What's new — September 2026

We've shipped a big batch of improvements across security, integrations, billing, DNS, infrastructure, and more — here's what's new.

✨ New

• Control Cloudflare from Automations: purge cache, set security level (including Under Attack mode), toggle Development Mode and Always Online, with pre-built templates and OAuth or API-token support on paid plans.
• Toggle individual registrar operations per account: switch nameservers, contacts, DNSSEC, transfer lock, WHOIS privacy, and auto-renew on or off for each domain connection, with disabled operations greyed out and refused everywhere.
• Add a personal security phrase to sensitive emails: set a custom phrase in Profile → Security and we'll include it in alerts, billing notices, password resets, and sign-in codes so you can spot fakes.
• Verify new devices by email: sign in without 2FA and receive a one-time code via email on unrecognised browsers, with automatic remembering for future logins from that device.
• Sign in with Microsoft: Entra ID joins Google and GitHub as a sign-in option, supporting work or school accounts that already use Microsoft 365.
• Verify your email domains with one DNS record: prove control via Settings → Sign-in with a single TXT record (added automatically if the zone is in your account), letting verified-domain colleagues join your organization.
• Require approval for new organization members: people signing in with addresses on verified domains can now request to join, with administrators deciding who is added instead of automatic entry.
• Search, register, and transfer domains on one unified page: paste a list, search once, and add whatever you want from the results—registrations and transfers happen automatically based on availability without upfront selection.
• Compare prices across all registrars for each domain: search multiple extensions at once and see every registrar's pricing per name, both first-year and renewal, in your organisation's currency with honest 'Cheapest' badges.
• Check transfer eligibility before starting: transfers now verify lock status, 60-day registration lock, expiry safety, and WHOIS privacy email reachability upfront, with fixes for each issue and no blocking.
• Recover deleted items within 14 days: Monitors, automations, dashboards, alert destinations, maintenance windows, templates, tags, roles, custom fields, and status pages can be restored from Recently deleted or via the undo message.
• Import and export DNS zones as standard zone files: download zones in the universally-read format or upload one back, with a preview showing what will be added, what already exists, and what the provider rejects.
• Track cost history and actual spending: see what prices used to be, why they changed, and how much you have actually spent versus current rates.
• Find unused reserved IP addresses eating your budget: the IP addresses tab under Servers now lists every address in its own right, highlighting unattached ones and their monthly cost to surface forgotten test infrastructure.
• Keep your plan when the trial ends: choose 'Continue after the trial' in Settings → Plan to add a card and auto-continue on the trial end date without upfront charges, with the option to switch plans or cancel anytime before then.
• Find credit notes in your billing history: credit notes now appear in Settings → Invoices alongside the original invoices they cancel, showing the amount and download button for accounting records.
• Rename a volume to match your provider's panel: click a volume's name in its header to change it (where the provider allows, with DigitalOcean volumes staying as created and InfraNest noting the limitation).

⚡ Improved

• Integrations stop retrying failed operations: when a registrar denies access, we now disable that operation automatically instead of repeatedly erroring, with a one-click re-test to re-enable once permissions are fixed.
• Emails now match your region: all InfraNest emails share one cleaner design with dates, numbers, and amounts formatted to your language and region preferences.
• Drop your password entirely with passkeys: sign in with passkeys only once you have a non-phishable backup (a second passkey or 2FA enabled), preventing lockout from a single lost device.
• One alert per broken connection instead of per attempt: failing integrations now send a single alert stating what broke, what's out of date, and whether action is needed, with occasional reminders instead of a stream, plus a one-click 24-hour mute.
• Archive domains instead of deleting them: Archive replaces Delete to keep your DNS zones, certificates, costs, tags, and notes intact, only working on genuinely finished domains (expired, transferred, or disconnected).
• Always receive the all-clear when a monitor recovers: outages now send both the alert and recovery notification with downtime duration and current response time, including a direct View incident button.
• Deleting a server now destroys it at your provider: Delete permanently removes the machine and stops billing, while Stop tracking keeps it running and hides it under Servers → Not tracked for later retrieval.
• GoDaddy connections need a personal access token before end of 2026: replace your retiring API key and secret with a personal access token (same developer portal, 'Domains & DNS' scope) to maintain functionality beyond 2026.
• Warning banners now name the problems: instead of just counting issues, banners now list affected items and their specific problems (e.g. 'prod-db — SSH open to the internet'), grouped by issue type and linking directly to each resource.
• Set manual prices for anything your provider doesn't publish: enter custom prices for IP addresses, snapshots, and volumes once and they persist through syncs, with Hetzner volumes now arriving pre-priced.
• A server's cost now includes all attached resources: the Cost panel now lists every volume, IP address, and snapshot attached to the server, clearly labelled so nothing is hidden and nothing is double-counted.

🐛 Fixed

• Connect OVHcloud in one click via OAuth: approving InfraNest from your OVHcloud account now works without manually creating three API keys, with reconnection required for existing legacy credentials.
• SRV records now include weight and port fields: the form now requests all three required parameters instead of target alone, ensuring Cloudflare and other providers accept the records.
• Zone file exports now correctly name the apex: root records are exported as '@' instead of the full domain name, preventing incorrect subdomain interpretation on import.
• Resizing a volume now actually resizes it at your provider: volumes grow genuinely (larger only, never smaller) and you must run sudo resize2fs or sudo xfs_growfs on the attached server afterwards.
• OVHcloud: re-issue your API key to register domains and delete VPS snapshots: two missing permissions are now included in the standard request, so create a new key via the integration page and paste the three values in.