Windows DNS Policy Manager

Project Homepage

A browser-based GUI for Windows Server DNS — policies, zones, records, DNSSEC, DNS over HTTPS, and blocklists. Built with Next.js, TypeScript, and shadcn/ui, it connects to a live DNS server through the included PowerShell bridge for real-time management, and works offline as a PowerShell command generator. Includes 8 scenario wizards and an MCP server for AI agent integration (Claude Code, Cursor, VS Code).

Features

• 12-tab interface: Server, Objects, Zones, Policies, Create, Blocklists, Wizards, DNSSEC, DNS over HTTPS, Resolvers, Backup, PowerShell
• Multi-server management with Kerberos, DPAPI-saved, or session-based credentials and header server switcher for quick switching from any tab
• Server configuration dashboard with inline editing for 13 config panels (settings, forwarders, recursion, cache, blocklist, diagnostics, statistics, RRL, scavenging, root hints, EDNS, AD settings, global name zone)
• DNS Best Practices Analyzer — run Windows BPA from the UI with severity-coded findings
• Zone browser with two-panel layout, settings editor, full record CRUD, CSV import/export, pagination, and filters for Forward/Reverse, zone type (Primary/Secondary/Stub/Forwarder), and AD-integrated
• 8 scenario wizards with typed execution (geo-location, split-brain, time-of-day, load balancing, query filters, blocklist, geo+LB combo, primary-secondary)
• Blocklists tab — Quick Block (single domain), Bulk Import (.txt), Active Block Policies table, and Global Query Block List management
• Resolvers tab — IP stack DNS per adapter (IPv4/IPv6), forwarder configuration, Mermaid topology diagram with color-coded edges
• DNSSEC management — zone signing, signing key CRUD, trust anchors, trust points
• DNS over HTTPS (DoH) — dedicated tab to enable/disable inbound DoH and manage up to 3 URI templates live on Windows Server 2025+ (KB5094125), plus an offline generator for the full prerequisite setup script (certificate import, netsh SSL binding, firewall rule, Set-DnsServerEncryptionProtocol, and DNS service restart)
• Policy CRUD with enable/disable toggle, processing order editor, and cross-server copy
• DNS object management for client subnets, zone scopes, and recursion scopes
• Zone lifecycle — create, delete, convert, suspend, resume, export zones
• PowerShell command generation with copy-to-clipboard — works offline as a command generator
• Backup & export — policy JSON backup/restore, server configuration export (Get-DnsServer as JSON), DNS zone export (single or all primary zones via Export-DnsServerZone), AD-integrated backup info
• DNS Lookup utility — slide-over panel with live nslookup and dig queries from any tab. Tool-specific options (+trace, +dnssec, +short, +all, +multiline, debug), custom or registered nameserver targeting, and console-style session output with copy/clear
• Context-sensitive help with slide-over panel and full-page popout
• 21 Playwright E2E tests with mock bridge, integrated into CI
• MCP server — 31 read-only tools for AI agents via Model Context Protocol (zones, records, policies, server config, DNSSEC, RRL, scavenging, and more), plus offline PowerShell command generation
• Docker-ready with multi-stage Alpine image (221 MB)
• Keyboard-accessible tab navigation and ARIA attributes

Running Locally

Requirements

• Node.js 24 LTS ("Krypton") — the version CI, Docker, and .nvmrc all target. Node 20 reached end-of-life on 2026-04-30 and Node 22 is in maintenance until 2027-04-30, so 24 is the current Active LTS. With nvm, run nvm use in the repo root to pick it up.
• Windows Server with the DNS Server role, or a machine with the DnsServer PowerShell module
• The bridge binds only to 127.0.0.1 by default — never exposed to the network

One-command launch

powershell -ExecutionPolicy Bypass -File Start-DNSPolicyManager.ps1

This starts both the PowerShell bridge (port 8650) and the Next.js dev server (port 10010), then opens your browser. Frontend dependencies are installed automatically on first run.

Manual startup

# Terminal 1: Start the bridge
powershell -ExecutionPolicy Bypass -File server/bridge.ps1

# Terminal 2: Start the frontend
cd dns-manager
npm install   # first time only
npm run dev

Then open http://localhost:10010.

Offline mode

If the bridge isn't running, the app falls back to command generation only — build policies visually and copy the generated PowerShell commands.

MCP Server (AI Agent Integration)

The MCP server lets AI agents query your DNS servers through 31 read-only tools via the Model Context Protocol. It connects to the same PowerShell bridge used by the web UI.

Setup

cd mcp-server
npm install
npm run build

Or use the launcher:

powershell -ExecutionPolicy Bypass -File Start-DNSPolicyManager.ps1 -MCP

Register with Claude Code

claude mcp add dns-policy-manager -- node /path/to/mcp-server/dist/index.js

With environment variables for a specific server:

claude mcp add dns-policy-manager \
  -e BRIDGE_URL=http://127.0.0.1:8650 \
  -e DNS_DEFAULT_SERVER=dc01.contoso.com \
  -e DNS_CREDENTIAL_MODE=currentUser \
  -- node /path/to/mcp-server/dist/index.js

Configuration

All configuration is via environment variables:

This is the beginning of the README. Read the rest at the original. Read the full README ↗