DNS Server Sentinel documentation

Quick start

1. Download and extract the ZIP package.
2. Run the Admin application included in the package.
3. Download the Service edition for a Windows Service, or the Portable edition for a project-local DNS server.
4. Create or choose a configuration file.
5. Add a zone and records.
6. Start the service or launch portable mode.

Admin app

The Admin app is the graphical control panel for DNS Server Sentinel. Use it to edit zones and DNS records, manage the Windows Service edition, launch the Portable edition, open settings, view basic statistics, inspect logs when enabled, and install a Pro license.

The Service package includes DnsServerSentinel.Admin.Service.exe. The Portable package includes DnsServerSentinel.Admin.Portable.exe. Both edit the same JSON configuration format, but each edition is tailored to its runtime mode.

Service mode

The Service edition installs DNS Server Sentinel as a Windows Service named DnsServerSentinel. Use it when the DNS server should run continuously in the background.

Default system paths

• Configuration: C:\ProgramData\DnsServerSentinel\dns-config.json
• Logs: C:\ProgramData\DnsServerSentinel\Logs\

Portable mode

The Portable edition starts the DNS service process directly without installing a Windows Service. It is useful for development, demos, and project-specific DNS configurations.

For practical scenarios, see Portable DNS Server for Windows and DNS Server for Developers.

& ".\DnsServerSentinel.Service.exe" --portable --config ".\.sentinel\dns-config.json"

If logs are enabled, Admin adds the --logs argument. If logs are disabled, the argument is omitted.

License

DNS Server Sentinel uses offline license keys. The Admin app verifies the key locally using the product public key.

• Without Pro, both editions run in Free mode.
• Free mode answers DNS queries for 48 hours from each server start.
• After 48 hours, the server stops resolving DNS requests. Stop and start the Windows Service, or close and relaunch portable mode, to resume DNS resolution.
• Pro licenses are bound to the Machine ID shown in Settings > License.
• Pro removes the 48-hour runtime limit on the licensed machine.
• Install a license from Settings > License.
• Service licenses are stored in C:\ProgramData\DnsServerSentinel\license.key.
• Portable licenses are stored next to the selected portable configuration file.

How to buy and activate Pro

Pro removes the 48-hour Free runtime limit on the licensed machine. The license is generated for the Machine ID shown by the Admin app.

1. Open the Admin app on the machine where DNS Server Sentinel will run.
2. Open Settings > License.
3. Copy the Machine ID, or click the purchase link from the License page if available.
4. Open the Buy Pro page and make sure the Machine ID field contains the correct value.
5. Fill in the customer and billing details.
6. Complete the payment with PayPal.
7. After payment, the license request is reviewed and the Pro license key is sent to the email address used during purchase.
8. Return to Settings > License, paste the license key, and install it.
9. Restart the Service or relaunch Portable mode so the running server picks up the Pro license.

Configuration files

The configuration is JSON-based and shared by Admin, Service, and Portable mode. The server watches the file and reloads settings when possible.

Zones

A zone groups the records for a DNS namespace, such as example.local or 0.0.127.in-addr.arpa.

Name servers and SOA

Use the zone name server window to configure optional SOA and NS metadata. The Admin UI lets users type local parts like ns1 and shows the zone suffix next to the field.

Records

Records can be edited inline in the grid or through the structured editor. Invalid rows are highlighted in light red.

Wildcards

*        = any direct name under the zone
*.wild   = any direct name under wild.example.local

Forwarding and cache

Forwarding sends unanswered local queries to upstream DNS servers. Cache stores forwarded answers until their TTL expires.

• Use forwarding for normal internet DNS resolution.
• Use cache to reduce repeated upstream traffic.
• TCP fallback retries upstream UDP responses when they are truncated.
• Global fallback A/AAAA can return a configured IP for unmatched local requests.

Protections

Protections limit traffic and control who can use recursive forwarding.

• Max UDP/TCP query size: drops or closes oversized queries.
• Rate per minute: limits requests from the same client IP.
• Max TCP clients: caps concurrent TCP clients.
• Recursion allowlist: restricts forwarding to trusted clients.
• Ignored domains: silently drops matching domains or subdomains.

Ignored domains

Ignored domains are not answered. Sentinel silently drops matching requests instead of returning an error response.

Global fallback

Global fallback can answer unmatched local A or AAAA requests with a configured address. Use it only when you intentionally want unknown names to resolve to a controlled destination.

• A fallback returns the configured IPv4 address for unmatched A queries.
• AAAA fallback returns the configured IPv6 address for unmatched AAAA queries.
• Disable fallback when you prefer NXDOMAIN or forwarding behavior.

Logs and stats

Logs are disabled by default. Enable logs from Settings when troubleshooting or observing server behavior. The Stats panel reads recent log lines and summarizes queries, forwarding, cache, listeners, and errors.

Troubleshooting