Download Global DNS – Multiple Server – DNS Propagation Checker – WP v3.3.0

List of improvements in Global DNS – Multiple Server – DNS Propagation Checker – WP version 3.3.0

• All notable changes to the Global DNS WordPress Plugin will be documented in this file.
• The format is based on [Keep a Changelog]( and this project adheres to [Semantic Versioning](

## [3.3.0] 2026-05-11


### Added


• DKIM record checker: shortcodes `global_dns_dkim_input` and `global_dns_dkim`; REST `POST /global-dns/v1/dkim/{selector}/{domain}`; raw TXT plus parsed tags.
• Propagation toolbar: export CSV/JSON and **Copy share link*(outline-style actions; share uses admin primary color); time-limited snapshots (`POST /global-dns/v1/propagation/share`); read-only `GET …/propagation/share/{uuid}`; shortcode `global_dns_propagation_share_view` with `?global_dns_share={uuid}`.
• Database table for snapshots, daily cron prune, uninstall cleanup.
• Admin: **Verify TLS for DNS probe URLs**, **HTTP connect timeout**, **Propagation share TTL (days)**, **Propagation share button*(show or hide “Copy share link” on the server list), **DKIM checker shortcut*(toolbar link when DKIM form exists on page).
• Shared `Global_Dns_Dns_Input_Validator`, `Global_Dns_Http_Probe`, `Global_Dns_Rate_Limiter`; rate limits (transient buckets) for DNS propagation fetch, propagation share create, and `global_dns_throttle_contact()` for third-party contact forms.

### Changed


• Remote DNS probe calls use hardened HTTP client (timeouts, connect timeout, optional TLS verify).
• IP lookup (on-site tool) uses the same HTTP client with TLS verification always on; HTTPS ip-api endpoint.
• `dig` execution prefers `proc_open` with existing `escapeshellarg` command line; falls back to `shell_exec`.

### Fixed


• DMARC input partial corrupted docblock repaired; safer JSON/options output.
• Deactivation now clears propagation cron and removes `global_dns` capability (was incorrectly removing unrelated cap).
• Propagation UI: clearer per-server errors from REST; URL hash uses `encodeURIComponent` for domain/type deep links; minimal export/share toolbar (admin primary color on Copy share link).
• Repaired `clearResults` / map reset when the map is absent.
• REST propagation and related calls: base64 domain segments are URL-safe (`encodeURIComponent` + server decode); `X-WP-Nonce` sent on REST POSTs for better compatibility.
• Hostname normalization (`Global_Dns_Dns_Input_Validator::normalize_hostname_input`) fixed regex delimiter clash that broke domain parsing and caused false “invalid domain” errors.
• Creating share snapshots returns **403*when the share button is disabled in settings.

### Removed


• Unused duplicate `public/js/global-dns-public-jquery.min.js` (only `global-dns-public-jquery.js` is registered).

### Housekeeping


• Removed scaffold “demonstration purposes” comment blocks from public and admin enqueue methods; shortened the public jQuery file header; fixed admin “Timeout” label typo.

## [3.2.0] 2025-08-04


### 🔐 Security


• **CRITICAL**: Fixed command injection vulnerability in DNS record lookup functionality
• **HIGH**: Added comprehensive input validation for all API endpoints
• **HIGH**: Fixed DNS injection vulnerabilities in DMARC, SPF, and WHOIS APIs
• **MEDIUM**: Resolved XSS vulnerabilities in shortcode template files
• **MEDIUM**: Fixed SSRF vulnerability in IP lookup API
• **MEDIUM**: Added validation for blacklist checker API

### 🛡️ Added


• **New Security Functions**:
• `sanitizeDomain()` Validates and sanitizes domain name inputs
• `sanitizeDnsType()` Whitelist validation for DNS record types
• `sanitizeDnsServer()` Validates DNS server IP addresses and hostnames

### 🔧 Changed


• **API Security Improvements**:
• All base64 decoded inputs are now validated before processing
• DNS queries now use sanitized and validated parameters
• External API calls include proper input validation
• Shell commands now use `escapeshellarg()` for parameter escaping
• **Template Security**:
• CSS color values are now properly escaped with `esc_attr()`
• JavaScript variables are sanitized with `esc_js()`
• All user-controlled output is properly escaped

### 🐛 Fixed


• Fixed potential command execution through malicious DNS server parameters