19a258565a4d24e5a0af62f626943ac9b898d957vboxsyncBIND 9

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync BIND version 9 is a major rewrite of nearly all aspects of the

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync underlying BIND architecture. Some of the important features of

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync BIND 9 are:

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync - DNS Security

e64031e20c39650a7bc902a3e1aba613b9415deevboxsync DNSSEC (signed zones)

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync TSIG (signed DNS requests)

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync - IP version 6

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Answers DNS queries on IPv6 sockets

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync IPv6 resource records (AAAA)

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Experimental IPv6 Resolver Library

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync - DNS Protocol Enhancements

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync IXFR, DDNS, Notify, EDNS0

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Improved standards conformance

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync - Views

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync One server process can provide multiple "views" of

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync the DNS namespace, e.g. an "inside" view to certain

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync clients, and an "outside" view to others.

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync - Multiprocessor Support

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync - Improved Portability Architecture

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync BIND version 9 development has been underwritten by the following

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync organizations:

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Sun Microsystems, Inc.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Hewlett Packard

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Compaq Computer Corporation

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync IBM

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Process Software Corporation

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Silicon Graphics, Inc.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Network Associates, Inc.

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync U.S. Defense Information Systems Agency

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync USENIX Association

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Stichting NLnet - NLnet Foundation

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Nominum, Inc.

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync

9040f019271f91b98e1320c0a8c38a42636e3979vboxsyncBIND 9.7.0

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync releases, including:

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Support for RFC 5011, automated trust anchor maintenance.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Simplified configuration of DNSSEC Lookaside Validation (DLV).

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Simplified configuration of Dynamic DNS using the "ddns-confgen"

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync command line tool or the "ddns-autoconf" zone option.

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync New named option "attach-cache" that allows multiple views to

9040f019271f91b98e1320c0a8c38a42636e3979vboxsync share a single cache.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync New logging category "query-errors" to provide detailed

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync internal information about query failures, especially about

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync server failures.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync DNS rebinding attack prevention.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsyncBIND 9.6.0

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

cc5db764b0331d17575b3f384d29e1c74970e62fvboxsync BIND 9.6.0 includes a number of changes from BIND 9.5 and earlier

99be02f9e15a3ca61b6a7c207cc7eb68dbd04817vboxsync releases, including:

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Full NSEC3 support

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Automatic zone re-signing

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync New update-policy methods tcp-self and 6to4-self

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync The BIND 8 resolver library, libbind, has been removed from the

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync BIND 9 distribution and is now available as a separate download.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Change the default pid file location from /var/run to

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync /var/run/{named,lwresd} for improved chroot/setuid support.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsyncBIND 9.5.0

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync BIND 9.5.0 has a number of new features over 9.4,

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync including:

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync GSS-TSIG support (RFC 3645).

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync DHCID support.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Experimental http server and statistics support for named via xml.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync More detailed statistics counters including those supported in BIND 8.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Faster ACL processing.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Use Doxygen to generate internal documentation.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Efficient LRU cache-cleaning mechanism.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

6c90795355c6e59ba82e8e5a58e10d686a6d6e65vboxsync NSID support.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsyncBIND 9.4.0

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync BIND 9.4.0 has a number of new features over 9.3,

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync including:

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Implemented "additional section caching (or acache)", an

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync internal cache framework for additional section content to

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync improve response performance. Several configuration options

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync were provided to control the behavior.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync New notify type 'master-only'. Enable notify for master

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync zones only.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Accept 'notify-source' style syntax for query-source.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync rndc now allows addresses to be set in the server clauses.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync New option "allow-query-cache". This lets "allow-query"

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync be used to specify the default zone access level rather

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync than having to have every zone override the global value.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync "allow-query-cache" can be set at both the options and view

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync levels. If "allow-query-cache" is not set then "allow-recursion"

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync is used if set, otherwise "allow-query" is used if set

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync unless "recursion no;" is set in which case "none;" is used,

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync otherwise the default (localhost; localnets;) is used.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync rndc: the source address can now be specified.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync ixfr-from-differences now takes master and slave in addition

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync to yes and no at the options and view levels.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Allow the journal's name to be changed via named.conf.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync 'rndc notify zone [class [view]]' resend the NOTIFY messages

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync for the specified zone.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync 'dig +trace' now randomly selects the next servers to try.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Report if there is a bad delegation.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Improve check-names error messages.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Make public the function to read a key file, dst_key_read_public().

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync dig now returns the byte count for axfr/ixfr.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync allow-update is now settable at the options / view level.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync named-checkconf now checks the logging configuration.

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync host now can turn on memory debugging flags with '-m'.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Don't send notify messages to self.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Perform sanity checks on NS records which refer to 'in zone' names.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync New zone option "notify-delay". Specify a minimum delay

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync between sets of NOTIFY messages.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Extend adjusting TTL warning messages.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Named and named-checkzone can now both check for non-terminal

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync wildcard records.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync "rndc freeze/thaw" now freezes/thaws all zones.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync named-checkconf now check acls to verify that they only

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync refer to existing acls.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync The server syntax has been extended to support a range of

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync servers.

71e61358090b8d7bad611a6d38786ebd63ed04e1vboxsync

71e61358090b8d7bad611a6d38786ebd63ed04e1vboxsync Report differences between hints and real NS rrset and

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync associated address records.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Preserve the case of domain names in rdata during zone

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync transfers.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Restructured the data locking framework using architecture

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync dependent atomic operations (when available), improving

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync response performance on multi-processor machines significantly.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync x86, x86_64, alpha, powerpc, and mips are currently supported.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync UNIX domain controls are now supported.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Add support for additional zone file formats for improving

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync loading performance. The masterfile-format option in

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync named.conf can be used to specify a non-default format. A

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync separate command named-compilezone was provided to generate

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync zone files in the new format. Additionally, the -I and -O

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync options for dnssec-signzone specify the input and output

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync formats.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync dnssec-signzone can now randomize signature end times

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync (dnssec-signzone -j jitter).

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Add support for CH A record.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Add additional zone data constancy checks. named-checkzone

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync has extended checking of NS, MX and SRV record and the hosts

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync they reference. named has extended post zone load checks.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync New zone options: check-mx and integrity-check.

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync edns-udp-size can now be overridden on a per server basis.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync dig can now specify the EDNS version when making a query.

6831f283dbc5c27bde8a8f8bea179b84a5741697vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Added framework for handling multiple EDNS versions.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Additional memory debugging support to track size and mctx

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync arguments.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync Detect duplicates of UDP queries we are recursing on and

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync drop them. New stats category "duplicates".

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

01ea175f55740168d1dd0af3277d3b86a30b4f91vboxsync "USE INTERNAL MALLOC" is now runtime selectable.

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync The lame cache is now done on a <qname,qclass,qtype> basis

19a258565a4d24e5a0af62f626943ac9b898d957vboxsync as some servers only appear to be lame for certain query

01ea175f55740168d1dd0af3277d3b86a30b4f91vboxsync types.

Limit the number of recursive clients that can be waiting

for a single query (<qname,qtype,qclass>) to resolve. New

options clients-per-query and max-clients-per-query.

dig: report the number of extra bytes still left in the

packet after processing all the records.

Support for IPSECKEY rdata type.

Raise the UDP recieve buffer size to 32k if it is less than 32k.

x86 and x86_64 now have seperate atomic locking implementations.

named-checkconf now validates update-policy entries.

Attempt to make the amount of work performed in a iteration

self tuning. The covers nodes clean from the cache per

iteration, nodes written to disk when rewriting a master

file and nodes destroyed per iteration when destroying a

zone or a cache.

ISC string copy API.

Automatic empty zone creation for D.F.IP6.ARPA and friends.

Note: RFC 1918 zones are not yet covered by this but are

likely to be in a future release.

New options: empty-server, empty-contact, empty-zones-enable

and disable-empty-zone.

dig now has a '-q queryname' and '+showsearch' options.

host/nslookup now continue (default)/fail on SERVFAIL.

dig now warns if 'RA' is not set in the answer when 'RD'

was set in the query. host/nslookup skip servers that fail

to set 'RA' when 'RD' is set unless a server is explicitly

set.

Integrate contibuted DLZ code into named.

Integrate contibuted IDN code from JPNIC.

libbind: corresponds to that from BIND 8.4.7.

BIND 9.3.0

BIND 9.3.0 has a number of new features over 9.2,

including:

DNSSEC is now DS based (RFC 3658).

See also RFC 3845, doc/draft/draft-ietf-dnsext-dnssec-*.

DNSSEC lookaside validation.

check-names is now implemented.

rrset-order in more complete.

IPv4/IPv6 transition support, dual-stack-servers.

IXFR deltas can now be generated when loading master files,

ixfr-from-differences.

It is now possible to specify the size of a journal, max-journal-size.

It is now possible to define a named set of master servers to be

used in masters clause, masters.

The advertised EDNS UDP size can now be set, edns-udp-size.

allow-v6-synthesis has been obsoleted.

NOTE:

* Zones containing MD and MF will now be rejected.

* dig, nslookup name. now report "Not Implemented" as

NOTIMP rather than NOTIMPL. This will have impact on scripts

that are looking for NOTIMPL.

libbind: corresponds to that from BIND 8.4.5.

BIND 9.2.0

BIND 9.2.0 has a number of new features over 9.1,

including:

- The size of the cache can now be limited using the

"max-cache-size" option.

- The server can now automatically convert RFC1886-style

recursive lookup requests into RFC2874-style lookups,

when enabled using the new option "allow-v6-synthesis".

This allows stub resolvers that support AAAA records

but not A6 record chains or binary labels to perform

lookups in domains that make use of these IPv6 DNS

features.

- Performance has been improved.

- The man pages now use the more portable "man" macros

rather than the "mandoc" macros, and are installed

by "make install".

- The named.conf parser has been completely rewritten.

It now supports "include" directives in more

places such as inside "view" statements, and it no

longer has any reserved words.

- The "rndc status" command is now implemented.

- rndc can now be configured automatically.

- A BIND 8 compatible stub resolver library is now

included in lib/bind.

- OpenSSL has been removed from the distribution. This

means that to use DNSSEC, OpenSSL must be installed and

the --with-openssl option must be supplied to configure.

This does not apply to the use of TSIG, which does not

require OpenSSL.

- The source distribution now builds on Windows.

See win32utils/readme1.txt and win32utils/win32-build.txt

for details.

This distribution also includes a new lightweight stub

resolver library and associated resolver daemon that fully

support forward and reverse lookups of both IPv4 and IPv6

addresses. This library is considered experimental and

is not a complete replacement for the BIND 8 resolver library.

Applications that use the BIND 8 res_* functions to perform

DNS lookups or dynamic updates still need to be linked against

the BIND 8 libraries. For DNS lookups, they can also use the

new "getrrsetbyname()" API.

BIND 9.2 is capable of acting as an authoritative server

for DNSSEC secured zones. This functionality is believed to

be stable and complete except for lacking support for

verifications involving wildcard records in secure zones.

When acting as a caching server, BIND 9.2 can be configured

to perform DNSSEC secure resolution on behalf of its clients.

This part of the DNSSEC implementation is still considered

experimental. For detailed information about the state of the

DNSSEC implementation, see the file doc/misc/dnssec.

There are a few known bugs:

On some systems, IPv6 and IPv4 sockets interact in

unexpected ways. For details, see doc/misc/ipv6.

To reduce the impact of these problems, the server

no longer listens for requests on IPv6 addresses

by default. If you need to accept DNS queries over

IPv6, you must specify "listen-on-v6 { any; };"

in the named.conf options statement.

FreeBSD prior to 4.2 (and 4.2 if running as non-root)

and OpenBSD prior to 2.8 log messages like

"fcntl(8, F_SETFL, 4): Inappropriate ioctl for device".

This is due to a bug in "/dev/random" and impacts the

server's DNSSEC support.

OS X 10.1.4 (Darwin 5.4), OS X 10.1.5 (Darwin 5.5) and

OS X 10.2 (Darwin 6.0) reports errors like

"fcntl(3, F_SETFL, 4): Operation not supported by device".

This is due to a bug in "/dev/random" and impacts the

server's DNSSEC support.

--with-libtool does not work on AIX.

A bug in some versions of the Microsoft DNS server can cause zone

transfers from a BIND 9 server to a W2K server to fail. For details,

see the "Zone Transfers" section in doc/misc/migration.

For a detailed list of user-visible changes from

previous releases, see the CHANGES file.

Building

BIND 9 currently requires a UNIX system with an ANSI C compiler,

basic POSIX support, and a 64 bit integer type.

We've had successful builds and tests on the following systems:

COMPAQ Tru64 UNIX 5.1B

Fedora Core 6

FreeBSD 4.10, 5.2.1, 6.2

HP-UX 11.11

Mac OS X 10.5

NetBSD 3.x, 4.0-beta, 5.0-beta

OpenBSD 3.3 and up

Solaris 8, 9, 9 (x86), 10

Ubuntu 7.04, 7.10

Windows XP/2003/2008

NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of

Windows, including Windows NT and Windows 2000, are no longer

supported.

We have recent reports from the user community that a supported

version of BIND will build and run on the following systems:

AIX 4.3, 5L

CentOS 4, 4.5, 5

Darwin 9.0.0d1/ARM

Debian 4

Fedora Core 5, 7

FreeBSD 6.1

HP-UX 11.23 PA

MacOS X 10.4, 10.5

Red Hat Enterprise Linux 4, 5

SCO OpenServer 5.0.6

Slackware 9, 10

SuSE 9, 10

To build, just

./configure

make

Do not use a parallel "make".

Several environment variables that can be set before running

configure will affect compilation:

CC

The C compiler to use. configure tries to figure

out the right one for supported systems.

CFLAGS

C compiler flags. Defaults to include -g and/or -O2

as supported by the compiler.

STD_CINCLUDES

System header file directories. Can be used to specify

where add-on thread or IPv6 support is, for example.

Defaults to empty string.

STD_CDEFINES

Any additional preprocessor symbols you want defined.

Defaults to empty string.

Possible settings:

Change the default syslog facility of named/lwresd.

-DISC_FACILITY=LOG_LOCAL0

Enable DNSSEC signature chasing support in dig.

-DDIG_SIGCHASE=1 (sets -DDIG_SIGCHASE_TD=1 and

-DDIG_SIGCHASE_BU=1)

Disable dropping queries from particular well known ports.

-DNS_CLIENT_DROPPORT=0

Sibling glue checking in named-checkzone is enabled by default.

To disable the default check set. -DCHECK_SIBLING=0

named-checkzone checks out-of-zone addresses by default.

To disable this default set. -DCHECK_LOCAL=0

To create the default pid files in ${localstatedir}/run rather

than ${localstatedir}/run/{named,lwresd}/ set.

-DNS_RUN_PID_DIR=0

Enable workaround for Solaris kernel bug about /dev/poll

-DISC_SOCKET_USE_POLLWATCH=1

The watch timeout is also configurable, e.g.,

-DISC_SOCKET_POLLWATCH_TIMEOUT=20

LDFLAGS

Linker flags. Defaults to empty string.

The following need to be set when cross compiling.

BUILD_CC

The native C compiler.

BUILD_CFLAGS (optional)

BUILD_CPPFLAGS (optional)

Possible Settings:

-DNEED_OPTARG=1 (optarg is not declared in <unistd.h>)

BUILD_LDFLAGS (optional)

BUILD_LIBS (optional)

To build shared libraries, specify "--with-libtool" on the

configure command line.

For the server to support DNSSEC, you need to build it

with crypto support. You must have OpenSSL 0.9.5a

or newer installed and specify "--with-openssl" on the

configure command line. If OpenSSL is installed under

a nonstandard prefix, you can tell configure where to

look for it using "--with-openssl=/prefix".

On some platforms it is necessary to explictly request large

file support to handle files bigger than 2GB. This can be

done by "--enable-largefile" on the configure command line.

On some platforms, BIND 9 can be built with multithreading

support, allowing it to take advantage of multiple CPUs.

You can specify whether to build a multithreaded BIND 9

by specifying "--enable-threads" or "--disable-threads"

on the configure command line. The default is operating

system dependent.

Support for the "fixed" rrset-order option can be enabled

or disabled by specifying "--enable-fixed-rrset" or

"--disable-fixed-rrset" on the configure command line.

The default is "disabled", to reduce memory footprint.

If your operating system has integrated support for IPv6, it

will be used automatically. If you have installed KAME IPv6

separately, use "--with-kame[=PATH]" to specify its location.

"make install" will install "named" and the various BIND 9 libraries.

By default, installation is into /usr/local, but this can be changed

with the "--prefix" option when running "configure".

You may specify the option "--sysconfdir" to set the directory

where configuration files like "named.conf" go by default,

and "--localstatedir" to set the default parent directory

of "run/named.pid". For backwards compatibility with BIND 8,

--sysconfdir defaults to "/etc" and --localstatedir defaults to

"/var" if no --prefix option is given. If there is a --prefix

option, sysconfdir defaults to "$prefix/etc" and localstatedir

defaults to "$prefix/var".

To see additional configure options, run "configure --help".

Note that the help message does not reflect the BIND 8

compatibility defaults for sysconfdir and localstatedir.

If you're planning on making changes to the BIND 9 source, you

should also "make depend". If you're using Emacs, you might find

"make tags" helpful.

If you need to re-run configure please run "make distclean" first.

This will ensure that all the option changes take.

Building with gcc is not supported, unless gcc is the vendor's usual

compiler (e.g. the various BSD systems, Linux).

Known compiler issues:

* gcc-3.2.1 and gcc-3.1.1 is known to cause problems with solaris-x86.

* gcc prior to gcc-3.2.3 ultrasparc generates incorrect code at -02.

* gcc-3.3.5 powerpc generates incorrect code at -02.

* Irix, MipsPRO 7.4.1m is known to cause problems.

A limited test suite can be run with "make test". Many of

the tests require you to configure a set of virtual IP addresses

on your system, and some require Perl; see bin/tests/system/README

for details.

SunOS 4 requires "printf" to be installed to make the shared

libraries. sh-utils-1.16 provides a "printf" which compiles

on SunOS 4.

Documentation

The BIND 9 Administrator Reference Manual is included with the

source distribution in DocBook XML and HTML format, in the

doc/arm directory.

Some of the programs in the BIND 9 distribution have man pages

in their directories. In particular, the command line

options of "named" are documented in /bin/named/named.8.

There is now also a set of man pages for the lwres library.

If you are upgrading from BIND 8, please read the migration

notes in doc/misc/migration. If you are upgrading from

BIND 4, read doc/misc/migration-4to9.

Frequently asked questions and their answers can be found in

FAQ.

Bug Reports and Mailing Lists

Bugs reports should be sent to

bind9-bugs@isc.org

To join the BIND Users mailing list, send mail to

bind-users-request@isc.org

archives of which can be found via

http://www.isc.org/ops/lists/

If you're planning on making changes to the BIND 9 source

code, you might want to join the BIND Workers mailing list.

Send mail to

bind-workers-request@isc.org