Bv9ARM.ch09.html revision 111d5ef471ecec90671f480afd8f93e550a80917
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - This Source Code Form is subject to the terms of the Mozilla Public
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - License, v. 2.0. If a copy of the MPL was not distributed with this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - file, You can obtain one at http://mozilla.org/MPL/2.0/.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h1 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.2</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#root_key">New DNSSEC Root Key</a></span></dt>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.2</h2></div></div></div>
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater This document summarizes changes since the last production
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater release on the BIND 9.11 branch.
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater Please see the <code class="filename">CHANGES</code> file for a further
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater list of bug fixes and other changes.
28b3569d6248168e6c00caab951521cc8141a49dAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_download"></a>Download</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The latest versions of BIND 9 software can always be found at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater There you will find additional information about each release,
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater source code, and pre-compiled versions for Microsoft Windows
c6d486af36165da7eb970354981d145249e342e4Mark Andrews operating systems.
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="root_key"></a>New DNSSEC Root Key</h3></div></div></div>
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater ICANN is in the process of introducing a new Key Signing Key (KSK) for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the global root zone. BIND has multiple methods for managing DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trust anchors, with somewhat different behaviors. If the root
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater key is configured using the <span class="command"><strong>managed-keys</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statement, or if the pre-configured root key is enabled by using
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater <span class="command"><strong>dnssec-validation auto</strong></span>, then BIND can keep keys up
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to date automatically. Servers configured in this way should have
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein begun the process of rolling to the new key when it was published in
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater the root zone in July 2017. However, keys configured using the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>trusted-keys</strong></span> statement are not automatically
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater maintained. If your server is performing DNSSEC validation and is
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater configured using <span class="command"><strong>trusted-keys</strong></span>, you are advised to
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater change your configuration before the root zone begins signing with
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews the new KSK. This is currently scheduled for October 11, 2017.
98b5a9d1099f72169c90de39712fc4f63e9d990eAutomatic Updater This release includes an updated version of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">bind.keys</code> file containing the new root
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key. This file can also be downloaded from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://www.isc.org/bind-keys" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<a name="relnotes_license"></a>License Change</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein With the release of BIND 9.11.0, ISC changed to the open
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews source license for BIND from the ISC license to the Mozilla
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Public License (MPL 2.0).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The MPL-2.0 license requires that if you make changes to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein licensed software (e.g. BIND) and distribute them outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein your organization, that you publish those changes under that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same license. It does not require that you publish or disclose
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein anything other than the changes you made to our software.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This requirement will not affect anyone who is using BIND, with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or without modifications, without redistributing it, nor anyone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein redistributing it without changes. Therefore, this change will be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without consequence for most individuals and organizations who are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Those unsure whether or not the license change affects their
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein use of BIND, or who wish to discuss how to comply with the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein platforms for BIND; "XP" binaries are no longer available for download
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein An error in TSIG handling could permit unauthorized zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transfers or zone updates. These flaws are disclosed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3142 and CVE-2017-3143. [RT #45383]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The BIND installer on Windows used an unquoted service path,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews which can enable privilege escalation. This flaw is disclosed
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in CVE-2017-3141. [RT #45229]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews With certain RPZ configurations, a response with TTL 0
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews could cause <span class="command"><strong>named</strong></span> to go into an infinite
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews query loop. This flaw is disclosed in CVE-2017-3140.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Addresses could be referenced after being freed during resolver
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein processing, causing an assertion failure. The chances of this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein happening were remote, but the introduction of a delay in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resolution increased them. This bug is disclosed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3145. [RT #46839]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The ISC DNSSEC Lookaside Validation (DLV) service has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein been shut down; all DLV records in the dlv.isc.org zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein have been removed. References to the service have been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein removed from BIND documentation. Lookaside validation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is no longer used by default by <span class="command"><strong>delv</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The DLV key has been removed from <code class="filename">bind.keys</code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Setting <span class="command"><strong>dnssec-lookaside</strong></span> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein anchor results in a warning being issued.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signing algorithms described in RFC 8080. Note, however, that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein these algorithms must be supported in OpenSSL;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein currently they are only available in the development branch
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of OpenSSL at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://github.com/openssl/openssl" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When parsing DNS messages, EDNS KEY TAG options are checked
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for correctness. When printing messages (for example, in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews in readable format.
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews<div class="titlepage"><div><div><h3 class="title">
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews <span class="command"><strong>named</strong></span> will no longer start or accept
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reconfiguration if <span class="command"><strong>managed-keys</strong></span> or
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews <span class="command"><strong>dnssec-validation auto</strong></span> are in use and
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews the managed-keys directory (specified by
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews <span class="command"><strong>managed-keys-directory</strong></span>, and defaulting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the working directory if not specified),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is not writable by the effective user ID. [RT #46077]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updates from any source so long as they were signed by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein locally-generated session key. This has been further restricted;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updates are now only accepted from locally configured addresses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for EDNS options in addition to numeric values. For example,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an EDNS Client-Subnet option could be sent using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ednsopt=ecs:...</strong></span>. Thanks to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein John Worley of Secure64 for the contribution. [RT #44461]
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews Threads in <span class="command"><strong>named</strong></span> are now set to human-readable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein names to assist debugging on operating systems that support that.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Threads will have names such as "isc-timer", "isc-sockmgr",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "isc-worker0001", and so on. This will affect the reporting of
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews subsidiary thread names in <span class="command"><strong>ps</strong></span> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>top</strong></span>, but not the main thread. [RT #43234]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DiG now warns about .local queries which are reserved for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Multicast DNS. [RT #44783]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Attempting to validate improperly unsigned CNAME responses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from secure zones could cause a validator loop. This caused
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a delay in returning SERVFAIL and also increased the chances
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of encountering the crash bug described in CVE-2017-3145.
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones to load correctly could leave the system in an inconsistent
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein state; while generally harmless, this could lead to a crash later
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when using <span class="command"><strong>rndc addzone</strong></span>. Reconfiguration changes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are now fully rolled back in the event of failure. [RT #45841]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Fixed a bug that was introduced in an earlier development
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein release which caused multi-packet AXFR and IXFR messages to fail
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validation if not all packets contained TSIG records; this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein caused interoperability problems with some other DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implementations. [RT #45509]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Reloading or reconfiguring <span class="command"><strong>named</strong></span> could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fail on some platforms when LMDB was in use. [RT #45203]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Due to some incorrectly deleted code, when BIND was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein built with LMDB, zones that were deleted via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc delzone</strong></span> were removed from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein running server but were not removed from the new zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein database, so that deletion did not persist after a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server restart. This has been corrected. [RT #45185]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Semicolons are no longer escaped when printing CAA and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein URI records. This may break applications that depend on the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein presence of the backslash before the semicolon. [RT #45216]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein AD could be set on truncated answer with no records present
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the answer and authority sections. [RT #45140]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Some header files included <isc/util.h> incorrectly as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it pollutes with namespace with non ISC_ macros and this should
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein only be done by explicitly including <isc/util.h>. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been corrected. Some code may depend on <isc/util.h>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being implicitly included via other header files. Such
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein code should explicitly include <isc/util.h>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Zones created with <span class="command"><strong>rndc addzone</strong></span> could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein temporarily fail to inherit the <span class="command"><strong>allow-transfer</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ACL set in the <span class="command"><strong>options</strong></span> section of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>. [RT #46603]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> failed to properly determine whether
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there were active KSK and ZSK keys for an algorithm when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>update-check-ksk</strong></span> was true (which is the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default setting). This could leave records unsigned
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when rolling keys. [RT #46743] [RT #46754] [RT #46774]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="end_of_life"></a>End of Life</h3></div></div></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The end of life for BIND 9.11 is yet to be determined but
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews will not be before BIND 9.13.0 has been released for 6 months.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thank you to everyone who assisted us in making this release possible.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If you would like to contribute to ISC to assist us in continuing to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein make quality open source software, please visit our donations page at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2 (Extended Support Version)</p>