt.sigstore.json first):
cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github\.com/DNSControl/dnscontrol/\.github/workflows/release_draft\.yml@refs/(tags|heads)/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# Then check your download against checksums.txt:
sha256sum --ignore-missing -c checksums.txt