OAuth token responses now include a space-separated scope value showing the permissions granted to the access token. Read and store this value after a code, device, or refresh-token exchange so your integration can use the permissions the token actually has.

OpenID Connect ID tokens now include the nonce from the authorization request when you provide one. ID tokens issued with an access token also include at_hash, and hybrid responses that include an authorization code include c_hash. Your integration can validate these claims to tie the ID token to the original request and its associated credentials.

Integrations can use POST /api/v1/domains/list with a domains array of names or IDs to retrieve up to 100 matching domains in one request. This helps refresh a known set of domains without fetching each one separately; only domains in the selected team are returned.

Select active domains in the Domains list and use Enable transfer lock or Disable transfer lock from the bulk actions menu. Domain Chief schedules the supported changes for the selected domains; check each domain for a pending registry update.

For domains whose registry allows it, the Authorization Code section now lets you regenerate the code before transferring out. Regenerating invalidates the previous code; for other domains, use Sync to retrieve the current registry code instead.

You can now register .example domains to try Domain Chief's registration, transfer, contact, DNS, nameserver, and lock workflows without buying a public domain. These test names have no registration or renewal cost and do not resolve on the public internet.

Under Settings → Expiry Reminder Preference, each team member can choose a Monday summary for domains renewing or expiring in the next 14 days, or individual emails seven days before each domain's date.

The public pricing page now includes a calculator for comparing regular renewal prices with member prices and the membership cost. Add your domain extensions and quantities to estimate whether membership would save your portfolio money each year.

The main dashboard now includes a Servers table showing request activity by host. Select a server from the dashboard to open its traffic view, then use All servers to return to the team-wide view.

Each team member can now choose which domain activity emails to receive under Settings → Activity Notifications. Turn them all off or select individual events for this team; the choice affects only your inbox. Expiration reminders and invoice emails continue separately.

The team dashboard and individual server dashboards now let you choose a time range and narrow the traffic to proxied, blocked, rate-limited, or logged requests. The graph and summary tables update together, making it easier to compare a particular outcome over a chosen period.

The Contact filter in the Domains list now finds domains using a selected contact in any supported role, rather than only as the owner. Use it to review every domain affected before changing or retiring a shared contact.

When FlowGuard loads TLS certificates from an NGINX configuration, it now watches the referenced certificate and key files as well as the configuration files. A renewal or file replacement can be picked up automatically without editing the NGINX configuration or restarting FlowGuard.

When a Stream filter has few recent matches, FlowGuard now searches successive windows of retained logs until it finds matching requests or reaches the oldest available data. Results appear as they are found, and Stream shows how far back it has searched.

On a monitored domain, select edit beside the current HTTP check path to choose which endpoint Cert Chief checks, such as /health. Saving the path starts a new HTTP check.

Domain Connect templates can now include CAA records. Services that use CAA to control certificate issuance can include them in the DNS setup their customers review and approve in Domain Chief.

Hosted DNS now supports ALIAS records, allowing the zone root to point to a hostname where a CNAME cannot be used. Choose ALIAS when adding a record and provide the target hostname.

DNS lookup now validates DNSSEC signatures and shows whether the returned records are signed and valid, unsigned, or fail validation. Use the result when checking a domain's DNSSEC configuration.

Integrations can retrieve structured DNS lookup results with GET https://dns.chief.tools/api/lookup. Supply a domain in query and comma-separated record types in type; set include_log=true when you also need the lookup trace.

DNS lookup can now request multiple record types in one lookup and follow CNAME targets outside the original domain. This helps you inspect a domain's related records and the destination behind an alias in one result.