Bv9ARM.ch09.html revision 111d5ef471ecec90671f480afd8f93e550a80917
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - This Source Code Form is subject to the terms of the Mozilla Public
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - License, v. 2.0. If a copy of the MPL was not distributed with this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - file, You can obtain one at http://mozilla.org/MPL/2.0/.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h1 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.2</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#root_key">New DNSSEC Root Key</a></span></dt>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
e4a70b8fdfc5d2db2d992d884327a1e1fec67a07Tinderbox User<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.2</h2></div></div></div>
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User<div class="titlepage"><div><div><h3 class="title">
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User This document summarizes changes since the last production
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User release on the BIND 9.11 branch.
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User Please see the <code class="filename">CHANGES</code> file for a further
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User list of bug fixes and other changes.
a87790b9d8e062fac1b2dfb8903e77bfe92a3891Tinderbox User<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_download"></a>Download</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The latest versions of BIND 9 software can always be found at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein There you will find additional information about each release,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein source code, and pre-compiled versions for Microsoft Windows
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein operating systems.
27963ad22062efe8eac2beed51ff70d8f0b35900Tinderbox User<div class="titlepage"><div><div><h3 class="title">
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater<a name="root_key"></a>New DNSSEC Root Key</h3></div></div></div>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater ICANN is in the process of introducing a new Key Signing Key (KSK) for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the global root zone. BIND has multiple methods for managing DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trust anchors, with somewhat different behaviors. If the root
27963ad22062efe8eac2beed51ff70d8f0b35900Tinderbox User key is configured using the <span class="command"><strong>managed-keys</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statement, or if the pre-configured root key is enabled by using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-validation auto</strong></span>, then BIND can keep keys up
f39512a917cdd06c611d366603374f6ef570c80eTinderbox User to date automatically. Servers configured in this way should have
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein begun the process of rolling to the new key when it was published in
f39512a917cdd06c611d366603374f6ef570c80eTinderbox User the root zone in July 2017. However, keys configured using the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>trusted-keys</strong></span> statement are not automatically
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein maintained. If your server is performing DNSSEC validation and is
f39512a917cdd06c611d366603374f6ef570c80eTinderbox User configured using <span class="command"><strong>trusted-keys</strong></span>, you are advised to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein change your configuration before the root zone begins signing with
f39512a917cdd06c611d366603374f6ef570c80eTinderbox User the new KSK. This is currently scheduled for October 11, 2017.
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews This release includes an updated version of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">bind.keys</code> file containing the new root
507151045be68c671ffd4e2f37e17cdfa0376fc4Automatic Updater key. This file can also be downloaded from
507151045be68c671ffd4e2f37e17cdfa0376fc4Automatic Updater <a class="link" href="https://www.isc.org/bind-keys" target="_top">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<div class="titlepage"><div><div><h3 class="title">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<a name="relnotes_license"></a>License Change</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein With the release of BIND 9.11.0, ISC changed to the open
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews source license for BIND from the ISC license to the Mozilla
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Public License (MPL 2.0).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The MPL-2.0 license requires that if you make changes to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein licensed software (e.g. BIND) and distribute them outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein your organization, that you publish those changes under that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same license. It does not require that you publish or disclose
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein anything other than the changes you made to our software.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This requirement will not affect anyone who is using BIND, with
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews or without modifications, without redistributing it, nor anyone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein redistributing it without changes. Therefore, this change will be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without consequence for most individuals and organizations who are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Those unsure whether or not the license change affects their
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein use of BIND, or who wish to discuss how to comply with the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein platforms for BIND; "XP" binaries are no longer available for download
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein An error in TSIG handling could permit unauthorized zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transfers or zone updates. These flaws are disclosed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3142 and CVE-2017-3143. [RT #45383]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The BIND installer on Windows used an unquoted service path,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which can enable privilege escalation. This flaw is disclosed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in CVE-2017-3141. [RT #45229]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews With certain RPZ configurations, a response with TTL 0
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews could cause <span class="command"><strong>named</strong></span> to go into an infinite
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews query loop. This flaw is disclosed in CVE-2017-3140.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Addresses could be referenced after being freed during resolver
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews processing, causing an assertion failure. The chances of this
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews happening were remote, but the introduction of a delay in
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews resolution increased them. This bug is disclosed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3145. [RT #46839]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The ISC DNSSEC Lookaside Validation (DLV) service has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein been shut down; all DLV records in the dlv.isc.org zone
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater have been removed. References to the service have been
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater removed from BIND documentation. Lookaside validation
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater is no longer used by default by <span class="command"><strong>delv</strong></span>.
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater The DLV key has been removed from <code class="filename">bind.keys</code>.
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater Setting <span class="command"><strong>dnssec-lookaside</strong></span> to
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater anchor results in a warning being issued.
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signing algorithms described in RFC 8080. Note, however, that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein these algorithms must be supported in OpenSSL;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein currently they are only available in the development branch
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of OpenSSL at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://github.com/openssl/openssl" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When parsing DNS messages, EDNS KEY TAG options are checked
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for correctness. When printing messages (for example, in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in readable format.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> will no longer start or accept
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reconfiguration if <span class="command"><strong>managed-keys</strong></span> or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-validation auto</strong></span> are in use and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the managed-keys directory (specified by
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews <span class="command"><strong>managed-keys-directory</strong></span>, and defaulting
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews to the working directory if not specified),
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews is not writable by the effective user ID. [RT #46077]
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews updates from any source so long as they were signed by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein locally-generated session key. This has been further restricted;
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews updates are now only accepted from locally configured addresses.
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for EDNS options in addition to numeric values. For example,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an EDNS Client-Subnet option could be sent using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ednsopt=ecs:...</strong></span>. Thanks to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein John Worley of Secure64 for the contribution. [RT #44461]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Threads in <span class="command"><strong>named</strong></span> are now set to human-readable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein names to assist debugging on operating systems that support that.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Threads will have names such as "isc-timer", "isc-sockmgr",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "isc-worker0001", and so on. This will affect the reporting of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein subsidiary thread names in <span class="command"><strong>ps</strong></span> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>top</strong></span>, but not the main thread. [RT #43234]
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User DiG now warns about .local queries which are reserved for
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User Multicast DNS. [RT #44783]
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User<div class="titlepage"><div><div><h3 class="title">
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Attempting to validate improperly unsigned CNAME responses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from secure zones could cause a validator loop. This caused
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a delay in returning SERVFAIL and also increased the chances
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of encountering the crash bug described in CVE-2017-3145.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones to load correctly could leave the system in an inconsistent
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein state; while generally harmless, this could lead to a crash later
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews when using <span class="command"><strong>rndc addzone</strong></span>. Reconfiguration changes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are now fully rolled back in the event of failure. [RT #45841]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Fixed a bug that was introduced in an earlier development
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein release which caused multi-packet AXFR and IXFR messages to fail
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validation if not all packets contained TSIG records; this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein caused interoperability problems with some other DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implementations. [RT #45509]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Reloading or reconfiguring <span class="command"><strong>named</strong></span> could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fail on some platforms when LMDB was in use. [RT #45203]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Due to some incorrectly deleted code, when BIND was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein built with LMDB, zones that were deleted via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc delzone</strong></span> were removed from the
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews running server but were not removed from the new zone
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews database, so that deletion did not persist after a
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews server restart. This has been corrected. [RT #45185]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Semicolons are no longer escaped when printing CAA and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein URI records. This may break applications that depend on the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein presence of the backslash before the semicolon. [RT #45216]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein AD could be set on truncated answer with no records present
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the answer and authority sections. [RT #45140]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Some header files included <isc/util.h> incorrectly as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it pollutes with namespace with non ISC_ macros and this should
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein only be done by explicitly including <isc/util.h>. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been corrected. Some code may depend on <isc/util.h>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being implicitly included via other header files. Such
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein code should explicitly include <isc/util.h>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Zones created with <span class="command"><strong>rndc addzone</strong></span> could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein temporarily fail to inherit the <span class="command"><strong>allow-transfer</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ACL set in the <span class="command"><strong>options</strong></span> section of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>. [RT #46603]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> failed to properly determine whether
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there were active KSK and ZSK keys for an algorithm when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>update-check-ksk</strong></span> was true (which is the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default setting). This could leave records unsigned
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when rolling keys. [RT #46743] [RT #46754] [RT #46774]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="end_of_life"></a>End of Life</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The end of life for BIND 9.11 is yet to be determined but
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will not be before BIND 9.13.0 has been released for 6 months.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thank you to everyone who assisted us in making this release possible.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If you would like to contribute to ISC to assist us in continuing to
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater make quality open source software, please visit our donations page at
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater<table width="100%" summary="Navigation footer">
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2 (Extended Support Version)</p>