Bv9ARM.ch09.html revision 221870ba7bf08daf55db5a69a4de4bbdc4f2a93c
fdd80e9a55c70b36a3bf3e409b86897301c44ff8Automatic Updater - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h1 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.0a2</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_port">Porting Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.0a2</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater BIND 9.11.0 is a new feature release of BIND, still under development.
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater This document summarizes new features and functional changes that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein have been introduced on this branch. With each development
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater release leading up to the final BIND 9.11.0 release, this document
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will be updated with additional features added and bugs fixed.
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<div class="titlepage"><div><div><h3 class="title">
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<a name="relnotes_download"></a>Download</h3></div></div></div>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater The latest versions of BIND 9 software can always be found at
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater There you will find additional information about each release,
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater source code, and pre-compiled versions for Microsoft Windows
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater operating systems.
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<div class="titlepage"><div><div><h3 class="title">
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<div class="titlepage"><div><div><h3 class="title">
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<a name="relnotes_features"></a>New Features</h3></div></div></div>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater Added support for DynDB, a new interface for loading zone data
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater from an external database, developed by Red Hat for the FreeIPA
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater project. (Thanks in particular to Adam Tkac and Petr
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater Spacek of Red Hat for the contribution.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Unlike the existing DLZ and SDB interfaces, which provide a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein limited subset of database functionality within BIND —
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein translating DNS queries into real-time database lookups with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein relatively poor performance and with no ability to handle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNSSEC-signed data — DynDB is able to fully implement
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and extend the database API used natively by BIND.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A DynDB module could pre-load data from an external data
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews source, then serve it with the same performance and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein functionality as conventional BIND zones, and with the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ability to take advantage of database features not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein available in BIND, such as multi-master replication.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein New quotas have been added to limit the queries that are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sent by recursive resolvers to authoritative servers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein experiencing denial-of-service attacks. When configured,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein these options can both reduce the harm done to authoritative
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews servers and also avoid the resource exhaustion that can be
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews experienced by recursives when they are being used as a
58d9e9169e7ab4355a0b0bfc13bc616bc5247dfeAutomatic Updater vehicle for such an attack.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="option">fetches-per-server</code> limits the number of
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews simultaneous queries that can be sent to any single
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein authoritative server. The configured value is a starting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein point; it is automatically adjusted downward if the server is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein partially or completely non-responsive. The algorithm used to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein adjust the quota can be configured via the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">fetch-quota-params</code> option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">fetches-per-zone</code> limits the number of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein simultaneous queries that can be sent for names within a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein single domain. (Note: Unlike "fetches-per-server", this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein value is not self-tuning.)
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater Statistics counters have also been added to track the number
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater of queries affected by these quotas.
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater Added support for <span class="command"><strong>dnstap</strong></span>, a fast,
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater flexible method for capturing and logging DNS traffic,
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater developed by Robert Edmonds at Farsight Security, Inc.,
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater whose assistance is gratefully acknowledged.
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews To enable <span class="command"><strong>dnstap</strong></span> at compile time,
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews the <span class="command"><strong>fstrm</strong></span> and <span class="command"><strong>protobuf-c</strong></span>
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews libraries must be available, and BIND must be configured with
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater A new utility <span class="command"><strong>dnstap-read</strong></span> has been added
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater to allow <span class="command"><strong>dnstap</strong></span> data to be presented in
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater a human-readable format.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For more information on <span class="command"><strong>dnstap</strong></span>, see
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein New statistics counters have been added to track traffic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sizes, as specified in RSSAC002. Query and response
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein message sizes are broken up into ranges of histogram buckets:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and 4096+. These values can be accessed via the XML and JSON
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statistics channels at, for example,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A new DNSSEC key management utility,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-keymgr</strong></span>, has been added. This tool
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater is meant to run unattended (e.g., under <span class="command"><strong>cron</strong></span>).
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater It reads a policy definition file
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater (default: <code class="filename">/etc/dnssec.policy</code>)
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater and creates or updates DNSSEC keys as necessary to ensure that a
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater zone's keys match the defined policy for that zone. New keys are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein created whenever necessary to ensure rollovers occur correctly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Existing keys' timing metadata is adjusted as needed to set the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein correct rollover period, prepublication interval, etc. If
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the configured policy changes, keys are corrected automatically.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein See the <span class="command"><strong>dnssec-keymgr</strong></span> man page for full details.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Note: <span class="command"><strong>dnssec-keymgr</strong></span> depends on Python and on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the Python lex/yacc module, PLY. The other Python-based tools,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-coverage</strong></span> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-checkds</strong></span>, have been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein refactored and updated as part of this work.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Many thanks to Sebasti�n
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews Castro for his assistance in developing this tool at the IETF
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 95 Hackathon in Buenos Aires, April 2016.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The serial number of a dynamically updatable zone can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein now be set using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This is particularly useful with <code class="option">inline-signing</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones that have been reset. Setting the serial number to a value
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein larger than that on the slaves will trigger an AXFR-style
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When answering recursive queries, SERVFAIL responses can now be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cached by the server for a limited time; subsequent queries for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the same query name and type will return another SERVFAIL until
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the cache times out. This reduces the frequency of retries
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when a query is persistently failing, which can be a burden
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on recursive serviers. The SERVFAIL cache timeout is controlled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by <code class="option">servfail-ttl</code>, which defaults to 1 second
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and has an upper limit of 30.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The new <span class="command"><strong>rndc nta</strong></span> command can now be used to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein set a "negative trust anchor" (NTA), disabling DNSSEC validation for
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews a specific domain; this can be used when responses from a domain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are known to be failing validation due to administrative error
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rather than because of a spoofing attack. NTAs are strictly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein temporary; by default they expire after one hour, but can be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configured to last up to one week. The default NTA lifetime
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can be changed by setting the <code class="option">nta-lifetime</code> in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>. When added, NTAs are stored in a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in order to persist across restarts of the <span class="command"><strong>named</strong></span> server.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews The EDNS Client Subnet (ECS) option is now supported for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein authoritative servers; if a query contains an ECS option then
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein elements can match against the address encoded in the option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This can be used to select a view for a query, so that different
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein answers can be provided depending on the client network.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The EDNS EXPIRE option has been implemented on the client
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater side, allowing a slave server to set the expiration timer
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein correctly when transferring zone data from another slave
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews A new <code class="option">masterfile-style</code> zone option controls
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the formatting of text zone files: When set to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="literal">full</code>, the zone file will dumped in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein single-line-per-record format.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ednsopt</strong></span> can now be used to set
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein arbitrary EDNS options in DNS requests.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="command"><strong>dig +ednsflags</strong></span> can now be used to set
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews yet-to-be-defined EDNS flags in DNS requests.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="command"><strong>dig +[no]ednsnegotiation</strong></span> can now be used enable /
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein disable EDNS version negotiation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +header-only</strong></span> can now be used to send
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries without a question section.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ttlunits</strong></span> causes <span class="command"><strong>dig</strong></span>
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews to print TTL values with time-unit suffixes: w, d, h, m, s for
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews weeks, days, hours, minutes, and seconds.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +zflag</strong></span> can be used to set the last
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unassigned DNS header flag bit. This bit is normally zero.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can now be used to set the DSCP code point in outgoing query
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +mapped</strong></span> can now be used to determine
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if mapped IPv4 addresses can be used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">serial-update-method</code> can now be set to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="literal">date</code>. On update, the serial number will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be set to the current date in YYYYMMDDNN format.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-signzone -N date</strong></span> also sets the serial
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein number to YYYYMMDDNN.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named -L <em class="replaceable"><code>filename</code></em></strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein causes <span class="command"><strong>named</strong></span> to send log messages to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified file by default instead of to the system log.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The rate limiter configured by the
2cc6eb92f9443695bc32fa6eed372d983d261a35Automatic Updater <code class="option">serial-query-rate</code> option no longer covers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NOTIFY messages; those are now separately controlled by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">startup-notify-rate</code> (the latter of which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein controls the rate of NOTIFY messages sent when the server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is first started up or reconfigured).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default number of tasks and client objects available
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for serving lightweight resolver queries have been increased,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and are now configurable via the new <code class="option">lwres-tasks</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and <code class="option">lwres-clients</code> options in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>. [RT #35857]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Log output to files can now be buffered by specifying
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>buffered yes;</strong></span> when creating a channel.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>delv +tcp</strong></span> will exclusively use TCP when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sending queries.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> will now check to see whether
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein other name server processes are running before starting up.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This is implemented in two ways: 1) by refusing to start
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if the configured network interfaces all return "address
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in use", and 2) by attempting to acquire a lock on a file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified by the <code class="option">lock-file</code> option or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the <span class="command"><strong>-X</strong></span> command line option. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default lock file is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">/var/run/named/named.lock</code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifying <code class="literal">none</code> will disable the lock
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc delzone</strong></span> can now be applied to zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which were configured in <code class="filename">named.conf</code>;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it is no longer restricted to zones which were added by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc addzone</strong></span>. (Note, however, that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this does not edit <code class="filename">named.conf</code>; the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein must be removed from the configuration or it will return
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when <span class="command"><strong>named</strong></span> is restarted or reloaded.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc modzone</strong></span> can be used to reconfigure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a zone, using similar syntax to <span class="command"><strong>rndc addzone</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc showzone</strong></span> displays the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configuration for a specified zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Added server-side support for pipelined TCP queries. Clients
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein may continue sending queries via TCP while previous queries are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein processed in parallel. Responses are sent when they are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ready, not necessarily in the order in which the queries were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To revert to the former behavior for a particular
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein client address or range of addresses, specify the address prefix
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the "keep-response-order" option. To revert to the former
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews behavior for all clients, use "keep-response-order { any; };".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The new <span class="command"><strong>mdig</strong></span> command is a version of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig</strong></span> that sends multiple pipelined
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries and then waits for responses, instead of sending one
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein query and waiting the response before sending the next. [RT #38261]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To enable better monitoring and troubleshooting of RFC 5011
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trust anchor management, the new <span class="command"><strong>rndc managed-keys</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can be used to check status of trust anchors or to force keys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be refreshed. Also, the managed-keys data file now has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein easier-to-read comments. [RT #38458]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein An <span class="command"><strong>--enable-querytrace</strong></span> configure switch is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein now available to enable very verbose query tracelogging. This
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews option can only be set at compile time. This option has a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein negative performance impact and should be used only for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein debugging. [RT #37520]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A new <span class="command"><strong>tcp-only</strong></span> option can be specified
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in <span class="command"><strong>server</strong></span> statements to force
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce <span class="command"><strong>named</strong></span> to connect to the specified
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce server via TCP. [RT #37800]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The <span class="command"><strong>nxdomain-redirect</strong></span> option specifies
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce a DNS namespace to use for NXDOMAIN redirection. When a
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce recursive lookup returns NXDOMAIN, a second lookup is
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce initiated with the specified name appended to the query
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater name. This allows NXDOMAIN redirection data to be supplied
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater by multiple zones configured on the server or by recursive
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews queries to other servers. (The older method, using
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce a single <span class="command"><strong>type redirect</strong></span> zone, has
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater better average performance but is less flexible.) [RT #37989]
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater The following types have been implemented: CSYNC, NINFO, RKEY,
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater SINK, TA, TALINK.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce A new <span class="command"><strong>message-compression</strong></span> option can be
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce used to specify whether or not to use name compression when
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce answering queries. Setting this to <strong class="userinput"><code>no</code></strong>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater results in larger responses, but reduces CPU consumption and
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater may improve throughput. The default is <strong class="userinput"><code>yes</code></strong>.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater A <span class="command"><strong>read-only</strong></span> option is now available in the
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <span class="command"><strong>controls</strong></span> statement to grant non-destructive
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce control channel access. In such cases, a restricted set of
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <span class="command"><strong>rndc</strong></span> commands are allowed, which can
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce report information from <span class="command"><strong>named</strong></span>, but cannot
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce reconfigure or stop the server. By default, the control channel
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater access is <span class="emphasis"><em>not</em></span> restricted to these
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater read-only operations. [RT #40498]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce When loading a signed zone, <span class="command"><strong>named</strong></span> will
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce now check whether an RRSIG's inception time is in the future,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce and if so, it will regenerate the RRSIG immediately. This helps
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce when a system's clock needs to be reset backwards.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="titlepage"><div><div><h3 class="title">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The ISC DNSSEC Lookaside Validation (DLV) service is scheduled
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce to be disabled in 2017. A warning is now logged when
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <span class="command"><strong>named</strong></span> is configured to use this service,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce either explicitly or via <code class="option">dnssec-lookaside auto;</code>.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The timers returned by the statistics channel (indicating current
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce time, server boot time, and most recent reconfiguration time) are
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce now reported with millisecond accuracy. [RT #40082]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Updated the compiled-in addresses for H.ROOT-SERVERS.NET
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce ACLs containing <span class="command"><strong>geoip asnum</strong></span> elements were
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce not correctly matched unless the full organization name was
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce specified in the ACL (as in
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <span class="command"><strong>geoip asnum "AS1234 Example, Inc.";</strong></span>).
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce They can now match against the AS number alone (as in
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <span class="command"><strong>geoip asnum "AS1234";</strong></span>).
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater When using native PKCS#11 cryptography (i.e.,
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <span class="command"><strong>configure --enable-native-pkcs11</strong></span>) HSM PINs
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater of up to 256 characters can now be used.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater NXDOMAIN responses to queries of type DS are now cached separately
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce from those for other types. This helps when using "grafted" zones
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce of type forward, for which the parent zone does not contain a
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce delegation, such as local top-level domains. Previously a query
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce of type DS for such a zone could cause the zone apex to be cached
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater as NXDOMAIN, blocking all subsequent queries. (Note: This
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater change is only helpful when DNSSEC validation is not enabled.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce "Grafted" zones without a delegation in the parent are not a
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce recommended configuration.)
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce Update forwarding performance has been improved by allowing
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce a single TCP connection to be shared between multiple updates.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce By default, <span class="command"><strong>nsupdate</strong></span> will now check
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the correctness of hostnames when adding records of type
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein disabled with <span class="command"><strong>check-names no</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Added support for OPENPGPKEY type.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The names of the files used to store managed keys and added
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce zones for each view are no longer based on the SHA256 hash
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce of the view name, except when this is necessary because the
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce view name contains characters that would be incompatible with use
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein as a file name. For views whose names do not contain forward
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein slashes ('/'), backslashes ('\'), or capital letters - which
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews could potentially cause namespace collision problems on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein case-insensitive filesystems - files will now be named
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein after the view (for example, <code class="filename">internal.mkeys</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or <code class="filename">external.nzf</code>). However, to ensure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein consistent behavior when upgrading, if a file using the old
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein name format is found to exist, it will continue to be used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "rndc" can now return text output of arbitrary size to
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews the caller. (Prior to this, certain commands such as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "rndc tsig-list" and "rndc zonestatus" could return
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein truncated output.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Errors reported when running <span class="command"><strong>rndc addzone</strong></span>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews (e.g., when a zone file cannot be loaded) have been clarified
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to make it easier to diagnose problems.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews When encountering an authoritative name server whose name is
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews an alias pointing to another name, the resolver treats
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews this as an error and skips to the next server. Previously
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this happened silently; now the error will be logged to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the newly-created "cname" log category.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If <span class="command"><strong>named</strong></span> is not configured to validate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein answers, then allow fallback to plain DNS on timeout even when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein we know the server supports EDNS. This will allow the server to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein potentially resolve signed queries when TCP is being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Large inline-signing changes should be less disruptive.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Signature generation is now done incrementally; the number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of signatures to be generated in each quantum is controlled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by "sig-signing-signatures <em class="replaceable"><code>number</code></em>;".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The experimental SIT option (code point 65001) of BIND
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater 9.10.0 through BIND 9.10.2 has been replaced with the COOKIE
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater option (code point 10). It is no longer experimental, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is sent by default, by both <span class="command"><strong>named</strong></span> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The SIT-related named.conf options have been marked as
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater obsolete, and are otherwise ignored.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When <span class="command"><strong>dig</strong></span> receives a truncated (TC=1)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response or a BADCOOKIE response code from a server, it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will automatically retry the query using the server COOKIE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that was returned by the server in its initial response.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A alternative NXDOMAIN redirect method (nxdomain-redirect)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which allows the redirect information to be looked up from
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater a namespace on the Internet rather than requiring a zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be configured on the server is now available.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Retrieving the local port range from net.ipv4.ip_local_port_range
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on Linux is now supported.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A new <code class="option">nsip-wait-recurse</code> directive has been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein added to RPZ, specifying whether to look up unknown name server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein IP addresses and wait for a response before applying RPZ-NSIP rules.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default is <strong class="userinput"><code>yes</code></strong>. If set to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <strong class="userinput"><code>no</code></strong>, <span class="command"><strong>named</strong></span> will only
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein apply RPZ-NSIP rules to servers whose addresses are already cached.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The addresses will be looked up in the background so the rule can
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater be applied on subsequent queries. This improves performance when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the cache is cold, at the cost of temporary imprecision in applying
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein policy directives. [RT #35009]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Within the <code class="option">response-policy</code> option, it is now
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein possible to configure RPZ rewrite logging on a per-zone basis
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using the <code class="option">log</code> clause.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default preferred glue is now the address type of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transport the query was received over.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein On machines with 2 or more processors (CPU), the default value
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for the number of UDP listeners has been changed to the number
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater of detected processors minus one.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Zone transfers now use smaller message sizes to improve
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein message compression. This results in reduced network usage.
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater Added support for the AVC resource record type (Application
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Visibility and Control).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Changed <span class="command"><strong>rndc reconfig</strong></span> behaviour so that newly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein added zones are loaded asynchronously and the loading does not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein block the server.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_port"></a>Porting Changes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Windows installs were failing due to triggering UAC without
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the installation binary being signed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A race condition in rbt/rbtdb was leading to INSISTs being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="end_of_life"></a>End of Life</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The end of life for BIND 9.11 is yet to be determined but
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will not be before BIND 9.13.0 has been released for 6 months.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews Thank you to everyone who assisted us in making this release possible.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If you would like to contribute to ISC to assist us in continuing to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein make quality open source software, please visit our donations page at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0a2</p>