4885. [security] update-policy rules that otherwise ignore the name field now require that it be set to "." to ensure that any type list present is properly interpreted. [RT #47126] (cherry picked from commit ec771bbdc80223ab94eda2173f3b20fd3ecfad49)

update copyright notice / whitespace

[v9_11] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957] (cherry picked from commit 129c4414cb6cff8042f1985fe5833aaae6043142) (cherry picked from commit f662d5484e0cf4cd83da300620b3701fee5a2ca1)

[v9_11] document "fixedpoint"

[v9_11] clarify doc on zone refresh and expiry

[v9_11] removed references to obsolete versions in documentation

[v9_11] fix some documentation errors [RT #45527] (cherry picked from commit 81570e84a25071ebe8b8d2d0b9d4a64094d2a41e)

[v9_11] zone "file" option was undocumented (cherry picked from commit b1042e011ced4f2c1a5c8ea3bc33f12b011e9d21)

[v9_11] doc nit: Base64 is capitalized and not hyphenated (cherry picked from commit 321b8429f54f74b5741dd0c76f60724a7dcf8ace)

[v9_11] require writable managed keys directory 4769. [bug] Enforce the requirement that the managed keys directory (specified by "managed-keys-directory", and defaulting to the working directory if not specified) must be writable. [RT #46077]

[v9_11] add DOA to ARM

[v9_11] further restrict update-policy local 4762. [func] "update-policy local" is now restricted to updates from local addresses. (Previously, other addresses were allowed so long as updates were signed by the local session key.) [RT #45492]

[v9_11] fix topology doc 4758. [doc] Remove documentation of unimplemented "topology". [RT #46161]

[v9_11] remove spurious control character

update copyright notice / whitespace

[v9_11] de-DLV 4749. [func] The ISC DLV service has been shut down, and all DLV records have been removed from dlv.isc.org. - Removed references to ISC DLV in documentation - Removed DLV key from bind.keys - No longer use ISC DLV by default in delv [RT #46155]

remove unimplement rate-limit option [RT #46030] (cherry picked from commit fb088a00cf06ba9f28894409dd48dfbfc82171b3)

[v9_11] grammar error and missing reference to filter-aaaa-on-v6 (cherry picked from commit b2a5df8d4b6d78e2c6565ff6d4dba7640cab2877)

[v9_11] remove unnecessary acronym expansions

[v9_11] remove outdated reference to libbind (cherry picked from commit ef9ab10ce070b899e44d7e4f9dc59f64eb7a600f)

update copyright notice / whitespace

Set a LMDB mapsize and also provide a config option to control it (#44954) (cherry picked from commit 241b49e6119eb37eebe2de98f0e8bde436074cb3)

[v9_11] clarify auth ECS is not meant for production use

4527. [doc] Support DocBook XSL Stylesheets v1.79.1. [RT #43831] (cherry picked from commit 1b8ce3b3302f0afe682d04df8a1f20b4ac346fb2)

[v9_11] fixed ARM grammars 4526. [doc] Corrected errors and improved formatting of grammar defintiions in the ARM. [RT #43739]

[v9_11] fix managed-keys doc 4525. [doc] Fixed outdated documentation on managed-keys. [RT #43810] (cherry picked from commit e1ba21bd5859166fcb3bacbfbef2b38c5c1e2a0e)

automate insertion of copyright year list into Bv9ARM-book.xml (cherry picked from commit e527dcdb00d267d8488f6465beab615e0cbc620c)

4504. [security] Allow the maximum number of records in a zone to be specified. This provides a control for issues raised in CVE-2016-6170. [RT #42143] (cherry picked from commit 5f8412a4cb5ee14a0e8cddd4107854b40ee3291e)

s/secret_string/algorithm_id/ for cookie-algorithm (cherry picked from commit fe09d4b609f6a96d7f475a532622037ced55090f)

[v9_11] correct default value of tcp-clients (cherry picked from commit b46760b373efc7796be64f9423d6465837e8a5bc)

fix the 8K number from the upstream source: /** Default `buffer_hint` value. */

[v9_11] add missing release notes and fix other doc nits (cherry picked from commit 864dc79dce81123d31a30bc7b47ea564dd7a20a3)

[v9_11] add dnssec-keygen and nslookup man page links to ARM (cherry picked from commit 1e50c0d857b87d38a836e463aa145539dd2eb58b)

[v9_11] document power of 2 requirement for fstrm-set-input-queue-size (cherry picked from commit dd666442d3b6e0e172711c81231d534667011809)

[v9_11] missed renaming SIT to COOKIE (cherry picked from commit b715ad3cdbb09dcba0af081b5b20d75e2a6e4f9c)

4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974] (cherry picked from commit 934837913ff197b1a10ad027705d4497fae21e59)

4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005] (cherry picked from commit 78e31dd18798f22828059b0f5cbc1c984c7e142c)

add mdig, named-nzd2nzf, pkcs11-destroy, pkcs11-list, pkcs11-keygen and pkcs11-tokens manpages (cherry picked from commit 915544f38960148237a98de2acf0e246c14f33f7)

4424. [experimental] Named now sends _ta-XXXX.<trust-anchor>/NULL queries to provide feedback to the trust-anchor administrators about how key rollovers are progressing as per draft-ietf-dnsop-edns-key-tag-02. This can be disabled using 'trust-anchor-telemetry no;'. [RT #40583] (cherry picked from commit f20179857a8512441c3be7ad33f1c84e367de041)

copyright (cherry picked from commit 813e9f7ee291c611828041727c21a9f225fe1bcb)

4409. [bug] DNS64 should exlude mapped addresses by default when a exclude acl is not defined. [RT #42810] (cherry picked from commit 557c7221fd4a7a439916e17d21405188c94a6aa1)

4401. [misc] Change LICENSE to MPL 2.0.

request-ixfr is a slave option rather than a master option

4376. [experimental] Added support for Catalog Zones, a new method for provisioning secondary servers in which a list of zones to be served is stored in a DNS zone and can be propagated to slaves via AXFR/IXFR. [RT #41581] 4375. [func] Add support for automatic reallocation of isc_buffer to isc_buffer_put* functions. [RT #42394]

[master] minimal-any 4371. [func] New "minimal-any" option reduces the size of UDP responses for qtype ANY by returning a single arbitrarily selected RRset instead of all RRsets. Thanks to Tony Finch. [RT #41615]

remove repeated like

4356. [func] Add the ability to specify whether to wait for nameserver addresses to be looked up or not to rpz with a new modifying directive 'nsip-wait-recurse'. [RT #35009]

fix spelling

minor grammar fix

add automatic-interface-scan to ARM grammar (cherry picked from commit 90499817bf85543c4c2a1946e146d7aef60331e4)

add AVC

update copyright notice / whitespace

[master] correct also-notify grammar

Use optimal message sizes to improve compression in AXFRs (#40996)

4276. [protocol] Add support for SMIMEA. [RT #40513]

[master] disallow map zones in response-policy 4269. [bug] Zones using "map" format master files currently don't work as policy zones. This limitation has now been documented; attempting to use such zones in "response-policy" statements is now a configuration error. [RT #38321]

Allow non-destructive control channel access using a "read-only" clause (#40498)

add simpara to some note tags So generated "Note" header isn't on same line as content. Also removed one place that said "Note" (so doesn't say "Note Note").

Fix typo

[master] clarify message-compression doc - mention TCP and RFC compliance issues

4255. [func] Add 'message-compression' option to disable DNS compression in responses. [RT #40726]

fix some spelling typos and standardize some English spellings (to be consistent)

cleanup trailing white space in SGML like files

remove errant word a word is repeated in a sentence and didn't make sense as-is so removed it

get rid of the "See also fetch-glue" since is obsolete This doesn't remove the description but don't have other options refer to obsolete option. No CHANGES entry since very minor.

[master] update TSIG, TKEY, SIG(0) documentation 4241. [doc] Improved the TSIG, TKEY, and SIG(0) sections in the ARM. [RT #40955]

[master] shorten default servfail-ttl 4239. [func] Changed default servfail-ttl value to 1 second from 10. Also, the maximum value is now 30 instead of 300. [RT #37556]

[master] remove unneeded xsl code, fix a link in ARM

[master] add link achors to to <section> tags

regen master

[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]

add missing <listitem> tags because require-server-cookie and request-sit explanations were missing.

[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]

split out logging-categories [RT #40844]

[master] merge dyndb 4224. [func] Added support for "dyndb", a new interface for loading zone data from an external database, developed by Red Hat for the FreeIPA project. DynDB drivers fully implement the BIND database API, and are capable of significantly better performance and functionality than DLZ drivers, while taking advantage of advanced database features not available in BIND such as multi-master replication. Thanks to Adam Tkac and Petr Spacek of Red Hat. [RT #35271]

add closing tag

4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]

4222. [func] Bias IPv6 servers when selecting the next server to query. [RT #40836]

[master] comment no longer needed

[master] named.conf and lwresd man pages missing from ARM

Improve docs for zone-statistics This is for ticket #36955. Improve grammar for zone-statistics to list new arguments. Refer to the docs in the options section. Clarify about stats may not show view name.

4217. [protocol] Add support for CSYNC. [RT #40532]

4214. [protocol] Add support for TALINK. [RT #40544]

[master] some options were in the wrong section of the ARM

fix docbook tag mistake Fix my mistake in my new branch that I just introduced.

improve the nocookie-udp-size documentation

move the nocookie-udp-size from server statement to options

document zone "type" in the ARM This is for ticket #39577 It only added two sentences so didn't update changelog.

remove the only section in the history appendix to workaround dblatex issue dblatex generated LaTeX that failed with the "id" for link reference in the sect1 when itr had no <title> to reference. (A workaround is to set a <title>.) But since this appendix only had one section and looked off to have B1 with no title and no B2, just remove the sect1 tags. I added the id to the first <para> tag just in case someone uses it to link. Note I didn't reformat the content there. I didn't get this reviewed as was trivial change.

add docbook tag for dns64 suffix value add missing docbook formatting. Note the element is standard, but that can be fixed in bulk later.

add nxdomain-redirect to options grammar I just used "string" as the value type. There is no real order here so just put by another "nxdomain" option. This was not reviewed. This is for ticket #39384 which also considers other work.

4199. [protocol] Add support for NINFO, RKEY, SINK, TA. [RT #40545] [RT #40547] [RT #40561] [RT #40563]

4201. [func] The default preferred-glue is now the address record type of the transport the query was received over. [RT #40468]

add NINFO and RKEY

add missing space noticed in manual review of the PDF minor so wasn't reviewed

4199. [protocol] Add support for NINFO, RKEY, TA. [RT #40545] [RT #40547] [RT #40563]

4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]

fix grammar for keys to use key_id This is for ticket #23009. Remove statement about grammar too. No CHANGES entry done.

improve dnssec-enable and dnssec-validation documentation This is for #37362 Okayed via jabber No CHANGES entry

mention seconds for max-zone-ttl, max-cache-ttl, min-refresh-time, max-policy-ttl in ARM This is for ticket 38106. The initial patch was okayed, but then another commenter mentioned that max-zone-ttl also allows TTL units so I mention that also without review. Note for the ticket, resolver-query-timeout change was already handled last month in my commit 8789f39b

fix missing space (noticed in April, bug 39228) and fix grammar

grammar

update list of supported types in the ARM

mention resolver-query-timeout is in "seconds" I didn't get this reviewed but looked at source where dns_resolver_settimeout value is called "seconds" and the comments for the maximum and default macros say "seconds".

Updated CHANGES note to include require-server-cookie: 4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are available: send-cookie, cookie-secret, cookie-algorithm, nocookie-udp-size and require-server-cookie. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

fix spelling typo

whitespace

[master] remove accidentally duplicated section on clients-per-query

request-nsid -> request-sit

[master] DDoS mitigation features 3938. [func] Added quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are nonresponsive or are experiencing a denial of service attack. - "fetches-per-server" limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the "fetch-quota-params" option. - "fetches-per-zone" limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) - New stats counters have been added to count queries spilled due to these quotas. See the ARM for details of these options. [RT #37125]

[master] traffic size stats 4156. [func] Added statistics counters to track the sizes of incoming queries and outgoing responses in histogram buckets, as specified in RSSAC002. [RT #39049]

Allow RPZ rewrite logging to be configured on a per-zone basis (#39754)

4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

whitespace

Add statistics counters for nxdomain redirections. [RT #39790]

fix rpz-client-ip documentation [RT #39783]

update rpz doc as per rt39703

Fix a bug in RPZ that could cause unwanted recursion (#39229) Conflicts: doc/arm/notes.xml

4108. [func] A additional nxdomain redirect (nxdomain-redirect) method is now supported. [RT #37989]

docbook <command> tags around named server references

4092. [bug] 'in-view' didn't work for zones beneath a empty zone. [RT #39173]

[master] minor doc fixes

Add warning about configuration inheritence with in-view

document the EDNS version is logged

[master] add "lock-file" and fix up singleton code 4080. [func] Completed change #4022, adding a "lock-file" option to named.conf to override the default lock file, in addition to the "named -X <filename>" command line option. Setting the lock file to "none" using either method disables the check completely. [RT #37908]

[master] clarify edns-udp-size doc

[master] oops, semicolons were still wrong

[master] reformat response-policy grammar There was an overly long line that ran off the end of the page in the PDF; also missing semicolons and close brace.

[master] add TCP pipelining support 4040. [func] Added server-side support for pipelined TCP queries. TCP connections are no longer closed after the first query received from a client. (The new "keep-response-order" option allows clients to be specified for which the old behavior will still be used.) [RT #37821]

[master] document dscp option

Add NTA persistence (#37087) 4034. [func] When added, negative trust anchors (NTA) are now saved to files (viewname.nta), in order to persist across restarts of the named server. [RT #37087]

[master] clean up release note stylesheets

update copyright notice / whitespace

Update ARM for the named -L option, etc. [RT #38057]

[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]

[master] adjust max-recursion-queries 4021. [bug] Adjust max-recursion-queries to accommodate the need for more queries when the cache is empty. [RT #38104]

4015. [bug] Nameservers that are skipped due to them being CNAMEs were not being logged. They are now logged to category 'cname' as per BIND 8. [RT #37935]

Add a TCP only option to server/peer

4007. [doc] Remove acl forward reference restriction. [RT #37772]

[master] add missing grammar

[master] add max-recursion-queries also fixes and documentation for max-recursion-depth

[master] limit recursion depth and iterative queries 4006. [security] A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500). The recursion depth limit is configured via the "max-recursion-depth" option. [RT #35780]

[master] new mkeys and nzf naming format 3999. [func] "mkeys" and "nzf" files are now named after their corresponding views, unless the view name contains characters that would be incompatible with use in a filename (i.e., slash, backslash, or capital letters). If a view name does contain these characters, the files will still be named using a cryptographic hash of the view name. Regardless of this, if a file using the old name format is found to exist, it will continue to be used. [RT #37704]

[master] document that zone rate-limiters have a floor of 1/second

3991. [func] Add the ability to buffer logging output by specifying "buffered yes;" when defining a channel. [RT #26561]

[master] allow 1-week nta-lifetime/nta-recheck 3983. [bug] Change #3940 was incomplete: negative trust anchors could be set to last up to a week, but the "nta-lifetime" and "nta-recheck" options were still limted to one day. [RT #37522]

[master] include relnotes in doc 3982. [doc] Include release notes in product documentation. [RT #37272]

Fix grammar in ARM suh as was fixed in rndc manual. This is prompted by ticket #37505 from chucka.

Remove the apostrophe 's from plural acronyms This is to be consistent with our common usage of just using a plural "s" without apostrophe. This was brought up via discussion in ticket 37505. I didn't have this reviewed.

add missing space and fix typo

3956. [func] Notify messages are now rate limited by notify-rate and startup-notify-rate instead of serial-query-rate. [RT #24454] 3955. [bug] Notify messages due to changes are no longer queued behind startup notify messages. [RT #24454]

fix response-policy synopsis

[master] remove RRL classifier doc (feature not committed here yet)

[master] minor grammar change

[master] add servfail-ttl to options grammar

3949. [experimental] Experimental support for draft-andrews-edns1 by sending EDNS(1) queries (define DRAFT_ANDREWS_EDNS1 when building). Add support for limiting the EDNS version advertised to servers: server { edns-version 0; }; Log the EDNS version received in the query log. [RT #35864]

[master] add package version to scope statement

[master] retain release info when updating copyright

[master] fix warnings/doc errors - possible use before assignment in query.c - missing <varlistentry> in ARM

update copyright notice

[master] servfail cache 3943. [func] SERVFAIL responses can now be cached for a limited time (configured by "servfail-ttl", default 10 seconds, limit 30). This can reduce the frequency of retries when an authoritative server is known to be failing, e.g., due to ongoing DNSSEC validation problems. [RT #21347]

[master] add version number to ARM 3941. [doc] Include the BIND version number in the ARM. [RT #37067]

[master] [rt37069] update NTA limit to a week 3940. [func] "rndc nta" now allows negative trust anchors to be set for up to one week. [RT #37069]

remove embrionic paragraph

[master] fix xml error

[master] ECS authoritative support 3936. [func] Added authoritative support for the EDNS Client Subnet (ECS) option. ACLs can now include "ecs" elements which specify an address or network prefix; if an ECS option is included in a DNS query, then the address encoded in the option will be matched against "ecs" ACL elements. Also, if an ECS address is included in a query, then it will be used instead of the client source address when matching "geoip" ACL elements. This behavior can be overridden with "geoip-use-ecs no;". When "ecs" or "geoip" ACL elements are used to select a view for a query, the response will include an ECS option to indicate which client network the answer is valid for. (Thanks to Vincent Bernat.) [RT #36781]

[master] fix geoip asnum matching 3935. [bug] "geoip asnum" ACL elements would not match unless the full organization name was specified. They can now match against the AS number alone (e.g., AS1234). [RT #36945]

3934. [bug] Catch bad 'sit-secret' in named-checkconf. Improve sit-secrets documentation. [RT #36980]

[36877] added doc about geoip-directory

remove period punctuation at end of title in <title> tags This was in the bibliography <biblioentry> entries which already generates the desired punctuation. Most was already correct, but some had junk periods.

[master] doc masterfile-style 3919. [doc] Added doc for masterfile-style. [RT #36823]

3918. [doc] Update check-spf documentation. [RT #36910]

miscellaneous minor fixes Say named instead of Named (be consistent). add sit-secret, automatic-interface-scan, policy tcp-only to grammar lowercase All-per-second to all-per-second fix typo cn to can Note this was not reviewed.

fix typos or misspellings

[35925] add more EDNS EXPIRE doc, clarify CHANGES note 3911

3911. [func] Implement EDNS EXPIRE option client side. [RT #35925]

[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]

3869. [doc] Document that in-view zones cannot be used for response policy zones. [RT #35941]

[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]

[master] increase and allow configuration of lwresd tasks/clients 3852. [func] Increase the default number of clients available for servicing lightweight resolver queries, and make them configurable via the "lwres-tasks" and "lwres-clients" options. (Thanks to Tomas Hozza.) [RT #35857]

[master] globally rename "delve" to "delv" 3817. [func] The "delve" command is now spelled "delv" to avoid a namespace collision with the Xapian project. [RT #35801]

[master] serial-update-method date; 3811. [func] "serial-update-method date;" sets serial number on dynamic update to today's date in YYYYMMDDNN format. (Thanks to Bradley Forschinger.) [RT #24903]

3809. [doc] Fix SIT and NSID documentation.

[master] more prefetch doc improvement

Fix typo: word was repeated

[master] fix "prefetch" doc 3808. [doc] Clean up "prefetch" documentation. [RT #35751]

fix typo

This version of the manual corresponds to BIND version 9.10. Not 9.9

[master] document behavior of localhost/localnets when interface changes

[master] work around db2latex bug by removing literal tag

[master] whitespace

[master] fix negative numbers in $GENERATE 3780. [bug] $GENERATE handled negative numbers incorrectly. [RT #25528]

[master] warn when wrong address family used in listen-on/-v6 3778. [bug] Log a warning when the wrong address family is used in "listen-on" or "listen-on-v6". [RT #17848]

[master] improved doc for "rndc signing -list" 3769. [doc] Improved documentation of "rndc signing -list". [RT #30652]

[master] fix 'rndc freeze' doc, and mention 'rndc sync'

[master] grammar

[master] missing man pages, named-rrchecker had wrong name

[master] fix typos

[master] max-zone-ttl 3746. [func] New "max-zone-ttl" option enforces maximum TTLs for zones. If loading a zone containing a higher TTL, the load fails. DDNS updates with higher TTLs are accepted but the TTL is truncated. (Note: Currently supported for master zones only; inline-signing slaves will be added.) [RT #38405]

3744. [experimental] SIT: send and process Source Identity Tokens (which are similar to DNS Cookies by Donald Eastlake) and are designed to help clients detect off path spoofed responses and for servers to detect legitimate clients. SIT use a experimental EDNS option code (65001). SIT can be enabled via --enable-developer or --enable-sit. It is on by default in Windows. RRL processing as been updated to know about SIT with legitimate clients not being rate limited. [RT #35389]

3743. [bug] delegation-only flag wasn't working in forward zone declarations despite being documented. This is needed to support turning off forwarding and turning on delegation only at the same name. [RT #35392]

[master] correct delegation-only doc

[master] delve 3741. [func] "delve" (domain entity lookup and validation engine): A new tool with dig-like semantics for performing DNS lookups, with internal DNSSEC validation, using the same resolver and validator logic as named. This allows easy validation of DNSSEC data in environments with untrustworthy resolvers, and assists with troubleshooting of DNSSEC problems. (Note: not yet available on win32.) [RT #32406]

3733. [func] Improve interface scanning support. Interface information will be automatically updated if the OS supports routing sockets. Use "automatic-interface-scan no;" to disable. Add "rndc scan" to trigger a scan. [RT #23027]

[master] add no-case-compress 3731. [func] Added a "no-case-compress" ACL, which causes named to use case-insensitive compression (disabling change #3645) for specified clients. (This is useful when dealing with broken client implementations that use case-sensitive name comparisons, rejecting responses that fail to match the capitalization of the query that was sent.) [RT #35300]

fix tag

[master] better error message when exceeding RPZ zone limit 3726. [cleanup] Clarified the error message when attempting to configure more than 32 response-policy zones. [RT #35283]

[master] further clarify edns doc

[master] improve RRL documentation - wrote better qname classifer doc - imported response size classifier doc from 9.9 sub

[master] improve EDNS doc 3721. [doc] Improved doucmentation of the EDNS processing enhancements introduced in change #3593. [RT #35275]

balance tags

[master] improve prefetch doc

3703. [func] Prefetch about to expire records if they are queried for, see prefetch option for details. [RT #35041]

update copyrights

[master] stats improvements 3700. [func] Allow access to subgroups of XML statistics via special URLs http://<server>:<port>/xml/v3/server, /zones, /net, /tasks, /mem, and /status. [RT #35115] 3699. [bug] Improvements to statistics channel XSL stylesheet: the stylesheet can now be cached by the browser; section headers are omitted from the stats display when there is no data in those sections to be displayed; counters are now right-justified for easier readability. [RT #35117]

[master] "in-view" zone option 3673. [func] New "in-view" zone option allows direct sharing of zones between views. [RT #32968]

mention EventViewer (cherry picked from commit 28343c910e549f2159073ffad6b9f15dc80da72b)

typos

s/dyanmic/dynamic/

clarify slip doc 3643. [doc] Clarify RRL "slip" documentation.

[master] fix doc errors

[master] fix doc build error

[master] rpz work 3620. [func] Added "rpz-client-ip" policy triggers, enabling RPZ responses to be configured on the basis of the client IP address; this can be used, for example, to blacklist misbehaving recursive or stub resolvers. [RT #33605] 3619. [bug] Fixed a bug in RPZ with "recursive-only no;" [RT #33776]