Zonemaster 2026.1.2

In the AWS Marketplace listing, choose Continue to Subscribe, then choose Continue to Configuration. Pick Zonemaster 2026.1.2 on Ubuntu 24.04 as the software version, pick your Region, then choose Launch through EC2. Choose m5.large, your key pair and a security group as described above. The container uses about 300 MiB of memory, so several domain tests run comfortably side by side.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=zonemaster}]'

Connect over SSH. For Zonemaster 2026.1.2 on Ubuntu 24.04, the SSH user is ubuntu:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes under a minute. It creates the certificate and the password, starts the Zonemaster container against a fresh results database, and only then lets nginx start. Afterwards, every unit is active and the container is up, published on loopback only. Check with:

systemctl is-active docker zonemaster nginx zonemaster-firstboot
sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
sudo docker image ls --format '{{.Repository}}:{{.Tag}}'

active active active active NAMES STATUS PORTS zonemaster Up 5 minutes 127.0.0.1:8080->80/tcp sac/zonemaster-all-in-one:2026.1.2

Run the port check to see which ports the instance exposes:

sudo /usr/local/sbin/zonemaster-port-check.sh

off-box TCP exactly [22 80 443]; Zonemaster on loopback 8080; backend :5000 not on the host ZONEMASTER_PORTS_OK

This is the complete network surface of a new instance: SSH, the HTTPS front door and the HTTP redirect.

First boot writes this instance's web address, the user name and its password to a file that only root can read:

sudo cat /root/zonemaster-credentials.txt

# Zonemaster 2026.1.2 on Ubuntu 24.04 (sac)
# Generated on this instance's first boot. These credentials are unique to THIS instance. Keep this file secret. # Zonemaster has no login of its own: nginx requires this HTTP Basic credential for the web GUI and the JSON-RPC API. ZONEMASTER_URL=https://<public-dns-name>/ ZONEMASTER_API=https://<public-dns-name>/api/ ZONEMASTER_USER=admin ZONEMASTER_PASSWORD=<ZONEMASTER_PASSWORD> ...

None of these values exists in the image. Your instance creates the password and the certificate on its first boot. The host name is your instance's public DNS name, or its IP address when it has none. Step 10 shows how to use your own.

Without the password, the GUI and the API are both refused. Port 80 only redirects to HTTPS on your configured host name. To confirm, run:

curl -sk -o /dev/null -w 'no password: %{http_code}\n' https://127.0.0.1/en/
curl -sk -o /dev/null -w 'API without password: %{http_code}\n' -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"version_info"}' https://127.0.0.1/api/
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' http://127.0.0.1/en/

no password: 401 API without password: 401 port 80: 301 -> https://<public-dns-name>/en/

Open https://<public-dns-name>/ in your browser. The certificate is self-signed until you install your own (Step 10), so your browser asks you to accept it once. It then prompts for a user name and password. Sign in as admin with the password from Step 5. You land on the Zonemaster domain checkup page.

Type a domain, for example zonemaster.net, and select Run test. Zonemaster walks the delegation from the root to the domain's own name servers. Usually within a minute, it shows the graded report.

The Filter severity levels row counts the findings as Info, Notice, Warning, Error and Critical, so you can see the health of the zone at a glance. Show options lets you test IPv4 or IPv6 only. It also lets you test a domain that is not yet delegated, by giving its name servers and DS records yourself.

Below the summary, the findings are grouped by test module. Each module carries badges with its per-severity counts and expands to show every test case with its message. Expand all modules opens them all, and the search box finds a specific message. History lists earlier tests of the same domain, and Export downloads the report.

Internationalised domain names work too. Enter them in their native script (for example räksmörgås.se) and Zonemaster tests the punycode form.

The backend that powers the GUI is a JSON-RPC API at https://<public-dns-name>/api/, behind the same login. The commands on this page read the password from your credentials file. They hand it to curl as a configuration file on its standard input (-K -), so it never appears on a command line or in your shell history. Ask for the component versions:

zm_auth() {
sudo sed -n 's/^ZONEMASTER_PASSWORD=\(.*\)/user = "admin:\1"/p' /root/zonemaster-credentials.txt; } zm_auth | curl -sk -K - -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"version_info"}' https://127.0.0.1/api/ | jq -c .result

{"zonemaster_ldns":"5.1.0","zonemaster_backend":"12.1.1","zonemaster_engine":"v9.0.1"}

Start a test and wait for test_progress to reach 100. Then fetch the graded results and count them by severity:

zm_auth() {
sudo sed -n 's/^ZONEMASTER_PASSWORD=\(.*\)/user = "admin:\1"/p' /root/zonemaster-credentials.txt; } zm_rpc() { zm_auth | curl -sk -K - -H 'Content-Type: application/json' -d "$1" https://127.0.0.1/api/; }
ID=$(zm_rpc '{"jsonrpc":"2.0","id":1,"method":"start_domain_test","params":{"domain":"iis.se","ipv4":true,"ipv6":false}}' | jq -r .result)
echo "test id: $ID" until [ "$(zm_rpc "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"test_progress\",\"params\":{\"test_id\":\"$ID\"}}" | jq -r .result)" = 100 ]; do sleep 5; done zm_rpc "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"get_test_results\",\"params\":{\"id\":\"$ID\",\"language\":\"en\"}}" \
  | jq -r '.result.results | group_by(.level) | map("\(.[0].level): \(length)") | .[]'

test id: fe364f3c94d0da29 INFO: 78 NOTICE: 1

Each result carries its module, testcase, level and a human-readable message. The same test is visible in the GUI at https://<public-dns-name>/en/result/<test id>.

From your own workstation, call the API as curl -k -u admin https://<public-dns-name>/api/ ..., which prompts for the password. The full method list is in the Zonemaster Backend API documentation at doc.zonemaster.net.

The image carries a self-test that proves the whole front door. It checks that no password and the usual weak passwords are refused for the GUI and the API, that your instance's password works, that a real domain test returns a graded report, and that the container's own ports are refused on the network address. Run it with:

sudo /usr/local/sbin/zonemaster-roundtrip.sh

no credential and weak credentials refused (401 from the nginx Basic gate) for the GUI and the API per-instance credential -> GUI 200 and JSON-RPC version_info (Engine v9.0.1, Backend 12.1.1, LDNS 5.1.0) zonemaster.net: graded report with 84 results across 10 test modules; :5000/:8080 refused on <private-ip> ZONEMASTER_LOGIN_OK

Create a DNS record for your instance (for example zonemaster.example.com), then serve Zonemaster under that name. The helper creates a new certificate for the name and pins nginx, the cross-origin guard and the host the container sees to it:

sudo zonemaster-set-hostname zonemaster.example.com

The helper remembers the name in /etc/sac/zonemaster-hostname. To use a certificate from your own certificate authority, replace /etc/ssl/zonemaster/zonemaster.crt and /etc/ssl/zonemaster/zonemaster.key (keep the key 0600 root) and run sudo systemctl reload nginx.

sudo zonemaster-set-password creates a new random password and updates /root/zonemaster-credentials.txt. sudo zonemaster-set-password --stdin reads a password you choose (12 or more characters) from standard input. nginx picks up the new password on the next request.

sudo zonemaster-set-password

Zonemaster sends queries to whatever name servers a test points it at. The image drops any container traffic to the instance metadata service in Docker's DOCKER-USER firewall chain. systemd also denies Docker, the Zonemaster unit and nginx access to it. To check, run:

sudo iptables -S DOCKER-USER
sudo docker exec zonemaster perl -MHTTP::Tiny -e 'print "metadata from inside the container: ", HTTP::Tiny->new(timeout => 5)->get("http://169.254.169.254/latest/meta-data/")->{status}, "\n"'

-N DOCKER-USER -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP metadata from inside the container: 599

599 means the connection never completed. The instance itself still uses IMDSv2 normally, and first boot reads its host name from it.

The image's build record lists the upstream container digest, the image that runs, and every package and module brought up to its security release. Read the first lines with:

sed -n '1,5p' /usr/share/doc/sac/zonemaster/BUILD-PROVENANCE.txt

Zonemaster 2026.1.2 on Ubuntu 24.04 - sac build provenance ===================================================================== Upstream product release : Zonemaster v2026.1.2 (Engine v9.0.1, CLI v8.0.3, Backend v12.1.1, LDNS v5.1.0, GUI v5.1.0) Upstream container : zonemaster/all-in-one@sha256:ba35602d29298c1bbd9c121ea8e6f3d1fe9f73d11d1440bae57df86e310e0ada (zonemaster/all-in-one:v5.1.0-2, linux/amd64, 2026-10-01) Runtime image : sac/zonemaster-all-in-one:2026.1.2 id sha256:<image-id> (one layer)

• Ubuntu and Docker receive security updates automatically through unattended-upgrades.
• Zonemaster is the pinned 2026.1.2 container. SecureAnyCloud publishes a new version of this listing when a new Zonemaster release, or a security update to its container, is needed. Test results live in the Docker volume zonemaster_db. Launch the new version when you want to move, and keep the old instance until you no longer need its history.