Bv9ARM.ch09.html revision 1ca759b3f5c0672b2a66bc02288fe010cabbfe37
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin - This Source Code Form is subject to the terms of the Mozilla Public
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin - License, v. 2.0. If a copy of the MPL was not distributed with this
7c2fbfb345896881c631598ee3852ce9ce33fb07April Chin - file, You can obtain one at http://mozilla.org/MPL/2.0/.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.0</a></span></dt>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="titlepage"><div><div><h2 class="title" style="clear: both">
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.0</h2></div></div></div>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="titlepage"><div><div><h3 class="title">
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin BIND 9.11.0 is a new feature release of BIND, still under development.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin This document summarizes new features and functional changes that
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin have been introduced on this branch. With each development
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz release leading up to the final BIND 9.11.0 release, this document
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz will be updated with additional features added and bugs fixed.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="titlepage"><div><div><h3 class="title">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<a name="relnotes_download"></a>Download</h3></div></div></div>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz The latest versions of BIND 9 software can always be found at
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin There you will find additional information about each release,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz source code, and pre-compiled versions for Microsoft Windows
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz operating systems.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="titlepage"><div><div><h3 class="title">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<a name="relnotes_license"></a>License Change</h3></div></div></div>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz With the release of BIND 9.11.0, ISC is changing the open
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz source license for BIND from the ISC license to the Mozilla
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Public License (MPL 2.0). This change is effective from BIND
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz 9.11.0b1 onwards.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz The MPL-2.0 license requires that if you make changes to
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz licensed software (e.g. BIND) and distribute them outside
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz your organization, that you publish those changes under that
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz same license. It does not require that you publish or disclose
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz anything other than the changes you made to our software.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz This new requirement will not affect anyone who is using BIND
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz without redistributing it, nor anyone redistributing it without
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz changes, therefore this change will be without consequence
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz for most individuals and organizations who are using BIND.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Those unsure whether or not the license change affects their
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz use of BIND, or who wish to discuss how to comply with the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="titlepage"><div><div><h3 class="title">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz It was possible to trigger a assertion when rendering a
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz message using a specially crafted request. This flaw is
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz disclosed in CVE-2016-2776. [RT #43139]
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz getrrsetbyname with a non absolute name could trigger an
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz infinite recursion bug in lwresd and named with lwres
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz configured if when combined with a search list entry the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz resulting name is too long. This flaw is disclosed in
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz CVE-2016-2775. [RT #42694]
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="titlepage"><div><div><h3 class="title">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<a name="relnotes_features"></a>New Features</h3></div></div></div>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz A new method of provisioning secondary servers called
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz "Catalog Zones" has been added. This is an implementation of
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <a class="link" href="https://datatracker.ietf.org/doc/draft-muks-dnsop-dns-catalog-zones/" target="_top">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz draft-muks-dnsop-dns-catalog-zones/
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz A catalog zone is a regular DNS zone which contains a list
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz of "member zones", along with the configuration options for
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz each of those zones. When a server is configured to use a
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz catalog zone, all the zones listed in the catalog zone are
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz added to the local server as slave zones. When the catalog
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz zone is updated (e.g., by adding or removing zones, or
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz changing configuration options for existing zones) those
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz changes will be put into effect. Since the catalog zone is
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz itself a DNS zone, this means configuration changes can be
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz propagated to slaves using the standard AXFR/IXFR update
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz This feature should be considered experimental. It currently
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz supports only basic features; more advanced features such as
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz ACLs and TSIG keys are not yet supported. Example catalog
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz zone configurations can be found in the Chapter 9 of the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz BIND Administrator Reference Manual.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin Support for master entries with TSIG keys has been added to catalog
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin zones, as well as support for allow-query and allow-transfer.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin Added an <span class="command"><strong>isc.rndc</strong></span> Python module, which allows
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>rndc</strong></span> commands to be sent from Python programs.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin Added support for DynDB, a new interface for loading zone data
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin from an external database, developed by Red Hat for the FreeIPA
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz project. (Thanks in particular to Adam Tkac and Petr
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Spacek of Red Hat for the contribution.)
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Unlike the existing DLZ and SDB interfaces, which provide a
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin limited subset of database functionality within BIND —
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz translating DNS queries into real-time database lookups with
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz relatively poor performance and with no ability to handle
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz DNSSEC-signed data — DynDB is able to fully implement
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin and extend the database API used natively by BIND.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin A DynDB module could pre-load data from an external data
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner source, then serve it with the same performance and
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin functionality as conventional BIND zones, and with the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz ability to take advantage of database features not
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin available in BIND, such as multi-master replication.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin Fetch quotas are now compiled in by default: they
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz no longer require BIND to be configured with
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>--enable-fetchlimit</strong></span>, as was the case
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz when the feature was introduced in BIND 9.10.3.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz These quotas limit the queries that are sent by recursive
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz resolvers to authoritative servers experiencing denial-of-service
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz attacks. They can both reduce the harm done to authoritative
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz servers and also avoid the resource exhaustion that can be
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz experienced by recursive servers when they are being used as a
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz vehicle for such an attack.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="option">fetches-per-server</code> limits the number of
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz simultaneous queries that can be sent to any single
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz authoritative server. The configured value is a starting
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner point; it is automatically adjusted downward if the server is
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz partially or completely non-responsive. The algorithm used to
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz adjust the quota can be configured via the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="option">fetch-quota-params</code> option.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="option">fetches-per-zone</code> limits the number of
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz simultaneous queries that can be sent for names within a
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz single domain. (Note: Unlike "fetches-per-server", this
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz value is not self-tuning.)
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Statistics counters have also been added to track the number
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz of queries affected by these quotas.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Added support for <span class="command"><strong>dnstap</strong></span>, a fast,
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin flexible method for capturing and logging DNS traffic,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz developed by Robert Edmonds at Farsight Security, Inc.,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz whose assistance is gratefully acknowledged.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz To enable <span class="command"><strong>dnstap</strong></span> at compile time,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the <span class="command"><strong>fstrm</strong></span> and <span class="command"><strong>protobuf-c</strong></span>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin libraries must be available, and BIND must be configured with
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin A new utility <span class="command"><strong>dnstap-read</strong></span> has been added
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin to allow <span class="command"><strong>dnstap</strong></span> data to be presented in
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin a human-readable format.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin <span class="command"><strong>rndc dnstap -roll</strong></span> causes <span class="command"><strong>dnstap</strong></span>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin output files to be rolled like log files -- the most recent output
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin file is renamed with a <code class="filename">.0</code> suffix, the next
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin most recent with <code class="filename">.1</code>, etc. (Note that this
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin only works when <span class="command"><strong>dnstap</strong></span> output is being written
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz to a file, not to a UNIX domain socket.) An optional numerical
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz argument specifies how many backup log files to retain; if not
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner specified or set to 0, there is no limit.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>rndc dnstap -reopen</strong></span> simply closes and reopens
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the <span class="command"><strong>dnstap</strong></span> output channel without renaming
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the output file.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz For more information on <span class="command"><strong>dnstap</strong></span>, see
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz New statistics counters have been added to track traffic
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz sizes, as specified in RSSAC002. Query and response
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz message sizes are broken up into ranges of histogram buckets:
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz and 4096+. These values can be accessed via the XML and JSON
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz statistics channels at, for example,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <a class="link" href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <a class="link" href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Statistics for RSSAC02v3 traffic-volume, traffic-sizes and
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz rcode-volume reporting are now collected.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz A new DNSSEC key management utility,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dnssec-keymgr</strong></span>, has been added. This tool
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz is meant to run unattended (e.g., under <span class="command"><strong>cron</strong></span>).
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz It reads a policy definition file
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz (default <code class="filename">/etc/dnssec-policy.conf</code>)
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz and creates or updates DNSSEC keys as necessary to ensure that a
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz zone's keys match the defined policy for that zone. New keys are
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz created whenever necessary to ensure rollovers occur correctly.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Existing keys' timing metadata is adjusted as needed to set the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz correct rollover period, prepublication interval, etc. If
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the configured policy changes, keys are corrected automatically.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz See the <span class="command"><strong>dnssec-keymgr</strong></span> man page for full details.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Note: <span class="command"><strong>dnssec-keymgr</strong></span> depends on Python and on
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the Python lex/yacc module, PLY. The other Python-based tools,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dnssec-coverage</strong></span> and
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dnssec-checkds</strong></span>, have been
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz refactored and updated as part of this work.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dnssec-keymgr</strong></span> now takes a -r
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <em class="replaceable"><code>randomfile</code></em> option.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz (Many thanks to Sebasti�n
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Castro for his assistance in developing this tool at the IETF
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz 95 Hackathon in Buenos Aires, April 2016.)
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz The serial number of a dynamically updatable zone can
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz now be set using
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz This is particularly useful with <code class="option">inline-signing</code>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz zones that have been reset. Setting the serial number to a value
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz larger than that on the slaves will trigger an AXFR-style
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz When answering recursive queries, SERVFAIL responses can now be
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz cached by the server for a limited time; subsequent queries for
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the same query name and type will return another SERVFAIL until
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the cache times out. This reduces the frequency of retries
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz when a query is persistently failing, which can be a burden
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz on recursive servers. The SERVFAIL cache timeout is controlled
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz by <code class="option">servfail-ttl</code>, which defaults to 1 second
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz and has an upper limit of 30.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin The new <span class="command"><strong>rndc nta</strong></span> command can now be used to
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin set a "negative trust anchor" (NTA), disabling DNSSEC validation for
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz a specific domain; this can be used when responses from a domain
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz are known to be failing validation due to administrative error
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz rather than because of a spoofing attack. NTAs are strictly
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz temporary; by default they expire after one hour, but can be
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz configured to last up to one week. The default NTA lifetime
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz can be changed by setting the <code class="option">nta-lifetime</code> in
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="filename">named.conf</code>. When added, NTAs are stored in a
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz in order to persist across restarts of the <span class="command"><strong>named</strong></span> server.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz The EDNS Client Subnet (ECS) option is now supported for
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz authoritative servers; if a query contains an ECS option then
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
3e14f97f673e8a630f076077de35afdd43dc1587Roger A. Faulkner elements can match against the address encoded in the option.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin This can be used to select a view for a query, so that different
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz answers can be provided depending on the client network.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin The EDNS EXPIRE option has been implemented on the client
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz side, allowing a slave server to set the expiration timer
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin correctly when transferring zone data from another slave
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz A new <code class="option">masterfile-style</code> zone option controls
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin the formatting of text zone files: When set to
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin <code class="literal">full</code>, the zone file will dumped in
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin single-line-per-record format.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dig +ednsopt</strong></span> can now be used to set
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz arbitrary EDNS options in DNS requests.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dig +ednsflags</strong></span> can now be used to set
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz yet-to-be-defined EDNS flags in DNS requests.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin <span class="command"><strong>dig +[no]ednsnegotiation</strong></span> can now be used enable /
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin disable EDNS version negotiation.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dig +header-only</strong></span> can now be used to send
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz queries without a question section.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin <span class="command"><strong>dig +ttlunits</strong></span> causes <span class="command"><strong>dig</strong></span>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin to print TTL values with time-unit suffixes: w, d, h, m, s for
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin weeks, days, hours, minutes, and seconds.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dig +zflag</strong></span> can be used to set the last
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz unassigned DNS header flag bit. This bit is normally zero.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin can now be used to set the DSCP code point in outgoing query
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dig +mapped</strong></span> can now be used to determine
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz if mapped IPv4 addresses can be used.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>nslookup</strong></span> will now look up IPv6 as well
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz as IPv4 addresses by default. [RT #40420]
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="option">serial-update-method</code> can now be set to
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="literal">date</code>. On update, the serial number will
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin be set to the current date in YYYYMMDDNN format.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>dnssec-signzone -N date</strong></span> also sets the serial
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz number to YYYYMMDDNN.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>named -L <em class="replaceable"><code>filename</code></em></strong></span>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz causes <span class="command"><strong>named</strong></span> to send log messages to the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz specified file by default instead of to the system log.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz The rate limiter configured by the
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="option">serial-query-rate</code> option no longer covers
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz NOTIFY messages; those are now separately controlled by
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="option">startup-notify-rate</code> (the latter of which
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz controls the rate of NOTIFY messages sent when the server
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz is first started up or reconfigured).
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz The default number of tasks and client objects available
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz for serving lightweight resolver queries have been increased,
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz and are now configurable via the new <code class="option">lwres-tasks</code>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz and <code class="option">lwres-clients</code> options in
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="filename">named.conf</code>. [RT #35857]
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Log output to files can now be buffered by specifying
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>buffered yes;</strong></span> when creating a channel.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>delv +tcp</strong></span> will exclusively use TCP when
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz sending queries.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>named</strong></span> will now check to see whether
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz other name server processes are running before starting up.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz This is implemented in two ways: 1) by refusing to start
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz if the configured network interfaces all return "address
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz in use", and 2) by attempting to acquire a lock on a file
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz specified by the <code class="option">lock-file</code> option or
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the <span class="command"><strong>-X</strong></span> command line option. The
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz default lock file is
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <code class="filename">/var/run/named/named.lock</code>.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz Specifying <code class="literal">none</code> will disable the lock
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>rndc delzone</strong></span> can now be applied to zones
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz which were configured in <code class="filename">named.conf</code>;
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz it is no longer restricted to zones which were added by
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>rndc addzone</strong></span>. (Note, however, that
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz this does not edit <code class="filename">named.conf</code>; the zone
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz must be removed from the configuration or it will return
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz when <span class="command"><strong>named</strong></span> is restarted or reloaded.)
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>rndc modzone</strong></span> can be used to reconfigure
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz a zone, using similar syntax to <span class="command"><strong>rndc addzone</strong></span>.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin <span class="command"><strong>rndc showzone</strong></span> displays the current
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz configuration for a specified zone.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz When BIND is built with the <span class="command"><strong>lmdb</strong></span> library
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin (Lightning Memory-Mapped Database), <span class="command"><strong>named</strong></span>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin will store the configuration information for zones
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin that are added via <span class="command"><strong>rndc addzone</strong></span>
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz in a database, rather than in a flat "NZF" file. This
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin dramatically improves performance for
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz <span class="command"><strong>rndc delzone</strong></span> and
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin <span class="command"><strong>rndc modzone</strong></span>: deleting or changing
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz the contents of a database is much faster than rewriting
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz a text file.
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin On startup, if <span class="command"><strong>named</strong></span> finds an existing
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin NZF file, it will automatically convert it to the new NZD
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz database format.
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz To view the contents of an NZD, or to convert an
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin NZD back to an NZF file (for example, to revert back
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz to an earlier version of BIND which did not support the
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin NZD format), use the new command <span class="command"><strong>named-nzd2nzf</strong></span>
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin Added server-side support for pipelined TCP queries. Clients
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin may continue sending queries via TCP while previous queries are
da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968chin processed in parallel. Responses are sent when they are
34f9b3eef6fdadbda0a846aa4d68691ac40eace5Roland Mainz ready, not necessarily in the order in which the queries were
<span class="command"><strong>managed-keys</strong></span>, <span class="command"><strong>dnssec-validation
Updated the compiled-in addresses for H.ROOT-SERVERS.NET
When using native PKCS#11 cryptography (i.e.,
(e.g., when a zone file cannot be loaded) have been clarified
The SIT-related named.conf options have been marked as
Retrieving the local port range from net.ipv4.ip_local_port_range
<strong class="userinput"><code>no</code></strong>, <span class="command"><strong>named</strong></span> will only
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>