diff --git a/VERSION b/VERSION
index 7cb055c..4ad595c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.41
+1.0.42
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index b4d4dce..f2be0b5 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -45,7 +45,7 @@ import (
 	wgsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/wireguard"
 )
 
-var version = "1.0.41"
+var version = "1.0.42"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index dff1ad1..d91d0cd 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -9,7 +9,7 @@ import (
 	"os"
 )
 
-var version = "1.0.41"
+var version = "1.0.42"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index 41fa490..936226f 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -21,7 +21,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.0.41"
+var version = "1.0.42"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/unbound/unbound.cfg.tpl b/internal/unbound/unbound.cfg.tpl
index f384039..193b88f 100644
--- a/internal/unbound/unbound.cfg.tpl
+++ b/internal/unbound/unbound.cfg.tpl
@@ -58,7 +58,7 @@ server:
 {{range .LocalZones}}
     local-zone: "{{.Name}}." static
 {{- range .Records}}
-    local-data: "{{.Name}}{{if not (hasSuffix .Name $.dot)}}.{{end}} {{.TTL}} IN {{.RecordType}} {{.Value}}"
+    local-data: "{{.FQDN}} {{.TTL}} IN {{.RecordType}} {{.Value}}"
 {{- end}}
 {{end}}
 
diff --git a/internal/unbound/unbound.go b/internal/unbound/unbound.go
index c06ea36..41729bb 100644
--- a/internal/unbound/unbound.go
+++ b/internal/unbound/unbound.go
@@ -50,7 +50,30 @@ type View struct {
 
 type localZoneView struct {
 	Name    string
-	Records []models.DNSRecord
+	Records []recordView
+}
+
+// recordView ist DNSRecord plus FQDN — der Renderer expandiert
+// "@"/leer zu zone.Name, relative names zu "<name>.<zone>." Punkt
+// am Ende ist für unbound's local-data Pflicht.
+type recordView struct {
+	models.DNSRecord
+	FQDN string
+}
+
+func resolveFQDN(recName, zoneName string) string {
+	zone := strings.TrimSuffix(zoneName, ".")
+	n := strings.TrimSpace(recName)
+	if n == "" || n == "@" {
+		return zone + "."
+	}
+	if strings.HasSuffix(n, ".") {
+		return n // schon FQDN mit Punkt
+	}
+	if strings.HasSuffix(n, "."+zone) || n == zone {
+		return n + "."
+	}
+	return n + "." + zone + "."
 }
 
 type forwardZoneView struct {
@@ -96,10 +119,13 @@ func (g *Generator) Render(ctx context.Context) error {
 			if err != nil {
 				return fmt.Errorf("records for zone %s: %w", z.Name, err)
 			}
-			active := make([]models.DNSRecord, 0, len(recs))
+			active := make([]recordView, 0, len(recs))
 			for _, r := range recs {
 				if r.Active {
-					active = append(active, r)
+					active = append(active, recordView{
+						DNSRecord: r,
+						FQDN:      resolveFQDN(r.Name, z.Name),
+					})
 				}
 			}
 			view.LocalZones = append(view.LocalZones, localZoneView{
diff --git a/management-ui/package.json b/management-ui/package.json
index 5c74d5f..c762cef 100644
--- a/management-ui/package.json
+++ b/management-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "edgeguard-management-ui",
   "private": true,
-  "version": "1.0.41",
+  "version": "1.0.42",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/management-ui/src/components/Layout/Sidebar.tsx b/management-ui/src/components/Layout/Sidebar.tsx
index 5b0a220..da70af4 100644
--- a/management-ui/src/components/Layout/Sidebar.tsx
+++ b/management-ui/src/components/Layout/Sidebar.tsx
@@ -75,7 +75,7 @@ const NAV: NavSection[] = [
   },
 ]
 
-const VERSION = '1.0.41'
+const VERSION = '1.0.42'
 
 export default function Sidebar({ isOpen, onClose }: SidebarProps) {
   const { t } = useTranslation()