# CPalius CMF 2.2.0

**Released:** 2026-09-22 · **Channel:** stable · **Critical:** no

Turkish: [2.2.0-tr.md](2.2.0-tr.md)

This release ships DNS Tools as a first-class module: a public catalogue of diagnostics, header search, keyed REST, Studio per-tool SEO, and a one-shot inbox for spam scoring. Studio also gains a rebuild desk. Sitemap sources are tagged so a module can contribute URLs without a core edit.

## What's new

**DNS Tools.** Fifty-plus public tools under `/dns-tools`: lookup, mail policy, SSL, IP, generators. Each tool has its own SEO page. Probes never use `shell_exec`. Private, loopback and metadata targets are rejected. SMTP never sends mail. AXFR never returns zone contents.

**Studio catalogue.** Operators can enable or disable a tool, override titles and meta, and pick a forum board for "ask this field". Disabled tools 404 and leave the sitemap.

**Header search.** `SearchProviderInterface` now includes enabled DNS tools by title, slug and keywords.

**Spam score inbox.** Each visit can mint `t{hex}@catch-all`. Mail arrives through signed JSON at `/hooks/dnstools.inbound-mail`, `.eml` files in `var/dnstools-inbox`, or optional IMAP. A pasted raw source still scores without a mailbox. Score is 0–10 from SPF/DKIM/DMARC, PTR and DNSBL. Raw mail is dropped after scoring.

**Keyed REST.** `GET /api/dns-tools` is public. `GET|POST /api/dns-tools/{slug}` needs `dnstools.query` and an API key. The browser route stays CSRF-protected.

**Studio rebuild desk.** Cache, blog categories and forum counters rebuild in batches instead of one long request.

**Tagged sitemaps.** `SeoSitemapSourceInterface` is collected with a tagged iterator. DnsTools publishes `/sitemap-dnstools-{locale}.xml`.

**Login return path.** After sign-in the visitor lands on the page they asked for, not a hardcoded home.

## Fixes

**Settings seeder no longer trips the N+1 guard.** Missing DnsTools keys are loaded in one `IN (...)` query.

**Forum new-topic prefills the title only.** "Ask this field" opens a board picker, then the compose form with an empty body.

## Upgrade notes

**Activate DnsTools.** `cp-core/config/active_modules.php` already lists it in this zip. After the panel update, open Studio → DNS Tools once so defaults seed. Then empty `cp-core/var/cache/prod/` (leave the folder).

**Catch-all is optional.** Spam score works as paste-only until you set a catch-all domain and webhook secret in Studio.

**If you deploy by FTP rather than through the panel,** clear `cp-core/var/cache/prod/` after uploading — leave the folder, empty its contents. Upload `public/themes/cpalius-website/dist/` as well.

## Known limits

**The inbox does not create mailboxes on the internet.** You must point MX at a catch-all you control.

**DKIM is not cryptographically verified here.** Pass/fail is read from Authentication-Results when present; otherwise only DNS existence is claimed.

**Hcms and Hosting are not in this zip.** They remain local work and are not activated.