Windows DNS Policy Manager

Project Homepage

A browser-based GUI for Windows Server DNS — policies, zones, records, DNSSEC, DNS over HTTPS, and blocklists. Built with Next.js, TypeScript, and shadcn/ui, it connects to a live DNS server through the included PowerShell bridge for real-time management, and works offline as a PowerShell command generator. Includes 8 scenario wizards and an MCP server for AI agent integration (Claude Code, Cursor, VS Code).

Features

• 12-tab interface: Server, Objects, Zones, Policies, Create, Blocklists, Wizards, DNSSEC, DNS over HTTPS, Resolvers, Backup, PowerShell
• Multi-server management with Kerberos, DPAPI-saved, or session-based credentials and header server switcher for quick switching from any tab
• Server configuration dashboard with inline editing for 13 config panels (settings, forwarders, recursion, cache, blocklist, diagnostics, statistics, RRL, scavenging, root hints, EDNS, AD settings, global name zone)
• DNS Best Practices Analyzer — run Windows BPA from the UI with severity-coded findings
• Zone browser with two-panel layout, settings editor, full record CRUD, CSV import/export, pagination, and filters for Forward/Reverse, zone type (Primary/Secondary/Stub/Forwarder), and AD-integrated
• 8 scenario wizards with typed execution (geo-location, split-brain, time-of-day, load balancing, query filters, blocklist, geo+LB combo, primary-secondary)
• Blocklists tab — Quick Block (single domain), Bulk Import (.txt), Active Block Policies table, and Global Query Block List management
• Resolvers tab — IP stack DNS per adapter (IPv4/IPv6), forwarder configuration, Mermaid topology diagram with color-coded edges
• DNSSEC management — zone signing, signing key CRUD, trust anchors, trust points
• DNS over HTTPS (DoH) — dedicated tab to enable/disable inbound DoH and manage up to 3 URI templates live on Windows Server 2025+ (KB5094125), plus an offline generator for the full prerequisite setup script (certificate import, netsh SSL binding, firewall rule, Set-DnsServerEncryptionProtocol, and DNS service restart)
• Policy CRUD with enable/disable toggle, processing order editor, and cross-server copy
• DNS object management for client subnets, zone scopes, and recursion scopes
• Zone lifecycle — create, delete, convert, suspend, resume, export zones
• PowerShell command generation with copy-to-clipboard — works offline as a command generator
• Backup & export — policy JSON backup/restore, server configuration export (Get-DnsServer as JSON), DNS zone export (single or all primary zones via Export-DnsServerZone), AD-integrated backup info
• DNS Lookup utility — slide-over panel with live nslookup and dig queries from any tab. Tool-specific options (+trace, +dnssec, +short, +all, +multiline, debug), custom or registered nameserver targeting, and console-style session output with copy/clear
• Context-sensitive help with slide-over panel and full-page popout
• 21 Playwright E2E tests with mock bridge, integrated into CI
• MCP server — 31 read-only tools for AI agents via Model Context Protocol (zones, records, policies, server config, DNSSEC, RRL, scavenging, and more), plus offline PowerShell command generation
• Docker-ready with multi-stage Alpine image (221 MB)
• Keyboard-accessible tab navigation and ARIA attributes

Running Locally

Requirements

• Node.js 24 LTS ("Krypton") — the version CI, Docker, and .nvmrc all target. Node 20 reached end-of-life on 2026-04-30 and Node 22 is in maintenance until 2027-04-30, so 24 is the current Active LTS. With nvm, run nvm use in the repo root to pick it up.
• Windows Server with the DNS Server role, or a machine with the DnsServer PowerShell module
• The bridge binds only to 127.0.0.1 by default — never exposed to the network

One-command launch

powershell -ExecutionPolicy Bypass -File Start-DNSPolicyManager.ps1

This starts both the PowerShell bridge (port 8650) and the Next.js dev server (port 10010), then opens your browser. Frontend dependencies are installed automatically on first run.

Manual startup

# Terminal 1: Start the bridge
powershell -ExecutionPolicy Bypass -File server/bridge.ps1

# Terminal 2: Start the frontend
cd dns-manager
npm install   # first time only
npm run dev

Then open http://localhost:10010.

Offline mode

If the bridge isn't running, the app falls back to command generation only — build policies visually and copy the generated PowerShell commands.

MCP Server (AI Agent Integration)

The MCP server lets AI agents query your DNS servers through 31 read-only tools via the Model Context Protocol. It connects to the same PowerShell bridge used by the web UI.

Setup

cd mcp-server
npm install
npm run build

Or use the launcher:

powershell -ExecutionPolicy Bypass -File Start-DNSPolicyManager.ps1 -MCP

Register with Claude Code

claude mcp add dns-policy-manager -- node /path/to/mcp-server/dist/index.js

With environment variables for a specific server:

claude mcp add dns-policy-manager \
  -e BRIDGE_URL=http://127.0.0.1:8650 \
  -e DNS_DEFAULT_SERVER=dc01.contoso.com \
  -e DNS_CREDENTIAL_MODE=currentUser \
  -- node /path/to/mcp-server/dist/index.js

Configuration

All configuration is via environment variables:

Variable	Default	Description
BRIDGE_URL	http://127.0.0.1:8650	PowerShell bridge URL
BRIDGE_TOKEN	(read from the token file)	Bridge bearer token. Only needed when the MCP server runs as a different user or machine than the bridge
BRIDGE_TOKEN_FILE	%LOCALAPPDATA%\DNSPolicyManager\bridge.token	Where to read the token the bridge writes on start
DNS_DEFAULT_SERVER	(none)	Default DNS server hostname
DNS_SERVER_ID	(none)	Server ID for credential lookup
DNS_CREDENTIAL_MODE	currentUser	Auth mode: currentUser or savedCredential

Available Tools (31)

Category	Tools
Zones	dns_list_zones, dns_get_zone_details, dns_get_zone_records, dns_get_zone_aging, dns_get_zone_delegations
Policies	dns_list_policies, dns_list_transfer_policies
Server Config	dns_get_server_settings, dns_get_forwarders, dns_get_cache_settings, dns_get_recursion_settings, dns_get_blocklist, dns_get_diagnostics, dns_get_statistics, dns_get_rrl, dns_get_rrl_exceptions, dns_get_scavenging, dns_get_root_hints, dns_get_edns, dns_get_encryption, dns_get_global_name_zone, dns_export_server_config
DNS Objects	dns_list_subnets, dns_list_zone_scopes, dns_list_recursion_scopes
DNSSEC	dns_get_dnssec_settings, dns_get_signing_keys, dns_get_trust_anchors, dns_get_trust_points
Offline	dns_generate_policy_commands (works without bridge)
Health	dns_check_health

Authentication

The MCP server supports two credential modes:

• currentUser (default) — uses Kerberos/NTLM from the logged-in user. No setup needed.
• savedCredential — uses DPAPI-encrypted credentials stored via the web UI. Set DNS_SERVER_ID to the server ID configured in the GUI.

Session credentials (username/password) are intentionally not supported in the MCP server — AI agents should not handle raw passwords.

Security