Forged on over 100,000 production zones during a live fleet migration
Don't carry corrupt zones
into your new fleet.
cPanel DNS zone files decay over time. Semicolons inside unquoted TXT records, broken DKIM escaping, apex CNAMEs, and out-of-sync cluster secondaries sit quietly until you restart BIND or migrate servers — and then everything fails at once.
Steadfast DNS Toolkit gives you a complete, terminal-native system to audit, repair, update and synchronise your entire DNS fleet safely.
One price. Every server. Forever. No per-account billing, ever.
Domain names sanitized. Findings, timings and counts are from a real run.
Forged on over 100,000 production zones during a live fleet migration.
Then validated against 6,000 real broken zones before release.
One system, four tools
Each stage hands off to the next. You can stop after the first one and still know more about your DNS than you did this morning.
ZoneVitals
Finds split-brain zones, broken zone files, lame delegations, dangerous SPF records and write-only cluster nodes — then explains each one well enough that you learn something, not just patch something.
Never writes. Enforced by a test, not by good intentions.
DNS-Doctor
Repairs broken zone files — unbalanced TXT records, apex CNAMEs, MX records pointing at CNAMEs, mangled DKIM keys, concatenated domain names, duplicate SPF records — and can undo every change it makes.
Your comments survive. Only the broken line changes.
ZoneOps
Deliberate mass edits across working zones. Nameserver migrations, adding a relay to every SPF policy, bumping serials so a batch propagates — the things you do once every couple of years, to thousands of zones at a time.
Canary batch of ten, then it stops and waits for you.
ClusterFleet
Pushes zones across a cPanel cluster over SSH and reads the SOA serial back from every target to prove they landed. Agentless — nothing is installed on the servers it talks to.
No rollback — said plainly rather than faked.
What this actually costs you today
There are two kinds of buyer here, and the sum works out differently for each.
If you have staff
Auditing and repairing a few thousand zones by hand is roughly 20 hours of senior sysadmin time. At typical rates that is $800–$1,600.
Or $179, once.
If it's just you
Two nights of your life, with the ticket queue building the whole time.
Or $179, once.
And the third cost, which nobody budgets for
Doing it manually — or with a hand-rolled Perl script at 2am — does not just cost time. It can leave the zones worse than when you started. I have watched exactly that happen on a fleet I was responsible for, and an entire server had to be rebuilt to fix it.
That is the whole reason this toolkit refuses to write anything until it can prove the result is loadable, and keeps a verified copy of whatever it replaced.
A zone file changes only if every gate passes
Dry run is the default in every tool that writes. Nothing goes live without
--apply, and
--dry-run always beats it.
THE FIVE GATES · DNS-DOCTOR
Dry run is the default. Nothing is written without --apply.
An immutable, checksum-verified copy exists. Backup failure skips the zone; it is never repaired unprotected.
Repairs go to a temp file beside the target, never the live one.
named-checkzone passes on the staged file. A repair that would break the zone is discarded.
os.replace() swaps it in. A killed process can never leave a truncated zone.
After the swap the live file is validated again, and restored from backup if anything is wrong.
Three more for fleet-wide work
ZoneOps and ClusterFleet each add three gates on top of the five, because they touch zones that were already working. A bad rule does not break one zone — it breaks every zone at once.
- 6 PREVIEWED — the rule itself is shown before any zone is touched, not a diff afterwards. A wrong rule is caught while it has changed nothing.
- 7 CANARY — ten zones, validated, then it stops. The difference between breaking ten zones and breaking six thousand.
-
8
CONFIRMED — past 25 zones an armed run must be confirmed out loud. With no terminal and no
--yesit refuses rather than proceeding.
The undo button
Every armed run gets its own directory holding a verified copy of each zone it changed, plus the manifest that makes rollback possible.
/var/named-backups/
20260806-014540-c865/
example.com.db the zone as it was
entries.jsonl appended as each zone commits
manifest.json written when the run finishesNothing is overwritten and nothing is pruned — a backup store that deletes things on your behalf is not one you can rely on during an incident. An interrupted run has a journal and no manifest, and is still recoverable.
Where the honesty matters: ClusterFleet has no rollback
A cluster push is not reversible the way a file edit is. Re-pushing does not undo it, and the zone that arrived on the peers is now the zone they serve. So rather than fake an undo, ClusterFleet is built to be certain before it acts — preview the plan, resolve ownership so a zone is never broadcast to servers that do not host it, push to one server first — and to prove the result afterwards by reading the SOA serial back from every target.
Benchmarked on 5,883 live cPanel zone files
Not a synthetic corpus. A real shared-hosting fleet, 30 MB of zone files.
ZoneVitals — about 35 seconds
Validated every zone through BIND's own parser at roughly 170 zones/sec, and found 2 zones the nameserver cannot load at all, plus 17 zones on dynamic-DNS or abuse-pattern domains.
DNS-Doctor — about 51 seconds
Examined the same 5,883 zones, proposed 5 precise repairs to 1 zone, flagged 2 zones as beyond automated repair, and wrote nothing. Dry run is the default.
Measured on a 3-core i5 laptop under WSL2, not a server. A production cPanel box with 8–16 cores will be materially faster, so treat these as a floor rather than a ceiling. Both tools agree on which zones are broken, and neither calls a zone healthy without having asked BIND first.
SyncVitals Desktop
Everything else in the toolkit produces output for you. SyncVitals produces an artifact for someone else.
Watch cluster sync status live, then export a report showing exactly which domains are synced and which are still outstanding — the report you hand your client, attach to the ticket, or send your boss to prove the migration is clean.
That is a genuinely different job from the rest of the toolkit, which is why it sits outside the LOOK → HEAL → CHANGE → PUSH chain. I know the need firsthand — it is exactly what a manager kept asking me for.
- Live cluster sync status with real-time progress
- HTML and CSV export — hand it over, or drop it in a spreadsheet
- Check against your own cluster peers or public resolvers
- Saved jobs and history, so a re-check is one click
- Bulk paste or upload a domain list
SyncVitals runs on your desktop, not the server. It queries nameservers remotely, so your admin workstation is exactly the right place for it — your servers stay untouched.
Ships with a Windows installer that bundles its own Python, so there is nothing to set up. It is a plain Python application, so it also runs from source on macOS and Linux.
One price. Every server. Forever.
No per-account billing, ever. No subscription. All v1.x updates included.
ZoneVitals
The diagnosis. Yours regardless.
- Full read-only fleet audit
- Around 30 checks across zones, sync, nameservers, SPF and abuse patterns
- One file, standard library only — nothing to install
- Open source, forever
Steadfast DNS Toolkit
DNS-Doctor, ZoneOps, ClusterFleet & SyncVitals.
- Unlimited servers within your organisation
- Perpetual licence — yours forever
- All v1.x updates included
- Source-available — read and modify every line
- SyncVitals Desktop included
DNS + MySQL Bundle
Both toolkits, one purchase.
- Everything in the DNS Toolkit
- Steadfast MySQL Toolkit
- Same terms — unlimited servers, perpetual
- Saves $99 against buying them separately
ZoneVitals is MIT-licensed and always free. The toolkit is source-available under a perpetual licence — read every line and modify it for your own use, but not for redistribution or resale. Full licensing terms.
“If I still had DigiServ and looked at how many zones I had to fix, I'd have been scheduling it for night shifts and leaving support tickets for twenty hours.”
— Rudi Burger, 25 years of hosting infrastructure, Steadfast Codeworks
Start with the free one.
Run ZoneVitals against your own fleet. It never writes anything, so there is no blast radius — and whatever it prints is the honest state of your DNS. If the number comes back zero, you have lost nothing but a minute.