Bv9ARM.ch09.html revision 1879ff49326b49a9e4eadaca193c631409bf8575
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson - Permission to use, copy, modify, and/or distribute this software for any
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews - purpose with or without fee is hereby granted, provided that the above
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews - copyright notice and this permission notice appear in all copies.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews - PERFORMANCE OF THIS SOFTWARE.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<!-- $Id$ -->
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<table width="100%" summary="Navigation header">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<div class="titlepage"><div><div><h2 class="title">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<a name="Bv9ARM.ch09"></a>Appendix�A.�Release Notes</h2></div></div></div>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2573795">Release Notes for BIND Version 9.11.0pre-alpha</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<a name="id2573795"></a>Release Notes for BIND Version 9.11.0pre-alpha</h2></div></div></div>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<div class="titlepage"><div><div><h3 class="title">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews This document summarizes changes since the last production release
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews of BIND on the corresponding major release branch.
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉<div class="titlepage"><div><div><h3 class="title">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<a name="relnotes_download"></a>Download</h3></div></div></div>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The latest versions of BIND 9 software can always be found at
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <a href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews There you will find additional information about each release,
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews source code, and pre-compiled versions for Microsoft Windows
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews operating systems.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<div class="titlepage"><div><div><h3 class="title">
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews On servers configured to perform DNSSEC validation, an
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews assertion failure could be triggered on answers from
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews a specially configured server.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews This flaw was discovered by Breno Silveira Soares, and is
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews disclosed in CVE-2015-4620. [RT #39795]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews On servers configured to perform DNSSEC validation using
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews managed trust anchors (i.e., keys configured explicitly
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews via <span><strong class="command">managed-keys</strong></span>, or implicitly
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews via <span><strong class="command">dnssec-validation auto;</strong></span> or
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <span><strong class="command">dnssec-lookaside auto;</strong></span>), revoking
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews a trust anchor and sending a new untrusted replacement
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews could cause <span><strong class="command">named</strong></span> to crash with an
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews assertion failure. This could occur in the event of a
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews botched key rollover, or potentially as a result of a
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews deliberate attack if the attacker was in position to
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews monitor the victim's DNS traffic.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews This flaw was discovered by Jan-Piet Mens, and is
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews disclosed in CVE-2015-1349. [RT #38344]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews A flaw in delegation handling could be exploited to put
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">named</strong></span> into an infinite loop, in which
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews each lookup of a name server triggered additional lookups
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews of more name servers. This has been addressed by placing
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews limits on the number of levels of recursion
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews <span><strong class="command">named</strong></span> will allow (default 7), and
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews on the number of queries that it will send before
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews terminating a recursive query (default 50).
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The recursion depth limit is configured via the
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <code class="option">max-recursion-depth</code> option, and the query limit
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews via the <code class="option">max-recursion-queries</code> option.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews The flaw was discovered by Florian Maury of ANSSI, and is
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews disclosed in CVE-2014-8500. [RT #37580]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Two separate problems were identified in BIND's GeoIP code that
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews could lead to an assertion failure. One was triggered by use of
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews both IPv4 and IPv6 address families, the other by referencing
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews a GeoIP database in <code class="filename">named.conf</code> which was
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews not installed. Both are covered by CVE-2014-8680. [RT #37672]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews A less serious security flaw was also found in GeoIP: changes
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews to the <span><strong class="command">geoip-directory</strong></span> option in
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <code class="filename">named.conf</code> were ignored when running
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">rndc reconfig</strong></span>. In theory, this could allow
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 <span><strong class="command">named</strong></span> to allow access to unintended clients.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<div class="titlepage"><div><div><h3 class="title">
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉<a name="relnotes_features"></a>New Features</h3></div></div></div>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The serial number of a dynamically updatable zone can
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews now be set using
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews This is particularly useful with <code class="option">inline-signing</code>
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews zones that have been reset. Setting the serial number to a value
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews larger than that on the slaves will trigger an AXFR-style
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews When answering recursive queries, SERVFAIL responses can now be
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews cached by the server for a limited time; subsequent queries for
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews the same query name and type will return another SERVFAIL until
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews the cache times out. This reduces the frequency of retries
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews when a query is persistently failing, which can be a burden
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews on recursive serviers. The SERVFAIL cache timeout is controlled
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews by <code class="option">servfail-ttl</code>, which defaults to 10 seconds
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews and has an upper limit of 30.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews The new <span><strong class="command">rndc nta</strong></span> command can now be used to
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews set a "negative trust anchor" (NTA), disabling DNSSEC validation for
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews a specific domain; this can be used when responses from a domain
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews are known to be failing validation due to administrative error
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 rather than because of a spoofing attack. NTAs are strictly
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 temporary; by default they expire after one hour, but can be
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 configured to last up to one week. The default NTA lifetime
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 can be changed by setting the <code class="option">nta-lifetime</code> in
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <code class="filename">named.conf</code>. When added, NTAs are stored in a
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 in order to persist across restarts of the <span><strong class="command">named</strong></span> server.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The EDNS Client Subnet (ECS) option is now supported for
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews authoritative servers; if a query contains an ECS option then
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews elements can match against the the address encoded in the option.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews This can be used to select a view for a query, so that different
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews answers can be provided depending on the client network.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews The EDNS EXPIRE option has been implemented on the client
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews side, allowing a slave server to set the expiration timer
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews correctly when transferring zone data from another slave
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews A new <code class="option">masterfile-style</code> zone option controls
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews the formatting of text zone files: When set to
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <code class="literal">full</code>, the zone file will dumped in
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews single-line-per-record format.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig +ednsopt</strong></span> can now be used to set
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews arbitrary EDNS options in DNS requests.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig +ednsflags</strong></span> can now be used to set
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews yet-to-be-defined EDNS flags in DNS requests.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig +[no]ednsnegotiation</strong></span> can now be used enable /
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews disable EDNS version negotiation.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig +header-only</strong></span> can now be used to send
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews queries without a question section.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <span><strong class="command">dig +ttlunits</strong></span> causes <span><strong class="command">dig</strong></span>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews to print TTL values with time-unit suffixes: w, d, h, m, s for
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews weeks, days, hours, minutes, and seconds.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig +zflag</strong></span> can be used to set the last
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews unassigned DNS header flag bit. This bit in normally zero.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews can now be used to set the DSCP code point in outgoing query
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <code class="option">serial-update-method</code> can now be set to
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <code class="literal">date</code>. On update, the serial number will
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews be set to the current date in YYYYMMDDNN format.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dnssec-signzone -N date</strong></span> also sets the serial
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews number to YYYYMMDDNN.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">named -L <em class="replaceable"><code>filename</code></em></strong></span>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews causes <span><strong class="command">named</strong></span> to send log messages to the specified file by
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews default instead of to the system log.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The rate limiter configured by the
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <code class="option">serial-query-rate</code> option no longer covers
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews NOTIFY messages; those are now separately controlled by
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <code class="option">startup-notify-rate</code> (the latter of which
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews controls the rate of NOTIFY messages sent when the server
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews is first started up or reconfigured).
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The default number of tasks and client objects available
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews for serving lightweight resolver queries have been increased,
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews and are now configurable via the new <code class="option">lwres-tasks</code>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews and <code class="option">lwres-clients</code> options in
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <code class="filename">named.conf</code>. [RT #35857]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Log output to files can now be buffered by specifying
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">buffered yes;</strong></span> when creating a channel.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">delv +tcp</strong></span> will exclusively use TCP when
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews sending queries.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">named</strong></span> will now check to see whether
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews other name server processes are running before starting up.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews This is implemented in two ways: 1) by refusing to start
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews if the configured network interfaces all return "address
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews in use", and 2) by attempting to acquire a lock on a file
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews specified by the <code class="option">lock-file</code> option or
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews the <span><strong class="command">-X</strong></span> command line option. The
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews default lock file is
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <code class="filename">/var/run/named/named.lock</code>.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Specifying <code class="literal">none</code> will disable the lock
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">rndc delzone</strong></span> can now be applied to zones
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews which were configured in <code class="filename">named.conf</code>;
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews it is no longer restricted to zones which were added by
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">rndc addzone</strong></span>. (Note, however, that
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews this does not edit <code class="filename">named.conf</code>; the zone
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews must be removed from the configuration or it will return
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews when <span><strong class="command">named</strong></span> is restarted or reloaded.)
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">rndc modzone</strong></span> can be used to reconfigure
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews a zone, using similar syntax to <span><strong class="command">rndc addzone</strong></span>.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">rndc showzone</strong></span> displays the current
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews configuration for a specified zone.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Added server-side support for pipelined TCP queries. Clients
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews may continue sending queries via TCP while previous queries are
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews processed in parallel. Responses are sent when they are
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews ready, not necessarily in the order in which the queries were
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews To revert to the former behavior for a particular
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews client address or range of addresses, specify the address prefix
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews in the "keep-response-order" option. To revert to the former
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews behavior for all clients, use "keep-response-order { any; };".
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The new <span><strong class="command">mdig</strong></span> command is a version of
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig</strong></span> that sends multiple pipelined
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews queries and then waits for responses, instead of sending one
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews query and waiting the response before sending the next. [RT #38261]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews To enable better monitoring and troubleshooting of RFC 5011
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews trust anchor management, the new <span><strong class="command">rndc managed-keys</strong></span>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews can be used to check status of trust anchors or to force keys
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews to be refreshed. Also, the managed-keys data file now has
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews easier-to-read comments. [RT #38458]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews An <span><strong class="command">--enable-querytrace</strong></span> configure switch is
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews now available to enable very verbose query tracelogging. This
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews option can only be set at compile time. This option has a
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews negative performance impact and should be used only for
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews debugging. [RT #37520]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews A new <span><strong class="command">tcp-only</strong></span> option can be specified
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews in <span><strong class="command">server</strong></span> statements to force
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">named</strong></span> to connect to the specified
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews server via TCP. [RT #37800]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The <span><strong class="command">nxdomain-redirect</strong></span> option specifies
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews a DNS namespace to use for NXDOMAIN redirection. When a
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews recursive lookup returns NXDOMAIN, a second lookup is
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews initiated with the specified name appended to the query
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews name. This allows NXDOMAIN redirection data to be supplied
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews by multiple zones configured on the server or by recursive
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews queries to other servers. (The older method, using
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews a single <span><strong class="command">type redirect</strong></span> zone, has
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews better average performance but is less flexible.) [RT #37989]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<div class="titlepage"><div><div><h3 class="title">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews not correctly matched unless the full organization name was
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews specified in the ACL (as in
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews They can now match against the AS number alone (as in
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">geoip asnum "AS1234";</strong></span>).
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews When using native PKCS#11 cryptography (i.e.,
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews of up to 256 characters can now be used.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews NXDOMAIN responses to queries of type DS are now cached separately
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews from those for other types. This helps when using "grafted" zones
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews of type forward, for which the parent zone does not contain a
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews delegation, such as local top-level domains. Previously a query
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews of type DS for such a zone could cause the zone apex to be cached
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews as NXDOMAIN, blocking all subsequent queries. (Note: This
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews change is only helpful when DNSSEC validation is not enabled.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews "Grafted" zones without a delegation in the parent are not a
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews recommended configuration.)
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews Update forwarding performance has been improved by allowing
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews a single TCP connection to be shared between multiple updates.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews By default, <span><strong class="command">nsupdate</strong></span> will now check
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews the correctness of hostnames when adding records of type
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews disabled with <span><strong class="command">check-names no</strong></span>.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Added support for OPENPGPKEY type.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The names of the files used to store managed keys and added
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews zones for each view are no longer based on the SHA256 hash
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews of the view name, except when this is necessary because the
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews view name contains characters that would be incompatible with use
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews as a file name. For views whose names do not contain forward
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews slashes ('/'), backslashes ('\'), or capital letters - which
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews could potentially cause namespace collision problems on
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews case-insensitive filesystems - files will now be named
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews after the view (for example, <code class="filename">internal.mkeys</code>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews or <code class="filename">external.nzf</code>). However, to ensure
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews consistent behavior when upgrading, if a file using the old
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews name format is found to exist, it will continue to be used.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews "rndc" can now return text output of arbitrary size to
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews the caller. (Prior to this, certain commands such as
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews "rndc tsig-list" and "rndc zonestatus" could return
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews truncated output.)
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 Errors reported when running <span><strong class="command">rndc addzone</strong></span>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews (e.g., when a zone file cannot be loaded) have been clarified
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews to make it easier to diagnose problems.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews When encountering an authoritative name server whose name is
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews an alias pointing to another name, the resolver treats
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews this as an error and skips to the next server. Previously
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews this happened silently; now the error will be logged to
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews the newly-created "cname" log category.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews If <span><strong class="command">named</strong></span> is not configured to validate the answer then
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews allow fallback to plain DNS on timeout even when we know
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews the server supports EDNS. This will allow the server to
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 potentially resolve signed queries when TCP is being
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews Large inline-signing changes should be less disruptive.
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 Signature generation is now done incrementally; the number
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews of signatures to be generated in each quantum is controlled
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews by "sig-signing-signatures <em class="replaceable"><code>number</code></em>;".
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews The experimental SIT option (code point 65001) of BIND
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 9.10.0 through BIND 9.10.2 has be replace the COOKIE
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 option (code point 10) and is no longer experimental and
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 is sent by default.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The SIT related named.conf options have been marked as
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews obsolete and are otherwise ignored.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews When retrying a query via TCP due to the first answer
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews being truncated, <span><strong class="command">dig</strong></span> will now correctly
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews send the Server COOKIE returned by the server in the prior
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews response. [RT #39047]
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 A alternative NXDOMAIN redirect method (nxdomain-redirect)
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 which allows the redirect information to be looked up from
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews a namespace on the Internet rather than requiring a zone
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews to be configured on the server is now available.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Retrieving the local port range from net.ipv4.ip_local_port_range
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews on Linux is now supported.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<div class="titlepage"><div><div><h3 class="title">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">nslookup</strong></span> aborted when encountering
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews a name which, after appending search list elements,
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews exceeded 255 bytes. Such names are now skipped, but
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 processing of other names will continue. [RT #36892]
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 The error message generated when
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 <span><strong class="command">named-checkzone</strong></span> or
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <span><strong class="command">named-checkconf -z</strong></span> encounters a
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <code class="option">$TTL</code> directive without a value has
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 been clarified. [RT #37138]
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews Semicolon characters (;) included in TXT records were
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews incorrectly escaped with a backslash when the record was
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews displayed as text. This is actually only necessary when there
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews are no quotation marks. [RT #37159]
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews When files opened for writing by <span><strong class="command">named</strong></span>,
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews such as zone journal files, were referenced more than once
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews in <code class="filename">named.conf</code>, it could lead to file
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews corruption as multiple threads wrote to the same file. This
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews is now detected when loading <code class="filename">named.conf</code>
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews and reported as an error. [RT #37172]
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews When checking for updates to trust anchors listed in
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews now revalidates keys based on the current set of
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews active trust anchors, without relying on any cached
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews record of previous validation. [RT #37506]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Large-system tuning
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews problems on some platforms by setting a socket receive
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews buffer size that was too large. This is now detected and
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews corrected at run time. [RT #37187]
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 When NXDOMAIN redirection is in use, queries for a name
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews that is present in the redirection zone but a type that
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 is not present will now return NOERROR instead of NXDOMAIN.
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 Due to an inadvertent removal of code in the previous
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 release, when <span><strong class="command">named</strong></span> encountered an
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews authoritative name server which dropped all EDNS queries,
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews it did not always try plain DNS. This has been corrected.
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 A regression caused nsupdate to use the default recursive servers
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 rather than the SOA MNAME server when sending the UPDATE.
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 Adjusted max-recursion-queries to accommodate the smaller
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 initial packet sizes used in BIND 9.10 and higher when
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson contacting authoritative servers for the first time.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews Built-in "empty" zones did not correctly inherit the
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 "allow-transfer" ACL from the options or view. [RT #38310]
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 Two leaks were fixed that could cause <span><strong class="command">named</strong></span>
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 processes to grow to very large sizes. [RT #38454]
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 Fixed some bugs in RFC 5011 trust anchor management,
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 including a memory leak and a possible loss of state
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 information. [RT #38458]
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 Asynchronous zone loads were not handled correctly when the
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 zone load was already in progress; this could trigger a crash
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews in zt.c. [RT #37573]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews A race during shutdown or reconfiguration could
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews cause an assertion failure in mem.c. [RT #38979]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Some answer formatting options didn't work correctly with
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">dig +short</strong></span>. [RT #39291]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Several bugs have been fixed in the RPZ implementation:
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Policy zones that did not specifically require recursion
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews could be treated as if they did; consequently, setting
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews <span><strong class="command">qname-wait-recurse no;</strong></span> was
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews sometimes ineffective. This has been corrected.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews In most configurations, behavioral changes due to this
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews fix will not be noticeable. [RT #39229]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The server could crash if policy zones were updated (e.g.
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews via <span><strong class="command">rndc reload</strong></span> or an incoming zone
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews transfer) while RPZ processing was still ongoing for an
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews active query. [RT #39415]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews On servers with one or more policy zones configured as
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews slaves, if a policy zone updated during regular operation
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews (rather than at startup) using a full zone reload, such as
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews via AXFR, a bug could allow the RPZ summary data to fall out
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews of sync, potentially leading to an assertion failure in
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews rpz.c when further incremental updates were made to the
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews zone, such as via IXFR. [RT #39567]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The server could match a shorter prefix than what was
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews available in CLIENT-IP policy triggers, and so, an
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews unexpected action could be taken. This has been
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews corrected. [RT #39481]
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews The server could crash if a reload of an RPZ zone was
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews initiated while another reload of the same zone was
ab6e5af4cd644b174709f95c2702ec4c442aa755Mark Andrews already in progress. [RT #39649]
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<div class="titlepage"><div><div><h3 class="title">
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<a name="end_of_life"></a>End of Life</h3></div></div></div>
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews The end of life for BIND 9.11 is yet to be determined but
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews will not be before BIND 9.13.0 has been released for 6 months.
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews <a href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉<div class="titlepage"><div><div><h3 class="title">
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson Thank you to everyone who assisted us in making this release possible.
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson If you would like to contribute to ISC to assist us in continuing to
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉 make quality open source software, please visit our donations page at
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson <a href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson<table width="100%" summary="Navigation footer">
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
4848fe4ad2c0ba6e2e69e4a2617727f8556d79a0Andreas Gustafsson<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
f620c5e527746a2ec3d90a11d21abd8a114746dfTatuya JINMEI 神明達哉<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
30d6e6e907dfd7a254796c70f49ed11979c0cc3bMark Andrews<p style="text-align: center;">BIND 9.11.0pre-alpha</p>