README revision cb143a725f0c4aa805f8fc66494023448455c773
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley BIND version 9 is a major rewrite of nearly all aspects of the
b90dd6c0a9df584619d3c47be7c9417f55d5ccf6Bob Halley underlying BIND architecture. Some of the important features of
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson - DNS Security
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson DNSSEC (signed zones)
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson TSIG (signed DNS requests)
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson - IP version 6
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Answers DNS queries on IPv6 sockets
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson IPv6 resource records (AAAA)
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Experimental IPv6 Resolver Library
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson - DNS Protocol Enhancements
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson IXFR, DDNS, Notify, EDNS0
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Improved standards conformance
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson One server process can provide multiple "views" of
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson the DNS namespace, e.g. an "inside" view to certain
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson clients, and an "outside" view to others.
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson - Multiprocessor Support
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson - Improved Portability Architecture
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson BIND version 9 development has been underwritten by the following
b90dd6c0a9df584619d3c47be7c9417f55d5ccf6Bob Halley organizations:
b90dd6c0a9df584619d3c47be7c9417f55d5ccf6Bob Halley Sun Microsystems, Inc.
b90dd6c0a9df584619d3c47be7c9417f55d5ccf6Bob Halley Hewlett Packard
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Compaq Computer Corporation
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Process Software Corporation
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Silicon Graphics, Inc.
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Network Associates, Inc.
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson U.S. Defense Information Systems Agency
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson USENIX Association
16803617e47c83272013e45ba8eb83a3b11983edAndreas Gustafsson Stichting NLnet - NLnet Foundation
70680fa51b0147c726b939b72b2420249429756aBob Halley Nominum, Inc.
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley For a summary of functional enhancements in previous
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley releases, see the HISTORY file.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson For a detailed list of user-visible changes from
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson previous releases, see the CHANGES file.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson BIND 9.9.0 includes a number of changes from BIND 9.8 and earlier
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson releases. New features include:
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Inline signing, allowing automatic DNSSEC signing of
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson master zones without modification of the zonefile, or
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson "bump in the wire" signing in slaves.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - NXDOMAIN redirection.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - New 'rndc flushtree' command clears all data under a given
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson name from the DNS cache.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - New 'rndc sync' command dumps pending changes in a dynamic
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson zone to disk without a freeze/thaw cycle.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - New 'rndc signing' command displays or clears signing status
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson records in 'auto-dnssec' zones.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - NSEC3 parameters for 'auto-dnssec' zones can now be set prior
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson to signing, eliminating the need to initially sign with NSEC.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Startup time improvements on large authoritative servers.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Slave zones are now saved in raw format by default.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Several improvements to response policy zones (RPZ).
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Improved hardware scalability by using multiple threads
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson to listen for queries and using finer-grained client locking
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - The 'also-notify' option now takes the same syntax as
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson 'masters', so it can used named masterlists and TSIG keys.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - 'dnssec-signzone -D' writes an output file containing only DNSSEC
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson data, which can be included by the primary zone file.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - 'dnssec-signzone -R' forces removal of signatures that are
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson not expired but were created by a key which no longer exists.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - 'dnssec-signzone -X' allows a separate expiration date to
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson be specified for DNSKEY signatures from other signatures.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - New '-L' option to dnssec-keygen, dnssec-settime, and
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson dnssec-keyfromlabel sets the default TTL for the key.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - dnssec-dsfromkey now supports reading from standard input,
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson to make it easier to convert DNSKEY to DS.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - RFC 1918 reverse zones have been added to the empty-zones
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson table per RFC 6303.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Dynamic updates can now optionally set the zone's SOA serial
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson number to the current UNIX time.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - DLZ modules can now retrieve the source IP address of
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson the querying client.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - 'request-ixfr' option can now be set at the per-zone level.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson releases. New features include:
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Built-in trust anchor for the root zone, which can be
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson switched on via "dnssec-validation auto;"
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Support for DNS64.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Support for response policy zones (RPZ).
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Support for writable DLZ zones.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Improved ease of configuration of GSS/TSIG for
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson interoperability with Active Directory
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Support for GOST signing algorithm for DNSSEC.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Removed RTT Banding from server selection algorithm.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - New "static-stub" zone type.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Allow configuration of resolver timeouts via
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson "resolver-query-timeout" option.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - The DLZ "dlopen" driver is now built by default.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Added a new include file with function typedefs
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson for the DLZ "dlopen" driver.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Made "--with-gssapi" default.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - More verbose error reporting from DLZ LDAP.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson releases. Most are intended to simplify DNSSEC configuration.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson New features include:
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Fully automatic signing of zones by "named".
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Simplified configuration of DNSSEC Lookaside Validation (DLV).
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Simplified configuration of Dynamic DNS, using the "ddns-confgen"
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson command line tool or the "local" update-policy option. (As a side
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson effect, this also makes it easier to configure automatic zone
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley re-signing.)
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley - New named option "attach-cache" that allows multiple views to
e5256e34b4a26a26088b2dc5ca621b42c0750256Andreas Gustafsson share a single cache.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence - DNS rebinding attack prevention.
b90dd6c0a9df584619d3c47be7c9417f55d5ccf6Bob Halley - New default values for dnssec-keygen parameters.
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley - Support for RFC 5011 automated trust anchor maintenance
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley - Smart signing: simplified tools for zone signing and key
40d01ce8f3a1889f5799d9b22b26d5398fa75a1bBob Halley maintenance.
8db66dc4eb654a2e295eaeab3aaf96e24c9ae7b7Bob Halley - The "statistics-channels" option is now available on Windows.
8db66dc4eb654a2e295eaeab3aaf96e24c9ae7b7Bob Halley - A new DNSSEC-aware libdns API for use by non-BIND9 applications
8db66dc4eb654a2e295eaeab3aaf96e24c9ae7b7Bob Halley - On some platforms, named and other binaries can now print out
501da430e2f16f496f8e8d1b57ab77f78428c682David Lawrence a stack backtrace on assertion failure, to aid in debugging.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley - A "tools only" installation mode on Windows, which only installs
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley dig, host, nslookup and nsupdate.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley - Improved PKCS#11 support, including Keyper support and explicit
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson OpenSSL engine selection.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley Known issues in this release:
d80ccd47ad4b526f82590b6c182b4dd80006712eAndreas Gustafsson - In rare cases, DNSSEC validation can leak memory. When this
a81d239754610b4e50892149bf8a570b257f6555Bob Halley happens, it will cause an assertion failure when named exits,
997e3113b7c91ec94e6274d31735f122e6e8209cAndreas Gustafsson but is otherwise harmless. A fix exists, but was too late for
d80ccd47ad4b526f82590b6c182b4dd80006712eAndreas Gustafsson this release; it will be included in BIND 9.7.1.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson Compatibility notes:
a0cad57966364095e4367f568389a8bd84afb2afAndreas Gustafsson - If you had built BIND 9.6 with any of ALLOW_NSEC3PARAM_UPDATE,
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson ALLOW_SECURE_TO_INSECURE or ALLOW_INSECURE_TO_SECURE defined, then
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson you should ensure that all changes that are in progress have
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson completed prior to upgrading to BIND 9.7. BIND 9.7 implements
bacb365014b37c9d6d377fc41797bd651d3f6727Mark Andrews those features in a way which is not backwards compatible.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley - Prior releases had a bug which caused HMAC-SHA* keys with long
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley secrets to be used incorrectly. Fixing this bug means that older
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley versions of BIND 9 may fail to interoperate with this version
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley when using TSIG keys. If this occurs, the new "isc-hmac-fixup"
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley tool will convert a key with a long secret into a form that works
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson correctly with all versions of BIND 9. See the "isc-hmac-fixup"
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson man page for additional details.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - Revoking a DNSSEC key with "dnssec-revoke" changes its key ID.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson It is possible for the new key ID to collide with that of a
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson different key. Newly generated keys will not have this problem,
b70fc17acec2c036bb35a937ba00fbcf10848859David Lawrence as "dnssec-keygen" looks for potential collisions before
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson generating keys, but exercise caution if using key revokation
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson with keys that were generated by older versions of BIND 9. See
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson the Administrator's Reference Manual, section 4.10 ("Dynamic
b70fc17acec2c036bb35a937ba00fbcf10848859David Lawrence Trust Anchor Management") for more details.
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson - A bug was fixed in which a key's scheduled inactivity date was
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson stored incorectly. Users who participated in the 9.7.0 BETA test
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson and had DNSSEC keys with scheduled inactivity dates will need to
b70fc17acec2c036bb35a937ba00fbcf10848859David Lawrence reset those keys' dates using "dnssec-settime -I".
b70fc17acec2c036bb35a937ba00fbcf10848859David Lawrence BIND 9 currently requires a UNIX system with an ANSI C compiler,
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson basic POSIX support, and a 64 bit integer type.
69930116e30137705d3b87d05cbfbc5712386fdeAndreas Gustafsson We've had successful builds and tests on the following systems:
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson COMPAQ Tru64 UNIX 5.1B
e21262ae8af5d12f64a2242e26338f36901ba4ccAndreas Gustafsson FreeBSD 4.10, 5.2.1, 6.2
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence NetBSD 3.x, 4.0-beta, 5.0-beta
3b8932de20e12b07f9d874d5538d30e1fac9a9f4Andreas Gustafsson OpenBSD 3.3 and up
9e87fd676ee62e6e11d29611731b80839fc305b3David Lawrence Solaris 8, 9, 9 (x86), 10
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley Ubuntu 7.04, 7.10
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley Windows XP/2003/2008
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of
5f5bb44065a3e7f506e4afd4d81c89da2931bf1bBob Halley Windows, including Windows NT and Windows 2000, are no longer
5f5bb44065a3e7f506e4afd4d81c89da2931bf1bBob Halley We have recent reports from the user community that a supported
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley version of BIND will build and run on the following systems:
fe82c227f69c4a95d9db2f64f07e55daaf9499e6Bob Halley CentOS 4, 4.5, 5
9b19b39170eaf78ae1baf39acca0be462c2faa4cAndreas Gustafsson Darwin 9.0.0d1/ARM
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley Fedora Core 5, 7
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson HP-UX 11.23 PA
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson MacOS X 10.4, 10.5
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson Red Hat Enterprise Linux 4, 5
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson SCO OpenServer 5.0.6
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson Slackware 9, 10
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson To build, just
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson Do not use a parallel "make".
413d5565ba2af24f12dc54d6e6807af7f1a39867Andreas Gustafsson Several environment variables that can be set before running
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley configure will affect compilation:
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley The C compiler to use. configure tries to figure
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley out the right one for supported systems.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley C compiler flags. Defaults to include -g and/or -O2
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley as supported by the compiler.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley STD_CINCLUDES
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley System header file directories. Can be used to specify
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley where add-on thread or IPv6 support is, for example.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley Defaults to empty string.
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley STD_CDEFINES
36983956d7c3d9e294903eeda29548f67ac17daeBob Halley Any additional preprocessor symbols you want defined.
a48fa4b49c58246b297e0fd38e5fb85b985379f1Bob Halley Defaults to empty string.
Change the default syslog facility of named/lwresd.
Enable workaround for Solaris kernel bug about /dev/poll
The watch timeout is also configurable, e.g.,
-DNEED_OPTARG=1 (optarg is not declared in <unistd.h>)
By default, installation is into /usr/local, but this can be changed
where configuration files like "named.conf" go by default,
of "run/named.pid". For backwards compatibility with BIND 8,
option, sysconfdir defaults to "$prefix/etc" and localstatedir
defaults to "$prefix/var".
compiler (e.g. the various BSD systems, Linux).
on your system, and some require Perl; see bin/tests/system/README
doc/arm directory.
options of "named" are documented in /bin/named/named.8.
notes in doc/misc/migration. If you are upgrading from
BIND 4, read doc/misc/migration-4to9.