Trusting a server's host key

The first time you reach a server, dotMux shows its SHA-256 fingerprint and asks you to trust it — the standard trust-on-first-use handshake. From then on that endpoint is pinned: if its key ever changes, dotMux treats it as a hard mismatch and refuses rather than connect silently, so a man-in-the-middle can’t slip past.

If you’d rather not confirm every brand-new host by hand, turn on Trust New Servers Automatically (Settings → Security → Trusted Servers), like OpenSSH’s accept-new — it silently trusts unknown hosts while still catching key changes.

Forgetting a server

Everything you’ve trusted is listed on the Trusted Servers screen (Settings → Security), one row per endpoint with its key type and fingerprint. Forget a row and the next connection to that server asks you to trust it again — which is exactly what you want after a server is rebuilt or re-keyed, and it’s the one way past a hard key-mismatch refusal.