From 2de72ed506c47b049c8d1057518129ad8f7d543e Mon Sep 17 00:00:00 2001
From: Hermes <hermes@nousagent.com>
Date: Wed, 10 Jun 2026 15:06:41 -0700
Subject: [PATCH] =?UTF-8?q?feat:=20DNS=20provider=20abstraction=20?=
 =?UTF-8?q?=E2=80=94=20Technitium,=20Cloudflare,=20RFC=202136,=20Manual?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- dns-providers/: adapter base class + registry with auto-discovery
- technitium.js: wraps existing Technitium API calls into adapter interface
- cloudflare.js: Cloudflare API v4 adapter (zones, records, credentials)
- rfc2136.js: RFC 2136 dynamic DNS via nsupdate (BIND, PowerDNS, etc.)
- manual.js: no-op adapter for external DNS management with instructions
- provider-dns.js: provider-aware DNS context, resolves active adapter from config
- Universal helper methods: universalCreateRecord/Delete/ResolveRecord
- All 7 route files updated to use universal methods instead of raw dns.call()
- Setup wizard: provider dropdown (Technitium, Cloudflare, RFC 2136, Manual)
- DNS template selector: added Cloudflare and External/Manual options
- Config schema: validates dns.provider field
- Capability gating on Technitium-specific endpoints (logs, restart, update)
- Backward compatible: no provider set = auto-detect (technitium if dns.ip exists)
---
 dashcaddy-api/VERSION                     |   2 +-
 dashcaddy-api/config-schema.js            |   9 +
 dashcaddy-api/dns-providers/base.js       |  69 +++
 dashcaddy-api/dns-providers/cloudflare.js | 269 ++++++++++++
 dashcaddy-api/dns-providers/manual.js     |  93 ++++
 dashcaddy-api/dns-providers/registry.js   | 101 +++++
 dashcaddy-api/dns-providers/rfc2136.js    | 383 ++++++++++++++++
 dashcaddy-api/dns-providers/technitium.js | 507 ++++++++++++++++++++++
 dashcaddy-api/package.json                |   2 +-
 dashcaddy-api/routes/apps/deploy.js       |   2 +-
 dashcaddy-api/routes/apps/removal.js      |  15 +-
 dashcaddy-api/routes/apps/restore.js      |   2 +-
 dashcaddy-api/routes/apps/templates.js    |   8 +-
 dashcaddy-api/routes/dns.js               | 162 ++++++-
 dashcaddy-api/routes/services.js          |   5 +-
 dashcaddy-api/routes/sites.js             |   2 +-
 dashcaddy-api/src/context/dns.js          |  22 +
 dashcaddy-api/src/context/provider-dns.js | 302 +++++++++++++
 status/index.html                         |  10 +-
 status/js/dns-template-selector.js        |  30 ++
 status/js/setup-wizard.js                 |   3 +-
 21 files changed, 1965 insertions(+), 33 deletions(-)
 create mode 100644 dashcaddy-api/dns-providers/base.js
 create mode 100644 dashcaddy-api/dns-providers/cloudflare.js
 create mode 100644 dashcaddy-api/dns-providers/manual.js
 create mode 100644 dashcaddy-api/dns-providers/registry.js
 create mode 100644 dashcaddy-api/dns-providers/rfc2136.js
 create mode 100644 dashcaddy-api/dns-providers/technitium.js
 create mode 100644 dashcaddy-api/src/context/provider-dns.js

diff --git a/dashcaddy-api/VERSION b/dashcaddy-api/VERSION
index f8e233b..81c871d 100644
--- a/dashcaddy-api/VERSION
+++ b/dashcaddy-api/VERSION
@@ -1 +1 @@
-1.9.0
+1.10.0
diff --git a/dashcaddy-api/config-schema.js b/dashcaddy-api/config-schema.js
index c8b5438..75fed0c 100644
--- a/dashcaddy-api/config-schema.js
+++ b/dashcaddy-api/config-schema.js
@@ -59,6 +59,15 @@ function validateConfig(config) {
           errors.push('dns.servers must be an object');
         }
       }
+      // DNS provider validation
+      if (config.dns.provider !== undefined) {
+        const validProviders = ['technitium', 'cloudflare', 'rfc2136', 'manual'];
+        if (typeof config.dns.provider !== 'string') {
+          errors.push('dns.provider must be a string');
+        } else if (!validProviders.includes(config.dns.provider)) {
+          warnings.push(`dns.provider "${config.dns.provider}" is not one of: ${validProviders.join(', ')}. It may still work if a custom adapter is installed.`);
+        }
+      }
     }
   }
 
diff --git a/dashcaddy-api/dns-providers/base.js b/dashcaddy-api/dns-providers/base.js
new file mode 100644
index 0000000..9db3860
--- /dev/null
+++ b/dashcaddy-api/dns-providers/base.js
@@ -0,0 +1,69 @@
+/**
+ * Base DNS Provider Adapter
+ * All DNS provider adapters must extend this class and implement the required methods.
+ * 
+ * Each adapter handles the specifics of talking to a particular DNS provider's API.
+ * The routes layer calls these methods generically — no provider-specific logic in routes.
+ */
+class BaseDNSProvider {
+  constructor(config, ctx) {
+    this.config = config;    // Provider-specific config (api token, server url, etc.)
+    this.ctx = ctx;          // Shared app context (log, credentialManager, fetchT, etc.)
+    this.providerId = 'base';
+    this.displayName = 'Base DNS Provider';
+  }
+
+  /** Check if this provider supports a given capability */
+  supportsCapability(cap) {
+    // Capabilities: 'create-record', 'delete-record', 'resolve', 'list-records',
+    //              'logs', 'restart', 'update-check', 'credentials', 'zones'
+    return false;
+  }
+
+  /** Authenticate and return a token/session */
+  async authenticate() { throw new Error('Not implemented'); }
+
+  /** Create a DNS record */
+  async createRecord({ domain, zone, type, value, ttl, overwrite }) { throw new Error('Not implemented'); }
+
+  /** Delete a DNS record */
+  async deleteRecord({ domain, type, value }) { throw new Error('Not implemented'); }
+
+  /** Resolve/query existing records for a domain */
+  async resolveRecords({ domain, zone, type }) { throw new Error('Not implemented'); }
+
+  /** List all records in a zone */
+  async listRecords({ zone }) { throw new Error('Not implemented'); }
+
+  /** Get DNS query logs */
+  async getLogs({ limit, server }) { throw new Error('Not implemented'); }
+
+  /** Restart the DNS server */
+  async restartServer({ server }) { throw new Error('Not implemented'); }
+
+  /** Check for DNS server updates */
+  async checkUpdate({ server }) { throw new Error('Not implemented'); }
+
+  /** Get provider status info */
+  async getStatus() {
+    return {
+      providerId: this.providerId,
+      displayName: this.displayName,
+      capabilities: this.getCapabilities(),
+      authenticated: false
+    };
+  }
+
+  /** Get list of supported capabilities */
+  getCapabilities() {
+    return [];
+  }
+
+  /** Validate provider-specific config */
+  validateConfig() { return { valid: true, errors: [] }; }
+
+  /** Clean up resources on shutdown */
+  async shutdown() {}
+}
+
+module.exports = BaseDNSProvider;
diff --git a/dashcaddy-api/dns-providers/cloudflare.js b/dashcaddy-api/dns-providers/cloudflare.js
new file mode 100644
index 0000000..e10eb92
--- /dev/null
+++ b/dashcaddy-api/dns-providers/cloudflare.js
@@ -0,0 +1,269 @@
+/**
+ * Cloudflare DNS Provider Adapter
+ * Manages DNS records via the Cloudflare API v4.
+ */
+const BaseDNSProvider = require('./base');
+
+const CF_API_BASE = 'https://api.cloudflare.com/client/v4';
+
+class CloudflareDNSProvider extends BaseDNSProvider {
+  constructor(config, ctx) {
+    super(config, ctx);
+    this.providerId = 'cloudflare';
+    this.displayName = 'Cloudflare DNS';
+
+    // Resolve API token: explicit config takes priority, then credential manager
+    this.apiToken = config.apiToken
+      || (ctx.credentialManager && ctx.credentialManager.get('dns.cloudflare.apiToken'))
+      || null;
+    this.zoneId = config.zoneId || null;
+    this.domain = config.domain || null;
+  }
+
+  // ── Helpers ────────────────────────────────────────────────────────────
+
+  /** Build common request headers for Cloudflare API calls */
+  _headers() {
+    return {
+      'Authorization': `Bearer ${this.apiToken}`,
+      'Content-Type': 'application/json',
+    };
+  }
+
+  /** Make an authenticated request to the Cloudflare API */
+  async _cfRequest(method, path, body) {
+    const url = `${CF_API_BASE}${path}`;
+    const opts = {
+      method,
+      headers: this._headers(),
+    };
+    if (body !== undefined) {
+      opts.body = JSON.stringify(body);
+    }
+    return this.ctx.fetchT(url, opts);
+  }
+
+  /** Map a Cloudflare DNS record to the normalised format expected by routes */
+  _mapRecord(rec) {
+    return {
+      id: rec.id,
+      type: rec.type,
+      name: rec.name,
+      value: rec.content,
+      ttl: rec.ttl,
+      proxied: rec.proxied || false,
+    };
+  }
+
+  // ── Capabilities ───────────────────────────────────────────────────────
+
+  supportsCapability(cap) {
+    return this.getCapabilities().includes(cap);
+  }
+
+  getCapabilities() {
+    return ['create-record', 'delete-record', 'resolve', 'list-records', 'credentials', 'zones'];
+  }
+
+  // ── Authentication ─────────────────────────────────────────────────────
+
+  /**
+   * Validate the API token by calling the Cloudflare verify endpoint.
+   * Stores basic zone info on success.
+   */
+  async authenticate() {
+    this.ctx.log('[cloudflare] Authenticating – verifying API token…');
+
+    if (!this.apiToken) {
+      return { status: 'error', message: 'No Cloudflare API token provided' };
+    }
+
+    const res = await this._cfRequest('GET', '/user/tokens/verify');
+    const data = await res.json();
+
+    if (!data.success) {
+      const msg = (data.errors && data.errors[0] && data.errors[0].message) || 'Token verification failed';
+      this.ctx.log(`[cloudflare] Authentication failed: ${msg}`);
+      return { status: 'error', message: msg };
+    }
+
+    this.ctx.log(`[cloudflare] Token verified for status "${data.status}"`);
+
+    // Optionally fetch zone info if zoneId is configured
+    if (this.zoneId) {
+      try {
+        const zoneRes = await this._cfRequest('GET', `/zones/${this.zoneId}`);
+        const zoneData = await zoneRes.json();
+        if (zoneData.success && zoneData.result) {
+          this.zoneInfo = zoneData.result;
+          this.ctx.log(`[cloudflare] Zone loaded: ${zoneData.result.name} (${zoneData.result.id})`);
+        }
+      } catch (err) {
+        this.ctx.log(`[cloudflare] Could not fetch zone info: ${err.message}`);
+      }
+    }
+
+    return { status: 'ok', response: { status: data.status } };
+  }
+
+  // ── Create Record ──────────────────────────────────────────────────────
+
+  /**
+   * Create a DNS record.
+   * If overwrite is true, first delete any existing record with the same name+type.
+   */
+  async createRecord({ domain, zone, type, value, ttl, overwrite }) {
+    const targetDomain = domain || this.domain;
+    const targetZone = zone || this.zoneId;
+
+    if (!targetZone) {
+      return { status: 'error', message: 'No zone ID configured for Cloudflare' };
+    }
+
+    if (overwrite) {
+      this.ctx.log(`[cloudflare] Overwrite requested – deleting existing ${type} record for ${targetDomain}`);
+      try {
+        await this.deleteRecord({ domain: targetDomain, type, value });
+      } catch (err) {
+        this.ctx.log(`[cloudflare] No existing record to overwrite (or delete failed): ${err.message}`);
+      }
+    }
+
+    const body = {
+      type,
+      name: targetDomain,
+      content: value,
+      ttl: ttl || 1, // 1 = automatic TTL in Cloudflare
+      proxied: false,
+    };
+
+    this.ctx.log(`[cloudflare] Creating ${type} record: ${targetDomain} → ${value}`);
+    const res = await this._cfRequest('POST', `/zones/${targetZone}/dns_records`, body);
+    const data = await res.json();
+
+    if (!data.success) {
+      const msg = (data.errors && data.errors[0] && data.errors[0].message) || 'Record creation failed';
+      this.ctx.log(`[cloudflare] Create failed: ${msg}`);
+      return { status: 'error', message: msg };
+    }
+
+    return { status: 'ok', response: { record: this._mapRecord(data.result) } };
+  }
+
+  // ── Delete Record ──────────────────────────────────────────────────────
+
+  /**
+   * Delete DNS records matching domain+type.
+   * Lists matching records first, then deletes each one.
+   */
+  async deleteRecord({ domain, type, value }) {
+    const targetDomain = domain || this.domain;
+    const targetZone = this.zoneId;
+
+    if (!targetZone) {
+      return { status: 'error', message: 'No zone ID configured for Cloudflare' };
+    }
+
+    // List records matching name + type
+    let queryPath = `/zones/${targetZone}/dns_records?name=${encodeURIComponent(targetDomain)}`;
+    if (type) {
+      queryPath += `&type=${encodeURIComponent(type)}`;
+    }
+
+    const listRes = await this._cfRequest('GET', queryPath);
+    const listData = await listRes.json();
+
+    if (!listData.success) {
+      const msg = (listData.errors && listData.errors[0] && listData.errors[0].message) || 'Failed to list records for deletion';
+      this.ctx.log(`[cloudflare] Delete – list failed: ${msg}`);
+      return { status: 'error', message: msg };
+    }
+
+    const matching = listData.result || [];
+    if (matching.length === 0) {
+      this.ctx.log(`[cloudflare] No records found for ${targetDomain} (${type || 'any type'})`);
+      return { status: 'ok', response: { deleted: 0 } };
+    }
+
+    // If a specific value is given, only delete records matching that value
+    const toDelete = value
+      ? matching.filter((r) => r.content === value)
+      : matching;
+
+    let deleted = 0;
+    for (const record of toDelete) {
+      const delRes = await this._cfRequest('DELETE', `/zones/${targetZone}/dns_records/${record.id}`);
+      const delData = await delRes.json();
+      if (delData.success) {
+        deleted++;
+        this.ctx.log(`[cloudflare] Deleted record ${record.id} (${record.type} ${record.name})`);
+      } else {
+        const msg = (delData.errors && delData.errors[0] && delData.errors[0].message) || 'Delete failed';
+        this.ctx.log(`[cloudflare] Failed to delete record ${record.id}: ${msg}`);
+      }
+    }
+
+    return { status: 'ok', response: { deleted } };
+  }
+
+  // ── Resolve Records ───────────────────────────────────────────────────
+
+  /**
+   * Resolve/query existing records for a domain.
+   * Returns records matching domain (and optionally type).
+   */
+  async resolveRecords({ domain, zone, type }) {
+    const targetDomain = domain || this.domain;
+    const targetZone = zone || this.zoneId;
+
+    if (!targetZone) {
+      return { status: 'error', message: 'No zone ID configured for Cloudflare' };
+    }
+
+    let queryPath = `/zones/${targetZone}/dns_records?name=${encodeURIComponent(targetDomain)}`;
+    if (type) {
+      queryPath += `&type=${encodeURIComponent(type)}`;
+    }
+
+    this.ctx.log(`[cloudflare] Resolving records for ${targetDomain}${type ? ` (${type})` : ''}`);
+    const res = await this._cfRequest('GET', queryPath);
+    const data = await res.json();
+
+    if (!data.success) {
+      const msg = (data.errors && data.errors[0] && data.errors[0].message) || 'Resolve failed';
+      this.ctx.log(`[cloudflare] Resolve failed: ${msg}`);
+      return { status: 'error', message: msg };
+    }
+
+    const records = (data.result || []).map(this._mapRecord);
+    return { status: 'ok', response: { records } };
+  }
+
+  // ── List Records ───────────────────────────────────────────────────────
+
+  /**
+   * List all DNS records in a zone.
+   */
+  async listRecords({ zone }) {
+    const targetZone = zone || this.zoneId;
+
+    if (!targetZone) {
+      return { status: 'error', message: 'No zone ID configured for Cloudflare' };
+    }
+
+    this.ctx.log(`[cloudflare] Listing all records in zone ${targetZone}`);
+    const res = await this._cfRequest('GET', `/zones/${targetZone}/dns_records`);
+    const data = await res.json();
+
+    if (!data.success) {
+      const msg = (data.errors && data.errors[0] && data.errors[0].message) || 'List failed';
+      this.ctx.log(`[cloudflare] List failed: ${msg}`);
+      return { status: 'error', message: msg };
+    }
+
+    const records = (data.result || []).map(this._mapRecord);
+    return { status: 'ok', response: { records } };
+  }
+}
+
+module.exports = CloudflareDNSProvider;
diff --git a/dashcaddy-api/dns-providers/manual.js b/dashcaddy-api/dns-providers/manual.js
new file mode 100644
index 0000000..f6430de
--- /dev/null
+++ b/dashcaddy-api/dns-providers/manual.js
@@ -0,0 +1,93 @@
+/**
+ * Manual DNS Provider Adapter
+ * No-op adapter for users who manage DNS externally (manual, cPanel, other control panels).
+ * Provides propagation checking only — all record operations return helpful instructions.
+ */
+const BaseDNSProvider = require('./base');
+
+class ManualDNSProvider extends BaseDNSProvider {
+  constructor(config, ctx) {
+    super(config, ctx);
+    this.providerId = 'manual';
+    this.displayName = 'Manual / External DNS';
+    this.description = 'Manage DNS records yourself via your provider\'s control panel';
+  }
+
+  supportsCapability(cap) {
+    return ['credentials'].includes(cap);
+  }
+
+  getCapabilities() {
+    return ['credentials'];
+  }
+
+  async authenticate() {
+    return { success: true, message: 'Manual DNS — no authentication needed' };
+  }
+
+  async createRecord({ domain, zone, type, value, ttl }) {
+    return {
+      status: 'manual',
+      message: `Create this record manually in your DNS control panel:`,
+      instructions: {
+        name: domain,
+        type: type || 'A',
+        value,
+        ttl: ttl || 300
+      }
+    };
+  }
+
+  async deleteRecord({ domain, type, value }) {
+    return {
+      status: 'manual',
+      message: `Delete this record manually from your DNS control panel:`,
+      instructions: {
+        name: domain,
+        type: type || 'A',
+        value: value || '(any)'
+      }
+    };
+  }
+
+  async resolveRecords({ domain, zone, type }) {
+    // Use Node.js built-in DNS to resolve regardless of provider
+    const dns = require('dns').promises;
+    try {
+      const resolver = new dns.Resolver();
+      resolver.setServers(['1.1.1.1', '8.8.8.8']);
+      const records = await resolver.resolve(domain, type || 'A');
+      return {
+        status: 'ok',
+        response: {
+          records: records.map(r => ({
+            type: type || 'A',
+            domain,
+            rData: { ipAddress: r },
+            ttl: 0,
+            manual: true
+          }))
+        }
+      };
+    } catch (err) {
+      return { status: 'ok', response: { records: [] } };
+    }
+  }
+
+  async getStatus() {
+    return {
+      providerId: this.providerId,
+      displayName: this.displayName,
+      description: this.description,
+      capabilities: this.getCapabilities(),
+      authenticated: true,
+      note: 'DNS records are managed externally. Use propagation checks to verify changes.'
+    };
+  }
+
+  validateConfig() {
+    return { valid: true, errors: [] };
+  }
+}
+
+module.exports = ManualDNSProvider;
diff --git a/dashcaddy-api/dns-providers/registry.js b/dashcaddy-api/dns-providers/registry.js
new file mode 100644
index 0000000..915cf92
--- /dev/null
+++ b/dashcaddy-api/dns-providers/registry.js
@@ -0,0 +1,101 @@
+/**
+ * DNS Provider Registry
+ * Manages available DNS provider adapters.
+ * Providers register themselves, and the active provider is selected by config.
+ */
+const path = require('path');
+
+class DNSProviderRegistry {
+  constructor() {
+    this.providers = new Map();    // providerId -> adapter class
+    this.instances = new Map();    // providerId -> adapter instance
+  }
+
+  /** Register a provider adapter class */
+  register(adapterClass) {
+    const instance = new adapterClass({}, {});
+    const id = instance.providerId;
+    if (this.providers.has(id)) {
+      console.warn(`DNS provider "${id}" already registered, overwriting`);
+    }
+    this.providers.set(id, adapterClass);
+  }
+
+  /** Get list of all registered provider IDs */
+  getProviderIds() {
+    return Array.from(this.providers.keys());
+  }
+
+  /** Get metadata for all providers (without instantiating with real config) */
+  getProviderMeta() {
+    return this.getProviderIds().map(id => {
+      const Adapter = this.providers.get(id);
+      const inst = new Adapter({}, {});
+      return {
+        id: inst.providerId,
+        displayName: inst.displayName,
+        capabilities: inst.getCapabilities()
+      };
+    });
+  }
+
+  /** 
+   * Get or create an adapter instance for the given provider + config
+   * @param {string} providerId - The provider to instantiate
+   * @param {Object} config - Provider-specific configuration
+   * @param {Object} ctx - Shared application context
+   * @returns {BaseDNSProvider} The provider adapter instance
+   */
+  getProvider(providerId, config, ctx) {
+    // Re-create if config changed
+    const cacheKey = providerId;
+    const Adapter = this.providers.get(providerId);
+    if (!Adapter) {
+      throw new Error(`Unknown DNS provider: ${providerId}. Available: ${this.getProviderIds().join(', ')}`);
+    }
+    const instance = new Adapter(config, ctx);
+    this.instances.set(cacheKey, instance);
+    return instance;
+  }
+
+  /** Auto-discover and register all providers in this directory */
+  autoDiscover() {
+    const fs = require('fs');
+    const dir = __dirname;
+    const files = fs.readdirSync(dir).filter(f => 
+      f !== 'base.js' && f !== 'registry.js' && f.endsWith('.js') && !f.startsWith('.')
+    );
+    for (const file of files) {
+      try {
+        const Loaded = require(path.join(dir, file));
+        // Support: module.exports = Class, module.exports = { Class }, or plain objects
+        let cls = null;
+        if (typeof Loaded === 'function') {
+          cls = Loaded;
+        } else if (typeof Loaded === 'object' && Loaded !== null) {
+          // Try to find a class in the exported object
+          cls = Object.values(Loaded).find(v => typeof v === 'function');
+        }
+        if (cls) {
+          // Verify it has providerId (on prototype or set in constructor)
+          try {
+            const test = new cls({}, {});
+            if (test.providerId && typeof test.getCapabilities === 'function') {
+              this.register(cls);
+            }
+          } catch {
+            // Not a valid provider adapter, skip
+          }
+        }
+      } catch (err) {
+        console.error(`Failed to load DNS provider from ${file}:`, err.message);
+      }
+    }
+  }
+}
+
+// Singleton
+const registry = new DNSProviderRegistry();
+registry.autoDiscover();
+
+module.exports = registry;
diff --git a/dashcaddy-api/dns-providers/rfc2136.js b/dashcaddy-api/dns-providers/rfc2136.js
new file mode 100644
index 0000000..f218c9a
--- /dev/null
+++ b/dashcaddy-api/dns-providers/rfc2136.js
@@ -0,0 +1,383 @@
+/**
+ * RFC 2136 Dynamic DNS Provider Adapter
+ *
+ * Manages DNS records via RFC 2136 dynamic updates using the nsupdate CLI tool.
+ * Compatible with BIND, PowerDNS, Windows DNS, and any RFC 2136-compliant server.
+ *
+ * Capabilities: create-record, delete-record, resolve, credentials
+ * Not supported: logs, restart, update-check, list-records, zones
+ */
+
+const { execFile } = require('child_process');
+const { promisify } = require('util');
+const dns = require('dns');
+const os = require('os');
+const path = require('path');
+const fs = require('fs');
+
+const execFileAsync = promisify(execFile);
+
+const BaseDNSProvider = require('./base');
+
+const CAPABILITIES = ['create-record', 'delete-record', 'resolve', 'credentials'];
+
+const DEFAULT_PORT = 53;
+const DEFAULT_TSIG_ALGORITHM = 'hmac-sha256';
+const NSUPDATE_TIMEOUT_MS = 15000;
+
+class RFC2136Provider extends BaseDNSProvider {
+  static providerId = 'rfc2136';
+  static displayName = 'RFC 2136 (Dynamic DNS)';
+
+  constructor(config, ctx) {
+    super(config, ctx);
+
+    this.providerId = 'rfc2136';
+    this.displayName = 'RFC 2136 (Dynamic DNS)';
+
+    // Core config
+    this.server = config.server || null;
+    this.port = config.port || DEFAULT_PORT;
+    this.zone = config.zone || null;
+
+    // TSIG authentication
+    this.tsigAlgorithm = config.tsigAlgorithm || DEFAULT_TSIG_ALGORITHM;
+    this.tsigKeyName = config.tsigKeyName || null;
+    this.tsigSecret = config.tsigSecret || null;
+
+    // Resolve credentials from credential manager if available
+    if (ctx && ctx.credentialManager) {
+      if (!this.tsigKeyName && ctx.credentialManager.get) {
+        this.tsigKeyName = ctx.credentialManager.get('rfc2136_tsigKeyName') || null;
+      }
+      if (!this.tsigSecret && ctx.credentialManager.get) {
+        this.tsigSecret = ctx.credentialManager.get('rfc2136_tsigSecret') || null;
+      }
+    }
+
+    // Logger shorthand
+    this._log = ctx && ctx.log ? ctx.ctx : null;
+  }
+
+  // ── Logging helper ────────────────────────────────────────────────────────
+
+  _log(level, message, meta) {
+    if (this.ctx && this.ctx.log && typeof this.ctx.log[level] === 'function') {
+      this.ctx.log[level](`[rfc2136] ${message}`, meta || {});
+    }
+  }
+
+  // ── Capabilities ──────────────────────────────────────────────────────────
+
+  supportsCapability(cap) {
+    return CAPABILITIES.includes(cap);
+  }
+
+  getCapabilities() {
+    return [...CAPABILITIES];
+  }
+
+  // ── Config validation ─────────────────────────────────────────────────────
+
+  validateConfig() {
+    const errors = [];
+    if (!this.server) errors.push('Missing required config: server');
+    if (!this.zone) errors.push('Missing required config: zone');
+    return { valid: errors.length === 0, errors };
+  }
+
+  // ── Helpers ───────────────────────────────────────────────────────────────
+
+  /**
+   * Ensure a domain name ends with a trailing dot (FQDN for nsupdate).
+   */
+  _ensureFqdn(domain) {
+    if (!domain) return domain;
+    return domain.endsWith('.') ? domain : `${domain}.`;
+  }
+
+  /**
+   * Build the common nsupdate header lines (server, zone, key).
+   */
+  _buildHeader() {
+    const lines = [];
+    lines.push(`server ${this.server} ${this.port}`);
+    lines.push(`zone ${this.zone}`);
+
+    if (this.tsigKeyName && this.tsigSecret) {
+      lines.push(`key ${this.tsigAlgorithm}:${this.tsigKeyName} ${this.tsigSecret}`);
+    }
+
+    return lines;
+  }
+
+  /**
+   * Execute an nsupdate script and return { stdout, stderr }.
+   * Writes commands to a temporary file and runs `nsupdate <file>`.
+   */
+  async _runNsupdate(commands) {
+    const script = commands.join('\n') + '\n';
+    const tmpFile = path.join(os.tmpdir(), `nsupdate-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.cmd`);
+
+    try {
+      await fs.promises.writeFile(tmpFile, script, { mode: 0o600 });
+      this._log('debug', `Executing nsupdate script`, { script: script.trim() });
+
+      const { stdout, stderr } = await execFileAsync('nsupdate', [tmpFile], {
+        timeout: NSUPDATE_TIMEOUT_MS,
+        maxBuffer: 1024 * 1024,
+      });
+
+      this._log('debug', 'nsupdate completed', { stdout: (stdout || '').trim(), stderr: (stderr || '').trim() });
+
+      if (stderr && stderr.toLowerCase().includes('refused')) {
+        throw new Error(`nsupdate refused: ${stderr.trim()}`);
+      }
+      if (stderr && stderr.toLowerCase().includes('failed')) {
+        throw new Error(`nsupdate failed: ${stderr.trim()}`);
+      }
+
+      return { stdout: (stdout || '').trim(), stderr: (stderr || '').trim() };
+    } catch (err) {
+      if (err.code === 'ENOENT') {
+        throw new Error('nsupdate command not found. Install bind9utils (Debian/Ubuntu) or bind-utils (RHEL/CentOS).');
+      }
+      throw err;
+    } finally {
+      try { await fs.promises.unlink(tmpFile); } catch (_) { /* ignore */ }
+    }
+  }
+
+  // ── Authenticate ──────────────────────────────────────────────────────────
+
+  /**
+   * Verify nsupdate is available and optionally test connectivity.
+   * Runs a minimal nsupdate with just "show" (no-op) to confirm the tool works.
+   */
+  async authenticate() {
+    const validation = this.validateConfig();
+    if (!validation.valid) {
+      throw new Error(`RFC 2136 config invalid: ${validation.errors.join('; ')}`);
+    }
+
+    // Check nsupdate binary is available with a dry-run command set
+    const commands = [
+      ...this._buildHeader(),
+      'show',
+    ];
+
+    try {
+      const { stdout } = await this._runNsupdate(commands);
+      this._log('info', 'Authenticated to RFC 2136 server', { server: this.server, port: this.port });
+      return { success: true, server: this.server, port: this.port };
+    } catch (err) {
+      this._log('error', 'Authentication test failed', { error: err.message });
+      // If nsupdate is missing, rethrow immediately
+      if (err.message.includes('not found')) throw err;
+      // Otherwise, the server might be unreachable but the tool works — return partial
+      return { success: false, error: err.message, server: this.server };
+    }
+  }
+
+  // ── Create Record ─────────────────────────────────────────────────────────
+
+  /**
+   * Create (add) a DNS record via RFC 2136 UPDATE.
+   *
+   * @param {Object} params
+   * @param {string} params.domain  - Record name (e.g. "www.example.com")
+   * @param {string} params.zone    - Zone name (overrides constructor zone)
+   * @param {string} params.type    - Record type (A, AAAA, CNAME, TXT, etc.)
+   * @param {string} params.value   - Record value
+   * @param {number} [params.ttl=300] - TTL in seconds
+   */
+  async createRecord({ domain, zone, type, value, ttl }) {
+    const effectiveZone = zone || this.zone;
+    const effectiveTtl = ttl || 300;
+    const fqdn = this._ensureFqdn(domain);
+
+    const commands = [
+      `server ${this.server} ${this.port}`,
+      `zone ${effectiveZone}`,
+    ];
+
+    if (this.tsigKeyName && this.tsigSecret) {
+      commands.push(`key ${this.tsigAlgorithm}:${this.tsigKeyName} ${this.tsigSecret}`);
+    }
+
+    commands.push(`update add ${fqdn} ${effectiveTtl} ${type} ${value}`);
+    commands.push('show');
+    commands.push('send');
+
+    this._log('info', 'Creating DNS record', { domain: fqdn, type, value, ttl: effectiveTtl });
+
+    const result = await this._runNsupdate(commands);
+
+    return {
+      success: true,
+      action: 'create-record',
+      domain: fqdn,
+      type,
+      value,
+      ttl: effectiveTtl,
+      zone: effectiveZone,
+      raw: result.stdout,
+    };
+  }
+
+  // ── Delete Record ─────────────────────────────────────────────────────────
+
+  /**
+   * Delete a DNS record via RFC 2136 UPDATE.
+   *
+   * @param {Object} params
+   * @param {string} params.domain - Record name
+   * @param {string} params.type   - Record type
+   * @param {string} [params.value] - Optional specific value to match
+   */
+  async deleteRecord({ domain, type, value }) {
+    const effectiveZone = this.zone;
+    const fqdn = this._ensureFqdn(domain);
+
+    const commands = [
+      `server ${this.server} ${this.port}`,
+      `zone ${effectiveZone}`,
+    ];
+
+    if (this.tsigKeyName && this.tsigSecret) {
+      commands.push(`key ${this.tsigAlgorithm}:${this.tsigKeyName} ${this.tsigSecret}`);
+    }
+
+    // "update delete" with value removes that specific RR;
+    // without value it removes all RRs of that type for the name.
+    const deleteClause = value
+      ? `update delete ${fqdn} ${type} ${value}`
+      : `update delete ${fqdn} ${type}`;
+
+    commands.push(deleteClause);
+    commands.push('show');
+    commands.push('send');
+
+    this._log('info', 'Deleting DNS record', { domain: fqdn, type, value: value || '(all)' });
+
+    const result = await this._runNsupdate(commands);
+
+    return {
+      success: true,
+      action: 'delete-record',
+      domain: fqdn,
+      type,
+      value: value || null,
+      zone: effectiveZone,
+      raw: result.stdout,
+    };
+  }
+
+  // ── Resolve Records ───────────────────────────────────────────────────────
+
+  /**
+   * Resolve DNS records for a domain.
+   * First attempts dig against the configured server, then falls back to Node dns module.
+   *
+   * @param {Object} params
+   * @param {string} params.domain - Domain to resolve
+   * @param {string} [params.zone] - Zone (unused for resolution, kept for interface consistency)
+   * @param {string} [params.type='A'] - Record type to query
+   */
+  async resolveRecords({ domain, zone, type }) {
+    const queryType = type || 'A';
+    const fqdn = domain.endsWith('.') ? domain : domain;
+
+    // Strategy 1: Use dig against the configured RFC 2136 server
+    try {
+      const { stdout } = await execFileAsync('dig', [
+        `@${this.server}`,
+        '-p', String(this.port),
+        fqdn,
+        queryType,
+        '+short',
+        '+time=5',
+        '+tries=1',
+      ], { timeout: 10000 });
+
+      const records = stdout
+        .split('\n')
+        .map(line => line.trim())
+        .filter(Boolean);
+
+      if (records.length > 0) {
+        this._log('debug', `Resolved ${fqdn} ${queryType} via dig`, { records });
+        return {
+          domain: fqdn,
+          type: queryType,
+          records: records.map(r => ({ value: r, type: queryType })),
+          source: 'dig',
+          server: this.server,
+        };
+      }
+    } catch (err) {
+      this._log('warn', 'dig resolution failed, falling back to Node dns', { error: err.message });
+    }
+
+    // Strategy 2: Fallback to Node.js built-in resolver
+    try {
+      const resolver = new dns.Resolver();
+      resolver.setServers([this.server]);
+
+      const resolveMethod = this._getResolveMethod(queryType);
+      const resolveAsync = promisify(resolver[resolveMethod]).bind(resolver);
+
+      const results = await resolveAsync(fqdn);
+      const records = Array.isArray(results) ? results : [results];
+
+      this._log('debug', `Resolved ${fqdn} ${queryType} via Node dns`, { records });
+
+      return {
+        domain: fqdn,
+        type: queryType,
+        records: records.map(r => ({ value: String(r), type: queryType })),
+        source: 'node-dns',
+        server: this.server,
+      };
+    } catch (err) {
+      this._log('warn', 'Node dns resolution also failed', { error: err.message });
+      return {
+        domain: fqdn,
+        type: queryType,
+        records: [],
+        source: 'none',
+        server: this.server,
+        error: err.message,
+      };
+    }
+  }
+
+  /**
+   * Map record type to the Node dns resolver method name.
+   */
+  _getResolveMethod(type) {
+    const map = {
+      A: 'resolve4',
+      AAAA: 'resolve6',
+      CNAME: 'resolveCname',
+      MX: 'resolveMx',
+      TXT: 'resolveTxt',
+      NS: 'resolveNs',
+      SOA: 'resolveSoa',
+      SRV: 'resolveSrv',
+      PTR: 'reverse',
+    };
+    return map[(type || '').toUpperCase()] || 'resolve4';
+  }
+
+  // ── Shutdown ──────────────────────────────────────────────────────────────
+
+  async shutdown() {
+    this._log('info', 'RFC 2136 provider shutting down');
+  }
+}
+
+// Expose providerId on the prototype so the registry's auto-discover can detect it
+RFC2136Provider.prototype.providerId = 'rfc2136';
+
+module.exports = RFC2136Provider;
diff --git a/dashcaddy-api/dns-providers/technitium.js b/dashcaddy-api/dns-providers/technitium.js
new file mode 100644
index 0000000..7f519cb
--- /dev/null
+++ b/dashcaddy-api/dns-providers/technitium.js
@@ -0,0 +1,507 @@
+/**
+ * Technitium DNS Server Provider Adapter
+ *
+ * Wraps Technitium-specific DNS logic into the standard adapter interface.
+ * Uses the Technitium HTTP API (default port 5380) for all operations.
+ */
+const BaseDNSProvider = require('./base');
+
+const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24-hour token lifetime
+
+class TechnitiumDNSProvider extends BaseDNSProvider {
+  constructor(config, ctx) {
+    super(config, ctx);
+    this.providerId = 'technitium';
+    this.displayName = 'Technitium DNS Server';
+
+    this.serverIp = config.serverIp;
+    this.serverPort = config.serverPort || 5380;
+    this.dnsId = config.dnsId || null;
+
+    // Token state
+    this.token = null;
+    this.tokenExpiry = null;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Capabilities
+  // ---------------------------------------------------------------------------
+
+  static CAPABILITIES = [
+    'create-record',
+    'delete-record',
+    'resolve',
+    'list-records',
+    'logs',
+    'restart',
+    'update-check',
+    'credentials',
+    'zones'
+  ];
+
+  supportsCapability(cap) {
+    return TechnitiumDNSProvider.CAPABILITIES.includes(cap);
+  }
+
+  getCapabilities() {
+    return [...TechnitiumDNSProvider.CAPABILITIES];
+  }
+
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+
+  /** Build the base URL for this server */
+  _baseUrl() {
+    return `http://${this.serverIp}:${this.serverPort}`;
+  }
+
+  /** Build a full API URL with query-string params */
+  _buildUrl(apiPath, params = {}) {
+    const qs = new URLSearchParams(params).toString();
+    return `${this._baseUrl()}${apiPath}${qs ? '?' + qs : ''}`;
+  }
+
+  /** Ensure we have a valid token; throws on failure */
+  async _requireToken() {
+    // Re-use existing token if still valid
+    if (this.token && this.tokenExpiry && new Date() < new Date(this.tokenExpiry)) {
+      return this.token;
+    }
+    const result = await this.authenticate();
+    if (!result.success) {
+      const err = new Error('No valid DNS token available. ' + (result.error || ''));
+      err.statusCode = 401;
+      throw err;
+    }
+    return this.token;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Authentication
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Authenticate against the Technitium server.
+   * Checks per-server credentials first (dns.{dnsId}.readonly.username),
+   * then falls back to global credentials (dns.username).
+   *
+   * Stores token + expiry on success.
+   */
+  async authenticate() {
+    const { credentialManager, log } = this.ctx;
+
+    // Try per-server credentials first
+    if (this.dnsId) {
+      for (const role of ['readonly', 'admin']) {
+        try {
+          const username = await credentialManager.retrieve(`dns.${this.dnsId}.${role}.username`);
+          const password = await credentialManager.retrieve(`dns.${this.dnsId}.${role}.password`);
+          if (username && password) {
+            const result = await this._doLogin(username, password);
+            if (result.success) return result;
+          }
+        } catch (err) {
+          log.error('technitium', `Per-server ${role} credential error`, {
+            dnsId: this.dnsId,
+            error: err.message
+          });
+        }
+      }
+    }
+
+    // Fall back to global credentials
+    try {
+      const username = await credentialManager.retrieve('dns.username');
+      const password = await credentialManager.retrieve('dns.password');
+      if (username && password) {
+        return await this._doLogin(username, password);
+      }
+    } catch (err) {
+      log.error('technitium', 'Global credential error', { error: err.message });
+    }
+
+    return {
+      success: false,
+      error: 'No DNS credentials configured. Please set up credentials via /api/dns/credentials'
+    };
+  }
+
+  /**
+   * Perform the actual login POST to Technitium.
+   * Stores token on success.
+   */
+  async _doLogin(username, password) {
+    const { fetchT, log } = this.ctx;
+
+    try {
+      const params = new URLSearchParams({
+        user: username,
+        pass: password,
+        includeInfo: 'false'
+      });
+
+      const url = `${this._baseUrl()}/api/user/login?${params.toString()}`;
+      const response = await fetchT(url, {
+        method: 'POST',
+        headers: {
+          'Accept': 'application/json',
+          'Content-Type': 'application/x-www-form-urlencoded'
+        }
+      });
+
+      const result = await response.json();
+
+      if (result.status === 'ok' && result.token) {
+        this.token = result.token;
+        this.tokenExpiry = new Date(Date.now() + SESSION_TTL_MS).toISOString();
+        log.info('technitium', 'DNS token obtained', {
+          server: this.serverIp,
+          expires: this.tokenExpiry
+        });
+        return { success: true, token: this.token };
+      }
+
+      return { success: false, error: result.errorMessage || 'Login failed' };
+    } catch (error) {
+      log.error('technitium', 'Login error', { error: error.message });
+      return { success: false, error: error.message };
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Record Management
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Create (or overwrite) a DNS record.
+   * GET /api/zones/records/add?token=...&domain=...&zone=...&type=...&ipAddress=...&ttl=...&overwrite=...
+   */
+  async createRecord({ domain, zone, type, value, ttl, overwrite }) {
+    const token = await this._requireToken();
+    const { fetchT, log } = this.ctx;
+
+    const params = {
+      token,
+      domain,
+      zone,
+      type: type || 'A',
+      ipAddress: value,
+      ttl: String(ttl || 300),
+      overwrite: String(overwrite !== false)
+    };
+
+    try {
+      log.info('technitium', 'Creating DNS record', { domain, type, value });
+      const url = this._buildUrl('/api/zones/records/add', params);
+      const response = await fetchT(url, {
+        method: 'GET',
+        headers: { 'Accept': 'application/json' }
+      });
+      const result = await response.json();
+
+      if (result.status === 'ok') {
+        log.info('technitium', 'DNS record created', { domain, type, value });
+        return { success: true };
+      }
+
+      // If token expired, re-authenticate and retry once
+      if (result.errorMessage && result.errorMessage.toLowerCase().includes('token')) {
+        log.info('technitium', 'Token expired, re-authenticating');
+        this.token = null;
+        this.tokenExpiry = null;
+        const retryToken = await this._requireToken();
+        params.token = retryToken;
+        const retryUrl = this._buildUrl('/api/zones/records/add', params);
+        const retryResp = await fetchT(retryUrl, {
+          method: 'GET',
+          headers: { 'Accept': 'application/json' }
+        });
+        const retryResult = await retryResp.json();
+        if (retryResult.status === 'ok') {
+          return { success: true };
+        }
+        throw new Error(retryResult.errorMessage || 'Failed after token refresh');
+      }
+
+      throw new Error(result.errorMessage || 'Unknown error');
+    } catch (error) {
+      throw new Error(`Failed to create DNS record for ${domain}: ${error.message}`);
+    }
+  }
+
+  /**
+   * Delete a DNS record.
+   * GET /api/zones/records/delete?token=...&domain=...&type=...  (+ ipAddress if value provided)
+   */
+  async deleteRecord({ domain, type, value }) {
+    const token = await this._requireToken();
+    const { fetchT, log } = this.ctx;
+
+    const params = {
+      token,
+      domain,
+      type: type || 'A'
+    };
+    if (value) {
+      params.ipAddress = value;
+    }
+
+    try {
+      log.info('technitium', 'Deleting DNS record', { domain, type, value });
+      const url = this._buildUrl('/api/zones/records/delete', params);
+      const response = await fetchT(url, {
+        method: 'GET',
+        headers: { 'Accept': 'application/json' }
+      });
+      const result = await response.json();
+
+      if (result.status === 'ok') {
+        log.info('technitium', 'DNS record deleted', { domain, type, value });
+        return { success: true };
+      }
+
+      throw new Error(result.errorMessage || 'Unknown error');
+    } catch (error) {
+      throw new Error(`Failed to delete DNS record for ${domain}: ${error.message}`);
+    }
+  }
+
+  /**
+   * Resolve/query records for a domain in a zone.
+   * GET /api/zones/records/get?token=...&domain=...&zone=...&listZone=true
+   * Filters returned records by type if provided.
+   */
+  async resolveRecords({ domain, zone, type }) {
+    const token = await this._requireToken();
+    const { fetchT, log } = this.ctx;
+
+    const params = {
+      token,
+      domain,
+      zone,
+      listZone: 'true'
+    };
+
+    try {
+      log.info('technitium', 'Resolving records', { domain, zone, type });
+      const url = this._buildUrl('/api/zones/records/get', params);
+      const response = await fetchT(url, {
+        method: 'GET',
+        headers: { 'Accept': 'application/json' }
+      });
+      const result = await response.json();
+
+      if (result.status !== 'ok') {
+        throw new Error(result.errorMessage || 'Failed to resolve records');
+      }
+
+      let records = (result.response && result.response.records) || [];
+
+      // Filter by type if specified
+      if (type) {
+        records = records.filter(r => r.type === type);
+      }
+
+      return { success: true, records };
+    } catch (error) {
+      throw new Error(`Failed to resolve records for ${domain}: ${error.message}`);
+    }
+  }
+
+  /**
+   * List all records in a zone.
+   * Delegates to resolveRecords with a wildcard domain.
+   */
+  async listRecords({ zone }) {
+    return this.resolveRecords({ domain: zone, zone, type: null });
+  }
+
+  // ---------------------------------------------------------------------------
+  // Logs
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Fetch and parse DNS query logs.
+   * 1. GET /api/logs/list to discover the latest log file
+   * 2. GET /api/logs/download?token=...&fileName=... to download it
+   * 3. Parse text format: [timestamp] [client:port] [protocol] QNAME: domain; QTYPE: type; QCLASS: class; RCODE: rcode; ANSWER: [answer]
+   */
+  async getLogs({ limit, server } = {}) {
+    const token = await this._requireToken();
+    const { fetchT, log } = this.ctx;
+
+    const targetIp = server || this.serverIp;
+    const targetPort = this.serverPort;
+    const baseUrl = `http://${targetIp}:${targetPort}`;
+
+    try {
+      // Step 1: Get log file list
+      const listUrl = this._buildUrl('/api/logs/list', { token });
+      const listResp = await fetchT(listUrl.replace(this._baseUrl(), baseUrl), {
+        method: 'GET',
+        headers: { 'Accept': 'application/json' }
+      });
+      const listResult = await listResp.json();
+
+      if (listResult.status !== 'ok' || !listResult.response || !listResult.response.length) {
+        throw new Error(listResult.errorMessage || 'No log files found');
+      }
+
+      // Pick the latest log file (last entry)
+      const logFile = listResult.response[listResult.response.length - 1];
+      const fileName = logFile.name || logFile.fileName || logFile;
+
+      // Step 2: Download the log file
+      const downloadUrl = `${baseUrl}/api/logs/download?${new URLSearchParams({ token, fileName }).toString()}`;
+      const downloadResp = await fetchT(downloadUrl, {
+        method: 'GET'
+      });
+      const logText = await downloadResp.text();
+
+      // Step 3: Parse lines
+      const parsed = this._parseLogText(logText, limit);
+      return { success: true, logs: parsed };
+    } catch (error) {
+      log.error('technitium', 'Failed to fetch DNS logs', { error: error.message });
+      throw new Error(`Failed to get DNS logs: ${error.message}`);
+    }
+  }
+
+  /**
+   * Parse Technitium DNS log text format.
+   * Line format: [timestamp] [client:port] [protocol] QNAME: domain; QTYPE: type; QCLASS: class; RCODE: rcode; ANSWER: [answer]
+   */
+  _parseLogText(text, limit) {
+    const lines = text.split('\n').filter(l => l.trim());
+    const parsed = [];
+
+    // Process newest first if we need to limit
+    const iterable = limit ? lines.slice(-limit).reverse() : lines;
+
+    for (const line of iterable) {
+      try {
+        const entry = {};
+
+        // Extract timestamp: [2024-01-15 10:30:45]
+        const tsMatch = line.match(/\[([^\]]+)\]/);
+        if (tsMatch) entry.timestamp = tsMatch[1];
+
+        // Extract client:port: [192.168.1.100:12345]
+        const clientMatch = line.match(/\[([^\]]+:\d+)\]/g);
+        if (clientMatch && clientMatch.length >= 2) {
+          entry.client = clientMatch[1].replace(/\[|\]/g, '');
+        }
+
+        // Extract protocol: [UDP] or [TCP]
+        const protoMatch = line.match(/\]\s*\[(UDP|TCP|DoH|DoT|DoH2)\]/i);
+        if (protoMatch) entry.protocol = protoMatch[1];
+
+        // Extract key-value pairs: QNAME: value; QTYPE: value; etc.
+        const kvPattern = /(\w+):\s*([^;]+)/g;
+        let match;
+        while ((match = kvPattern.exec(line)) !== null) {
+          const key = match[1];
+          const val = match[2].trim();
+          if (['QNAME', 'QTYPE', 'QCLASS', 'RCODE'].includes(key)) {
+            entry[key.toLowerCase()] = val;
+          } else if (key === 'ANSWER') {
+            entry.answer = val;
+          }
+        }
+
+        entry.raw = line;
+        parsed.push(entry);
+      } catch {
+        // Skip unparseable lines
+      }
+    }
+
+    return parsed;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Server Management
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Restart the DNS server.
+   * POST /api/admin/restart?token=...
+   * Requires admin credentials.
+   */
+  async restartServer({ server } = {}) {
+    const token = await this._requireToken();
+    const { fetchT, log } = this.ctx;
+
+    try {
+      log.info('technitium', 'Restarting DNS server', { server: this.serverIp });
+      const url = this._buildUrl('/api/admin/restart', { token });
+      const response = await fetchT(url, {
+        method: 'POST',
+        headers: { 'Accept': 'application/json' }
+      });
+      const result = await response.json();
+
+      if (result.status === 'ok') {
+        log.info('technitium', 'DNS server restart initiated');
+        return { success: true, message: 'Server restart initiated' };
+      }
+
+      throw new Error(result.errorMessage || 'Restart failed');
+    } catch (error) {
+      log.error('technitium', 'DNS restart error', { error: error.message });
+      throw new Error(`Failed to restart DNS server: ${error.message}`);
+    }
+  }
+
+  /**
+   * Check for DNS server updates.
+   * GET /api/user/checkForUpdate?token=...
+   */
+  async checkUpdate({ server } = {}) {
+    const token = await this._requireToken();
+    const { fetchT, log } = this.ctx;
+
+    try {
+      log.info('technitium', 'Checking for DNS server update', { server: this.serverIp });
+      const url = this._buildUrl('/api/user/checkForUpdate', { token });
+      const response = await fetchT(url, {
+        method: 'GET',
+        headers: { 'Accept': 'application/json' }
+      });
+      const result = await response.json();
+
+      if (result.status === 'ok') {
+        return {
+          success: true,
+          updateAvailable: !!(result.response && result.response.updateAvailable),
+          latestVersion: (result.response && result.response.latestVersion) || null,
+          currentVersion: (result.response && result.response.currentVersion) || null,
+          response: result.response
+        };
+      }
+
+      throw new Error(result.errorMessage || 'Update check failed');
+    } catch (error) {
+      log.error('technitium', 'Update check error', { error: error.message });
+      throw new Error(`Failed to check for updates: ${error.message}`);
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Config Validation
+  // ---------------------------------------------------------------------------
+
+  validateConfig() {
+    const errors = [];
+    if (!this.serverIp) {
+      errors.push('serverIp is required');
+    }
+    if (this.serverPort && (typeof this.serverPort !== 'number' || this.serverPort < 1 || this.serverPort > 65535)) {
+      errors.push('serverPort must be a valid port number (1-65535)');
+    }
+    return { valid: errors.length === 0, errors };
+  }
+}
+
+module.exports = TechnitiumDNSProvider;
diff --git a/dashcaddy-api/package.json b/dashcaddy-api/package.json
index 001a88c..bcb7743 100644
--- a/dashcaddy-api/package.json
+++ b/dashcaddy-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dashcaddy-api",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "DashCaddy API server - Dashboard backend for Docker, Caddy & DNS management",
   "main": "server.js",
   "scripts": {
diff --git a/dashcaddy-api/routes/apps/deploy.js b/dashcaddy-api/routes/apps/deploy.js
index c884c81..c7329ef 100644
--- a/dashcaddy-api/routes/apps/deploy.js
+++ b/dashcaddy-api/routes/apps/deploy.js
@@ -316,7 +316,7 @@ module.exports = function({ docker, caddy, credentialManager, servicesStateManag
       let dnsWarning = null;
       if (config.createDns && !isSubdirectoryMode) {
         try {
-          await ctx.dns.createRecord(config.subdomain, config.ip);
+          await ctx.dns.universalCreateRecord(config.subdomain, config.ip);
           log.info('deploy', 'DNS record created', { domain: ctx.buildDomain(config.subdomain), ip: config.ip });
         } catch (dnsError) {
           await logError('app-deploy-dns', dnsError, { appId, subdomain: config.subdomain, ip: config.ip });
diff --git a/dashcaddy-api/routes/apps/removal.js b/dashcaddy-api/routes/apps/removal.js
index 1e000a0..fff073f 100644
--- a/dashcaddy-api/routes/apps/removal.js
+++ b/dashcaddy-api/routes/apps/removal.js
@@ -71,18 +71,13 @@ module.exports = function({
       if (shouldDeleteContainer && subdomain && ctx.dns.getToken()) {
         try {
           const domain = ctx.buildDomain(subdomain);
-          const getResult = await ctx.dns.call(ctx.siteConfig.dnsServerIp, '/api/zones/records/get', {
-            token: ctx.dns.getToken(), domain, zone: ctx.siteConfig.tld.replace(/^\./, ''), listZone: 'true'
-          });
+          const resolveResult = await ctx.dns.universalResolveRecord(domain, 'A');
           let recordIp = ip || 'localhost';
-          if (getResult.status === 'ok' && getResult.response?.records) {
-            const aRecord = getResult.response.records.find(r => r.type === 'A');
-            if (aRecord && aRecord.rData?.ipAddress) recordIp = aRecord.rData.ipAddress;
+          if (resolveResult) {
+            recordIp = resolveResult;
           }
-          const dnsResult = await ctx.dns.call(ctx.siteConfig.dnsServerIp, '/api/zones/records/delete', {
-            token: ctx.dns.getToken(), domain, type: 'A', ipAddress: recordIp
-          });
-          results.dns = dnsResult.status === 'ok' ? 'deleted' : (dnsResult.errorMessage || 'failed');
+          await ctx.dns.universalDeleteRecord(domain, recordIp);
+          results.dns = 'deleted';
           log.info('dns', 'DNS record removal', { result: results.dns });
         } catch (error) {
           results.dns = error.message;
diff --git a/dashcaddy-api/routes/apps/restore.js b/dashcaddy-api/routes/apps/restore.js
index 7c9d2f4..b05d130 100644
--- a/dashcaddy-api/routes/apps/restore.js
+++ b/dashcaddy-api/routes/apps/restore.js
@@ -458,7 +458,7 @@ module.exports = function({ docker, caddy, servicesStateManager, asyncHandler, e
     // DNS record
     if (manifest.config.createDns && manifest.caddy.routingMode !== 'subdirectory') {
       try {
-        await ctx.dns.createRecord(manifest.config.subdomain, manifest.config.ip);
+        await ctx.dns.universalCreateRecord(manifest.config.subdomain, manifest.config.ip);
         log.info('restore', 'DNS record recreated', { subdomain: manifest.config.subdomain });
       } catch (e) {
         log.warn('restore', `DNS recreation failed: ${e.message}`);
diff --git a/dashcaddy-api/routes/apps/templates.js b/dashcaddy-api/routes/apps/templates.js
index d073082..d6047c5 100644
--- a/dashcaddy-api/routes/apps/templates.js
+++ b/dashcaddy-api/routes/apps/templates.js
@@ -107,10 +107,8 @@ module.exports = function({
     if (oldSubdomain && ctx.dns.getToken()) {
       try {
         const oldDomain = oldSubdomain.includes('.') ? oldSubdomain : ctx.buildDomain(oldSubdomain);
-        const result = await ctx.dns.call(ctx.siteConfig.dnsServerIp, '/api/zones/records/delete', {
-          token: ctx.dns.getToken(), domain: oldDomain, type: 'A', ipAddress: ip || 'localhost'
-        });
-        results.oldDns = result.status === 'ok' ? 'deleted' : result.errorMessage;
+        await ctx.dns.universalDeleteRecord(oldDomain, ip || 'localhost');
+        results.oldDns = 'deleted';
         log.info('dns', 'Old DNS record deleted', { domain: oldDomain });
       } catch (error) {
         results.oldDns = `failed: ${error.message}`;
@@ -120,7 +118,7 @@ module.exports = function({
 
     if (newSubdomain && ctx.dns.getToken()) {
       try {
-        await ctx.dns.createRecord(newSubdomain, ip || 'localhost');
+        await ctx.dns.universalCreateRecord(newSubdomain, ip || 'localhost');
         results.newDns = 'created';
         log.info('dns', 'New DNS record created', { domain: ctx.buildDomain(newSubdomain) });
       } catch (error) {
diff --git a/dashcaddy-api/routes/dns.js b/dashcaddy-api/routes/dns.js
index 0cf4951..2a8ef7b 100644
--- a/dashcaddy-api/routes/dns.js
+++ b/dashcaddy-api/routes/dns.js
@@ -42,7 +42,137 @@ module.exports = function({
     return serverIp;
   }
 
-  // DELETE /record — Delete a DNS record from Technitium
+  // ===== DNS PROVIDER ENDPOINTS =====
+
+  // GET /providers — List all available DNS providers
+  router.get('/providers', asyncHandler(async (req, res) => {
+    const providers = dns.getAvailableProviders ? dns.getAvailableProviders() : [];
+    const activeProvider = dns.getProviderId ? dns.getProviderId() : 'technitium';
+    success(res, { providers, activeProvider });
+  }, 'dns-providers-list'));
+
+  // GET /provider/status — Get active provider status
+  router.get('/provider/status', asyncHandler(async (req, res) => {
+    if (!dns.getActiveProvider) {
+      return success(res, { providerId: 'technitium', capabilities: ['create-record', 'delete-record', 'resolve', 'list-records', 'logs', 'restart', 'update-check', 'credentials', 'zones'] });
+    }
+    try {
+      const provider = dns.getActiveProvider();
+      const status = await provider.getStatus();
+      success(res, status);
+    } catch (err) {
+      errorResponse(res, safeErrorMessage(err), 500);
+    }
+  }, 'dns-provider-status'));
+
+  // ===== UNIVERSAL RECORD ENDPOINTS (work with any provider) =====
+
+  // POST /universal/record — Create a DNS record via any provider
+  router.post('/universal/record', asyncHandler(async (req, res) => {
+    if (!dns.getActiveProvider) {
+      // Fallback to legacy Technitium route
+      return res.redirect(307, '/api/dns/record');
+    }
+    const { domain, ip, ttl, type, server } = req.body;
+    if (!domain || !ip) throw new ValidationError('domain and ip are required');
+    if (!REGEX.DOMAIN.test(domain)) throw new ValidationError('[DC-301] Invalid domain format');
+    if (!validatorLib.isIP(ip)) throw new ValidationError('[DC-210] Invalid IP address');
+
+    try {
+      const provider = dns.getActiveProvider();
+      if (!provider.supportsCapability('create-record')) {
+        const result = await provider.createRecord({
+          domain, zone: siteConfig.tld?.replace(/^\./, '') || '',
+          type: type || 'A', value: ip, ttl: ttl || 300, overwrite: true
+        });
+        return success(res, {
+          message: result.message || `DNS record instructions provided`,
+          manual: true,
+          instructions: result.instructions
+        });
+      }
+
+      const result = await provider.createRecord({
+        domain, zone: siteConfig.tld?.replace(/^\./, '') || '',
+        type: type || 'A', value: ip, ttl: ttl || 300, overwrite: true
+      });
+
+      // Start propagation check in background
+      if (dnsPropagationChecker && ip) {
+        dnsPropagationChecker.startVerification(domain, ip).catch(err => {
+          log('DNS propagation check start failed:', err.message);
+        });
+      }
+
+      success(res, {
+        message: result.status === 'manual' ? result.message : `DNS record ${domain} -> ${ip} created`,
+        provider: dns.getProviderId(),
+        ...(result.instructions ? { manual: true, instructions: result.instructions } : {})
+      });
+    } catch (error) {
+      log.error('dns', 'Universal DNS record creation error', { error: error.message });
+      errorResponse(res, safeErrorMessage(error), 500);
+    }
+  }, 'dns-universal-create'));
+
+  // DELETE /universal/record — Delete a DNS record via any provider
+  router.delete('/universal/record', asyncHandler(async (req, res) => {
+    if (!dns.getActiveProvider) {
+      return res.redirect(307, '/api/dns/record');
+    }
+    const { domain, type, value } = req.query;
+    if (!domain) throw new ValidationError('domain is required');
+    if (!REGEX.DOMAIN.test(domain)) throw new ValidationError('[DC-301] Invalid domain format');
+
+    try {
+      const provider = dns.getActiveProvider();
+      const result = await provider.deleteRecord({
+        domain, type: type || 'A', value
+      });
+
+      success(res, {
+        message: result.status === 'manual' ? result.message : `DNS record ${domain} deleted`,
+        provider: dns.getProviderId(),
+        ...(result.instructions ? { manual: true, instructions: result.instructions } : {})
+      });
+    } catch (error) {
+      log.error('dns', 'Universal DNS record deletion error', { error: error.message });
+      errorResponse(res, safeErrorMessage(error), 500);
+    }
+  }, 'dns-universal-delete'));
+
+  // GET /universal/resolve — Resolve a domain via any provider
+  router.get('/universal/resolve', asyncHandler(async (req, res) => {
+    if (!dns.getActiveProvider) {
+      return res.redirect(307, '/api/dns/resolve');
+    }
+    const { domain, type } = req.query;
+    if (!domain) throw new ValidationError('domain is required');
+    if (!REGEX.DOMAIN.test(domain)) throw new ValidationError('[DC-301] Invalid domain format');
+
+    try {
+      const provider = dns.getActiveProvider();
+      const result = await provider.resolveRecords({
+        domain, zone: siteConfig.tld?.replace(/^\./, '') || '',
+        type: type || 'A'
+      });
+
+      if (result.response?.records?.length > 0) {
+        const ipAddresses = result.response.records
+          .filter(r => r.type === (type || 'A'))
+          .map(r => r.rData?.ipAddress || r.content || r.rData?.address)
+          .filter(Boolean);
+        success(res, { answer: ipAddresses });
+      } else {
+        throw new NotFoundError('No records found for domain');
+      }
+    } catch (error) {
+      log.error('dns', 'Universal DNS resolve error', { error: error.message });
+      errorResponse(res, safeErrorMessage(error), error.statusCode || 500);
+    }
+  }, 'dns-universal-resolve'));
+
+  // ===== LEGACY TECHNITIUM-SPECIFIC ROUTES (unchanged) =====
   router.delete('/record', asyncHandler(async (req, res) => {
     const { domain, type, token, server, ipAddress } = req.query;
 
@@ -203,8 +333,13 @@ module.exports = function({
     }
   }, 'dns-resolve'));
 
-  // GET /logs — Fetch DNS query logs from Technitium
+  // GET /logs — Fetch DNS query logs (Technitium only)
   router.get('/logs', asyncHandler(async (req, res) => {
+    // Capability gate: logs are provider-specific
+    if (dns.supportsCapability && !dns.supportsCapability('logs')) {
+      return success(res, { server: 'N/A', count: 0, logs: [], message: 'DNS logs not supported by current provider' });
+    }
+
     const { server, limit } = req.query;
 
     if (!server) {
@@ -484,8 +619,13 @@ module.exports = function({
     success(res, { message: 'DNS credentials removed' });
   }, 'dns-credentials-delete'));
 
-  // POST /restart/:dnsId — Restart a DNS server (proxied through backend for auth)
+  // POST /restart/:dnsId — Restart a DNS server (Technitium only)
   router.post('/restart/:dnsId', asyncHandler(async (req, res) => {
+    // Capability gate
+    if (dns.supportsCapability && !dns.supportsCapability('restart')) {
+      return errorResponse(res, 'Server restart not supported by current DNS provider', 501);
+    }
+
     const { dnsId } = req.params;
     const serverInfo = siteConfig.dnsServers?.[dnsId];
     if (!serverInfo?.ip) {
@@ -527,8 +667,13 @@ module.exports = function({
     }
   }, 'dns-refresh-token'));
 
-  // GET /check-update — Check for Technitium DNS server updates
+  // GET /check-update — Check for DNS server updates (Technitium only)
   router.get('/check-update', asyncHandler(async (req, res) => {
+    // Capability gate
+    if (dns.supportsCapability && !dns.supportsCapability('update-check')) {
+      return success(res, { updateAvailable: false, message: 'Update check not supported by current DNS provider' });
+    }
+
     try {
       const { server } = req.query;
       if (!server) {
@@ -585,10 +730,13 @@ module.exports = function({
     }
   }, 'dns-check-update'));
 
-  // POST /update — Update Technitium DNS server
-  // Note: Technitium v14+ has no installUpdate API. This endpoint checks for updates
-  // and returns download info. The frontend handles showing update instructions.
+  // POST /update — Update DNS server (Technitium only)
   router.post('/update', asyncHandler(async (req, res) => {
+    // Capability gate
+    if (dns.supportsCapability && !dns.supportsCapability('update-check')) {
+      return errorResponse(res, 'Server update not supported by current DNS provider', 501);
+    }
+
     try {
       const { server } = req.query;
       if (!server) {
diff --git a/dashcaddy-api/routes/services.js b/dashcaddy-api/routes/services.js
index 29dfce1..9a1dbca 100644
--- a/dashcaddy-api/routes/services.js
+++ b/dashcaddy-api/routes/services.js
@@ -520,9 +520,8 @@ module.exports = function({
 
     if (oldSubdomain !== newSubdomain) {
       try {
-        const dnsToken = dns.getToken();
-        await dns.call(siteConfig.dnsServerIp, '/api/zones/records/delete', { token: dnsToken, domain: oldDomain, type: 'A' });
-        await dns.createRecord(newSubdomain, ip || 'localhost');
+        await dns.universalDeleteRecord(oldDomain);
+        await dns.universalCreateRecord(newSubdomain, ip || 'localhost');
         results.dns = 'updated';
       } catch (e) {
         results.dns = `failed: ${e.message}`;
diff --git a/dashcaddy-api/routes/sites.js b/dashcaddy-api/routes/sites.js
index 89557f9..e66eceb 100644
--- a/dashcaddy-api/routes/sites.js
+++ b/dashcaddy-api/routes/sites.js
@@ -205,7 +205,7 @@ module.exports = function({ asyncHandler, caddy, dns, fetchT, buildDomain, addSe
 
       if (createDns) {
         try {
-          await dns.createRecord(subdomain, siteConfig.dnsServerIp);
+          await dns.universalCreateRecord(subdomain, siteConfig.dnsServerIp);
           log.info('dns', 'DNS record created for external proxy', { domain, ip: siteConfig.dnsServerIp });
         } catch (dnsError) {
           dnsWarning = `DNS creation failed: ${dnsError.message}. You may need to create the DNS record manually.`;
diff --git a/dashcaddy-api/src/context/dns.js b/dashcaddy-api/src/context/dns.js
index 7dec976..c91988a 100644
--- a/dashcaddy-api/src/context/dns.js
+++ b/dashcaddy-api/src/context/dns.js
@@ -1,8 +1,14 @@
 /**
  * DNS context - Technitium DNS operations and token management
+ * 
+ * DEPRECATED: This module is kept for backward compatibility.
+ * New code should use src/context/provider-dns.js which supports multiple providers.
+ * 
+ * This module now delegates to the provider system internally.
  */
 const { TIMEOUTS, SESSION_TTL, CADDY } = require('../../constants');
 const { createCache, CACHE_CONFIGS } = require('../../cache-config');
+const { createProviderDnsContext } = require('./provider-dns');
 
 // DNS token management
 let dnsToken = process.env.DNS_ADMIN_TOKEN || '';
@@ -281,6 +287,10 @@ function invalidateTokenForServer(serverIp) {
 }
 
 function createDnsContext(siteConfig, buildDomain, credentialManager, fetchT, httpsAgent, log, DNS_CREDENTIALS_FILE) {
+  // Create the new provider-aware context
+  const providerCtx = createProviderDnsContext(siteConfig, buildDomain, credentialManager, fetchT, httpsAgent, log, DNS_CREDENTIALS_FILE);
+
+  // Legacy Technitium-specific wrappers (kept for backward compat)
   const ensureToken = () => ensureValidDnsToken(siteConfig, credentialManager, fetchT, log);
   const require = (providedToken) => requireDnsToken(providedToken, siteConfig, credentialManager, fetchT, log);
   const getForServer = (server, role) => getTokenForServer(server, siteConfig, credentialManager, fetchT, log, role);
@@ -289,6 +299,7 @@ function createDnsContext(siteConfig, buildDomain, credentialManager, fetchT, ht
   const call = (server, apiPath, params) => callDns(server, apiPath, params, fetchT, httpsAgent);
 
   return {
+    // Legacy Technitium-specific interface (unchanged)
     call,
     buildUrl: buildDnsUrl,
     requireToken: require,
@@ -302,6 +313,17 @@ function createDnsContext(siteConfig, buildDomain, credentialManager, fetchT, ht
     invalidateTokenForServer,
     refresh,
     credentialsFile: DNS_CREDENTIALS_FILE,
+
+    // Provider-aware methods (new)
+    getProviderId: providerCtx.getProviderId,
+    getActiveProvider: providerCtx.getActiveProvider,
+    getAvailableProviders: providerCtx.getAvailableProviders,
+    supportsCapability: providerCtx.supportsCapability,
+
+    // Universal DNS helpers (delegated to provider context)
+    universalCreateRecord: providerCtx.universalCreateRecord,
+    universalDeleteRecord: providerCtx.universalDeleteRecord,
+    universalResolveRecord: providerCtx.universalResolveRecord,
   };
 }
 
diff --git a/dashcaddy-api/src/context/provider-dns.js b/dashcaddy-api/src/context/provider-dns.js
new file mode 100644
index 0000000..8753054
--- /dev/null
+++ b/dashcaddy-api/src/context/provider-dns.js
@@ -0,0 +1,302 @@
+/**
+ * Provider-aware DNS Context
+ * Replaces the Technitium-only context with a provider-agnostic layer.
+ * Delegates to the active DNS provider adapter based on config.
+ *
+ * Falls back to legacy Technitium context for backward compatibility
+ * when no provider is explicitly configured.
+ */
+const { createCache, CACHE_CONFIGS } = require('../../cache-config');
+const { TIMEOUTS, SESSION_TTL, CADDY } = require('../../constants');
+const registry = require('../../dns-providers/registry');
+
+// Per-server token cache (legacy Technitium)
+const dnsServerTokens = createCache(CACHE_CONFIGS.dnsTokens);
+let dnsToken = '';
+let dnsTokenExpiry = null;
+
+/**
+ * Create a provider-aware DNS context.
+ * This wraps both the new provider system and the legacy Technitium context
+ * for seamless migration.
+ */
+function createProviderDnsContext(siteConfig, buildDomain, credentialManager, fetchT, httpsAgent, log, DNS_CREDENTIALS_FILE) {
+  /** Resolve the active provider from config */
+  function getProviderId() {
+    // New explicit provider field
+    if (siteConfig.dns?.provider) return siteConfig.dns.provider;
+    // Legacy: if dns.ip is set, default to technitium
+    if (siteConfig.dnsServerIp || siteConfig.dns?.ip) return 'technitium';
+    // No DNS configured
+    return 'manual';
+  }
+
+  /** Get provider-specific config from site config */
+  function getProviderConfig(providerId) {
+    const dnsConfig = siteConfig.dns || {};
+
+    switch (providerId) {
+      case 'technitium':
+        return {
+          serverIp: siteConfig.dnsServerIp || dnsConfig.ip || '',
+          serverPort: siteConfig.dnsServerPort || dnsConfig.port || '5380',
+          dnsServers: siteConfig.dnsServers || {},
+          dnsId: Object.keys(siteConfig.dnsServers || {})[0] || 'dns1'
+        };
+      case 'cloudflare':
+        return {
+          apiToken: dnsConfig.apiToken || '',
+          zoneId: dnsConfig.zoneId || '',
+          domain: siteConfig.domain || ''
+        };
+      case 'rfc2136':
+        return {
+          server: dnsConfig.server || siteConfig.dnsServerIp || '',
+          port: dnsConfig.port || 53,
+          zone: siteConfig.tld?.replace(/^\./, '') || '',
+          tsigAlgorithm: dnsConfig.tsigAlgorithm || 'hmac-sha256',
+          tsigKeyName: dnsConfig.tsigKeyName || '',
+          tsigSecret: dnsConfig.tsigSecret || ''
+        };
+      case 'manual':
+        return {};
+      default:
+        return dnsConfig;
+    }
+  }
+
+  /** Get or create the active provider adapter */
+  function getActiveProvider() {
+    const providerId = getProviderId();
+    const config = getProviderConfig(providerId);
+    const ctx = { log, credentialManager, fetchT, httpsAgent };
+    return registry.getProvider(providerId, config, ctx);
+  }
+
+  // ===== Legacy Technitium helpers (kept for backward compat) =====
+  function buildDnsUrl(server, apiPath, params) {
+    const protocol = server.match(/^\d+\.\d+\.\d+\.\d+$/) ? 'http' : 'https';
+    const port = protocol === 'http' ? `:${CADDY.DEFAULT_DNS_PORT}` : '';
+    const qs = params instanceof URLSearchParams ? params.toString() : new URLSearchParams(params).toString();
+    return `${protocol}://${server}${port}${apiPath}?${qs}`;
+  }
+
+  async function callDns(server, apiPath, params) {
+    const url = buildDnsUrl(server, apiPath, params);
+    const response = await fetchT(url, {
+      method: 'GET',
+      headers: { 'Accept': 'application/json' },
+      agent: httpsAgent
+    }, TIMEOUTS.HTTP_LONG);
+    return response.json();
+  }
+
+  async function refreshDnsToken(username, password, server) {
+    try {
+      const params = new URLSearchParams({ user: username, pass: password, includeInfo: 'false' });
+      const response = await fetchT(
+        `http://${server}:5380/api/user/login?${params.toString()}`,
+        { method: 'POST', headers: { 'Accept': 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' }, timeout: 10000 }
+      );
+      const result = await response.json();
+      if (result.status === 'ok' && result.token) {
+        dnsToken = result.token;
+        dnsTokenExpiry = new Date(Date.now() + SESSION_TTL.DNS_TOKEN).toISOString();
+        log.info('dns', 'DNS token refreshed', { expires: dnsTokenExpiry });
+        return { success: true, token: dnsToken };
+      }
+      return { success: false, error: result.errorMessage || 'Login failed' };
+    } catch (error) {
+      log.error('dns', 'DNS token refresh error', { error: error.message });
+      return { success: false, error: error.message };
+    }
+  }
+
+  function dnsIpToDnsId(serverIp) {
+    for (const [dnsId, info] of Object.entries(siteConfig.dnsServers || {})) {
+      if (info.ip === serverIp) return dnsId;
+    }
+    return null;
+  }
+
+  async function ensureValidDnsToken() {
+    if (dnsToken && dnsTokenExpiry && new Date() < new Date(dnsTokenExpiry)) {
+      return { success: true, token: dnsToken };
+    }
+    const primaryIp = siteConfig.dnsServerIp;
+    if (primaryIp) {
+      const dnsId = dnsIpToDnsId(primaryIp);
+      if (dnsId) {
+        for (const role of ['admin', 'readonly']) {
+          try {
+            const username = await credentialManager.retrieve(`dns.${dnsId}.${role}.username`);
+            const password = await credentialManager.retrieve(`dns.${dnsId}.${role}.password`);
+            if (username && password) return await refreshDnsToken(username, password, primaryIp);
+          } catch (err) { /* try next */ }
+        }
+      }
+    }
+    try {
+      const username = await credentialManager.retrieve('dns.username');
+      const password = await credentialManager.retrieve('dns.password');
+      const server = await credentialManager.retrieve('dns.server');
+      if (username && password) return await refreshDnsToken(username, password, server || primaryIp);
+    } catch (err) { /* no global creds */ }
+    return { success: false, error: 'No DNS credentials configured' };
+  }
+
+  async function getTokenForServer(targetServer, role = 'readonly') {
+    const cacheKey = `${targetServer}:${role}`;
+    const cached = dnsServerTokens.get(cacheKey);
+    if (cached?.token && cached?.expiry && new Date() < new Date(cached.expiry)) {
+      return { success: true, token: cached.token };
+    }
+    const serverPort = siteConfig.dnsServerPort || '5380';
+    async function authToServer(username, password) {
+      const params = new URLSearchParams({ user: username, pass: password, includeInfo: 'false' });
+      const response = await fetchT(
+        `http://${targetServer}:${serverPort}/api/user/login?${params.toString()}`,
+        { method: 'POST', headers: { 'Accept': 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' } }
+      );
+      const result = await response.json();
+      if (result.status === 'ok' && result.token) {
+        dnsServerTokens.set(cacheKey, { token: result.token, expiry: new Date(Date.now() + SESSION_TTL.DNS_TOKEN).toISOString() });
+        log.info('dns', 'DNS token obtained for server', { server: targetServer, role });
+        return { success: true, token: result.token };
+      }
+      return { success: false, error: result.errorMessage || 'Login failed' };
+    }
+    const dnsId = dnsIpToDnsId(targetServer);
+    if (dnsId) {
+      for (const r of [role, role === 'readonly' ? 'admin' : 'readonly']) {
+        try {
+          const username = await credentialManager.retrieve(`dns.${dnsId}.${r}.username`);
+          const password = await credentialManager.retrieve(`dns.${dnsId}.${r}.password`);
+          if (username && password) return await authToServer(username, password);
+        } catch { /* try next */ }
+      }
+    }
+    try {
+      const username = await credentialManager.retrieve('dns.username');
+      const password = await credentialManager.retrieve('dns.password');
+      if (username && password) return await authToServer(username, password);
+    } catch { /* no global creds */ }
+    return { success: false, error: 'No DNS credentials configured' };
+  }
+
+  async function requireDnsToken(providedToken) {
+    if (providedToken) return providedToken;
+    const result = await ensureValidDnsToken();
+    if (result.success) return result.token;
+    const err = new Error('No valid DNS token available. ' + result.error);
+    err.statusCode = 401;
+    throw err;
+  }
+
+  function invalidateTokenForServer(serverIp) {
+    dnsServerTokens.delete(`${serverIp}:readonly`);
+    dnsServerTokens.delete(`${serverIp}:admin`);
+  }
+
+  // ===== Public context API =====
+  // This maintains the same interface as the old createDnsContext()
+  // but adds provider-aware methods on top.
+
+  return {
+    // --- Provider-aware methods ---
+    /** Get the active provider ID */
+    getProviderId,
+
+    /** Get the active provider adapter instance */
+    getActiveProvider,
+
+    /** Get metadata for all available providers */
+    getAvailableProviders: () => registry.getProviderMeta(),
+
+    /** Check if the active provider supports a capability */
+    supportsCapability: (cap) => {
+      try { return getActiveProvider().supportsCapability(cap); }
+      catch { return false; }
+    },
+
+    // --- Legacy Technitium context (backward compat) ---
+    call: callDns,
+    buildUrl: buildDnsUrl,
+    requireToken: requireDnsToken,
+    ensureToken: ensureValidDnsToken,
+    getToken: () => dnsToken,
+    setToken: (t) => { dnsToken = t; },
+    getTokenExpiry: () => dnsTokenExpiry,
+    setTokenExpiry: (e) => { dnsTokenExpiry = e; },
+    getTokenForServer,
+    invalidateTokenForServer,
+    refresh: refreshDnsToken,
+    credentialsFile: DNS_CREDENTIALS_FILE,
+
+    // --- Universal DNS helpers (provider-agnostic) ---
+
+    /**
+     * Create a DNS A record using the active provider.
+     * Gracefully handles manual adapters that return instructions instead of performing the action.
+     */
+    async universalCreateRecord(subdomain, ip) {
+      const provider = getActiveProvider();
+      const result = await provider.createRecord({
+        domain: buildDomain(subdomain),
+        zone: siteConfig.tld?.replace(/^\./, '') || '',
+        type: 'A',
+        value: ip,
+        ttl: 300,
+        overwrite: true,
+      });
+      // Manual adapter returns instructions instead of performing the action
+      if (result?.manual || result?.instructions) {
+        return { success: true, manual: true, instructions: result.instructions || result };
+      }
+      return result;
+    },
+
+    /**
+     * Delete a DNS A record using the active provider.
+     * Gracefully handles manual adapters that return instructions instead of performing the action.
+     */
+    async universalDeleteRecord(domain, ip) {
+      const provider = getActiveProvider();
+      const result = await provider.deleteRecord({
+        domain,
+        type: 'A',
+        value: ip,
+      });
+      if (result?.manual || result?.instructions) {
+        return { success: true, manual: true, instructions: result.instructions || result };
+      }
+      return result;
+    },
+
+    /**
+     * Resolve DNS records using the active provider.
+     * Returns parsed IP addresses from the result.
+     */
+    async universalResolveRecord(domain, type) {
+      const provider = getActiveProvider();
+      const result = await provider.resolveRecords({
+        domain,
+        zone: siteConfig.tld?.replace(/^\./, '') || '',
+        type: type || 'A',
+      });
+      // Parse IP addresses from the result
+      if (Array.isArray(result)) {
+        return result;
+      }
+      if (result?.records) {
+        return result.records.map(r => r.ipAddress || r.value || r.address || r).filter(Boolean);
+      }
+      if (result?.ips) {
+        return result.ips;
+      }
+      return result;
+    },
+  };
+}
+
+module.exports = { createProviderDnsContext };
diff --git a/status/index.html b/status/index.html
index 70b3d40..1a50ca5 100644
--- a/status/index.html
+++ b/status/index.html
@@ -393,8 +393,14 @@
           <!-- DNS Server Configuration -->
           <div>
             <label class="form-label-accent">
-              🗂️ DNS Server (Technitium)
+              🗂️ DNS Provider
             </label>
+            <select id="setup-dns-provider" class="form-input-lg" style="margin-bottom: 12px;">
+              <option value="technitium">Technitium DNS (recommended)</option>
+              <option value="cloudflare">Cloudflare DNS</option>
+              <option value="rfc2136">RFC 2136 (BIND / PowerDNS / other)</option>
+              <option value="manual">Manual / External DNS</option>
+            </select>
             <div style="display: grid; grid-template-columns: 1fr auto; gap: 8px;">
               <input type="text" id="setup-dns-ip" value="" placeholder="DNS server IP"
                      style="padding: 12px; background: var(--card-bg); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; font-size: 1rem;" />
@@ -409,7 +415,7 @@
           <!-- DNS Admin Token -->
           <div>
             <label class="form-label-accent">
-              🔑 Technitium Admin Token
+              🔑 DNS Admin Token / API Key
             </label>
             <input type="password" id="setup-dns-token" placeholder="Paste your admin token here"
                    class="form-input-lg" />
diff --git a/status/js/dns-template-selector.js b/status/js/dns-template-selector.js
index d0f03a8..613509a 100644
--- a/status/js/dns-template-selector.js
+++ b/status/js/dns-template-selector.js
@@ -95,6 +95,36 @@
             'Prometheus metrics'
           ],
           recommended: false
+        },
+        {
+          id: 'cloudflare',
+          name: 'Cloudflare DNS',
+          description: 'Managed DNS with API access — no self-hosting needed',
+          icon: '🔶',
+          difficulty: 'Easy',
+          features: [
+            'Fully managed, no server needed',
+            'API for automated record management',
+            'Global anycast network',
+            'Free tier available'
+          ],
+          recommended: false,
+          providerId: 'cloudflare'
+        },
+        {
+          id: 'external',
+          name: 'External / Manual DNS',
+          description: 'Use your own DNS provider (cPanel, Route53, etc.)',
+          icon: '🔗',
+          difficulty: 'Easy',
+          features: [
+            'Works with any DNS provider',
+            'DashCaddy shows you what records to create',
+            'Propagation checking still works',
+            'No API credentials needed'
+          ],
+          recommended: false,
+          providerId: 'manual'
         }
       ];
     }
diff --git a/status/js/setup-wizard.js b/status/js/setup-wizard.js
index 3a94f27..e125891 100644
--- a/status/js/setup-wizard.js
+++ b/status/js/setup-wizard.js
@@ -174,8 +174,9 @@ window.populateTimezoneSelect = function(selectEl, selectedTz) {
     if (currentConfigType === 'homelab') {
       config.tld = document.getElementById('setup-tld')?.value?.trim() || '.home';
       config.caName = document.getElementById('setup-ca-name')?.value?.trim() || '';
+      const selectedProvider = document.getElementById('setup-dns-provider')?.value || 'technitium';
       config.dns = {
-        provider: 'technitium',
+        provider: selectedProvider,
         ip: document.getElementById('setup-dns-ip')?.value?.trim() || '',
         port: document.getElementById('setup-dns-port')?.value?.trim() || DC.DEFAULTS.DNS_PORT,
         token: document.getElementById('setup-dns-token')?.value?.trim() || ''