Bv9ARM.ch09.html revision 7e5658b04f825bc8defa83d35864ef6a0cbb5262
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - Permission to use, copy, modify, and/or distribute this software for any
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - purpose with or without fee is hereby granted, provided that the above
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - copyright notice and this permission notice appear in all copies.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - PERFORMANCE OF THIS SOFTWARE.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<table width="100%" summary="Navigation header">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h1 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2"></a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_port">Porting Changes</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<span style="color: red"><title>Release Notes for BIND Version 9.11.0pre-alpha</title></span><div class="section">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This document summarizes changes since the last production release
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of BIND on the corresponding major release branch.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_download"></a>Download</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The latest versions of BIND 9 software can always be found at
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews There you will find additional information about each release,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews source code, and pre-compiled versions for Microsoft Windows
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews operating systems.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Insufficient testing when parsing a message allowed
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews records with an incorrect class to be be accepted,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews triggering a REQUIRE failure when those records
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews were subsequently cached. This flaw is disclosed
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in CVE-2015-8000. [RT #40987]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Incorrect reference counting could result in an INSIST
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews failure if a socket error occurred while performing a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews An incorrect boundary check in the OPENPGPKEY rdatatype
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews could trigger an assertion failure. This flaw is disclosed
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in CVE-2015-5986. [RT #40286]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A buffer accounting error could trigger an assertion failure
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews when parsing certain malformed DNSSEC keys.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This flaw was discovered by Hanno B�ck of the Fuzzing
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Project, and is disclosed in CVE-2015-5722. [RT #40212]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A specially crafted query could trigger an assertion failure
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This flaw was discovered by Jonathan Foote, and is disclosed
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in CVE-2015-5477. [RT #40046]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews On servers configured to perform DNSSEC validation, an
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews assertion failure could be triggered on answers from
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a specially configured server.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This flaw was discovered by Breno Silveira Soares, and is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews disclosed in CVE-2015-4620. [RT #39795]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews On servers configured to perform DNSSEC validation using
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews managed trust anchors (i.e., keys configured explicitly
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews via <span class="command"><strong>managed-keys</strong></span>, or implicitly
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews via <span class="command"><strong>dnssec-validation auto;</strong></span> or
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dnssec-lookaside auto;</strong></span>), revoking
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a trust anchor and sending a new untrusted replacement
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews could cause <span class="command"><strong>named</strong></span> to crash with an
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews assertion failure. This could occur in the event of a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews botched key rollover, or potentially as a result of a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews deliberate attack if the attacker was in position to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews monitor the victim's DNS traffic.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This flaw was discovered by Jan-Piet Mens, and is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews disclosed in CVE-2015-1349. [RT #38344]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A flaw in delegation handling could be exploited to put
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named</strong></span> into an infinite loop, in which
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews each lookup of a name server triggered additional lookups
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of more name servers. This has been addressed by placing
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews limits on the number of levels of recursion
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named</strong></span> will allow (default 7), and
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews on the number of queries that it will send before
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews terminating a recursive query (default 50).
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The recursion depth limit is configured via the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">max-recursion-depth</code> option, and the query limit
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews via the <code class="option">max-recursion-queries</code> option.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The flaw was discovered by Florian Maury of ANSSI, and is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews disclosed in CVE-2014-8500. [RT #37580]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Two separate problems were identified in BIND's GeoIP code that
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews could lead to an assertion failure. One was triggered by use of
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews both IPv4 and IPv6 address families, the other by referencing
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a GeoIP database in <code class="filename">named.conf</code> which was
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews not installed. Both are covered by CVE-2014-8680. [RT #37672]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A less serious security flaw was also found in GeoIP: changes
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to the <span class="command"><strong>geoip-directory</strong></span> option in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="filename">named.conf</code> were ignored when running
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>rndc reconfig</strong></span>. In theory, this could allow
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named</strong></span> to allow access to unintended clients.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Specific APL data could trigger an INSIST. This flaw
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews is disclosed in CVE-2015-8704. [RT #41396]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Certain errors that could be encountered when printing out
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews or logging an OPT record containing a CLIENT-SUBNET option
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews could be mishandled, resulting in an assertion failure.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This flaw is disclosed in CVE-2015-8705. [RT #41397]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_features"></a>New Features</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Added support for DynDB, a new interface for loading zone data
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews from an external database, developed by Red Hat for the FreeIPA
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews project. (Thanks in particular to Adam Tkac and Petr
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Spacek of Red Hat for the contribution.)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Unlike the existing DLZ and SDB interfaces, which provide a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews limited subset of database functionality within BIND —
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews translating DNS queries into real-time database lookups with
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews relatively poor performance and with no ability to handle
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews DNSSEC-signed data — DynDB is able to fully implement
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews and extend the database API used natively by BIND.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A DynDB module could pre-load data from an external data
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews source, then serve it with the same performance and
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews functionality as conventional BIND zones, and with the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews ability to take advantage of database features not
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews available in BIND, such as multi-master replication.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews New quotas have been added to limit the queries that are
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews sent by recursive resolvers to authoritative servers
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews experiencing denial-of-service attacks. When configured,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews these options can both reduce the harm done to authoritative
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews servers and also avoid the resource exhaustion that can be
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews experienced by recursives when they are being used as a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews vehicle for such an attack.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">fetches-per-server</code> limits the number of
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews simultaneous queries that can be sent to any single
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews authoritative server. The configured value is a starting
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews point; it is automatically adjusted downward if the server is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews partially or completely non-responsive. The algorithm used to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews adjust the quota can be configured via the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">fetch-quota-params</code> option.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">fetches-per-zone</code> limits the number of
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews simultaneous queries that can be sent for names within a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews single domain. (Note: Unlike "fetches-per-server", this
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews value is not self-tuning.)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Statistics counters have also been added to track the number
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of queries affected by these quotas.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Added support for <span class="command"><strong>dnstap</strong></span>, a fast,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews flexible method for capturing and logging DNS traffic,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews developed by Robert Edmonds at Farsight Security, Inc.,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews whose assistance is gratefully acknowledged.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews To enable <span class="command"><strong>dnstap</strong></span> at compile time,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the <span class="command"><strong>fstrm</strong></span> and <span class="command"><strong>protobuf-c</strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews libraries must be available, and BIND must be configured with
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A new utility <span class="command"><strong>dnstap-read</strong></span> has been added
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to allow <span class="command"><strong>dnstap</strong></span> data to be presented in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a human-readable format.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews For more information on <span class="command"><strong>dnstap</strong></span>, see
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews New statistics counters have been added to track traffic
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews sizes, as specified in RSSAC002. Query and response
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews message sizes are broken up into ranges of histogram buckets:
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews and 4096+. These values can be accessed via the XML and JSON
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews statistics channels at, for example,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <a class="link" href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <a class="link" href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The serial number of a dynamically updatable zone can
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews now be set using
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This is particularly useful with <code class="option">inline-signing</code>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews zones that have been reset. Setting the serial number to a value
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews larger than that on the slaves will trigger an AXFR-style
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews When answering recursive queries, SERVFAIL responses can now be
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews cached by the server for a limited time; subsequent queries for
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the same query name and type will return another SERVFAIL until
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the cache times out. This reduces the frequency of retries
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews when a query is persistently failing, which can be a burden
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews on recursive serviers. The SERVFAIL cache timeout is controlled
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews by <code class="option">servfail-ttl</code>, which defaults to 1 second
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews and has an upper limit of 30.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The new <span class="command"><strong>rndc nta</strong></span> command can now be used to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews set a "negative trust anchor" (NTA), disabling DNSSEC validation for
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a specific domain; this can be used when responses from a domain
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews are known to be failing validation due to administrative error
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews rather than because of a spoofing attack. NTAs are strictly
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews temporary; by default they expire after one hour, but can be
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews configured to last up to one week. The default NTA lifetime
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews can be changed by setting the <code class="option">nta-lifetime</code> in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="filename">named.conf</code>. When added, NTAs are stored in a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in order to persist across restarts of the <span class="command"><strong>named</strong></span> server.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The EDNS Client Subnet (ECS) option is now supported for
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews authoritative servers; if a query contains an ECS option then
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews elements can match against the the address encoded in the option.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This can be used to select a view for a query, so that different
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews answers can be provided depending on the client network.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The EDNS EXPIRE option has been implemented on the client
1bb2f53b9f74a8ca9812cbe9243ef41190b4da14Evan Hunt side, allowing a slave server to set the expiration timer
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews correctly when transferring zone data from another slave
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A new <code class="option">masterfile-style</code> zone option controls
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the formatting of text zone files: When set to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="literal">full</code>, the zone file will dumped in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews single-line-per-record format.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +ednsopt</strong></span> can now be used to set
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews arbitrary EDNS options in DNS requests.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +ednsflags</strong></span> can now be used to set
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews yet-to-be-defined EDNS flags in DNS requests.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +[no]ednsnegotiation</strong></span> can now be used enable /
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews disable EDNS version negotiation.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +header-only</strong></span> can now be used to send
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews queries without a question section.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +ttlunits</strong></span> causes <span class="command"><strong>dig</strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to print TTL values with time-unit suffixes: w, d, h, m, s for
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews weeks, days, hours, minutes, and seconds.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +zflag</strong></span> can be used to set the last
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews unassigned DNS header flag bit. This bit in normally zero.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews can now be used to set the DSCP code point in outgoing query
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +mapped</strong></span> can now be used to determine
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews if mapped IPv4 addresses can be used.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">serial-update-method</code> can now be set to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="literal">date</code>. On update, the serial number will
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews be set to the current date in YYYYMMDDNN format.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dnssec-signzone -N date</strong></span> also sets the serial
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews number to YYYYMMDDNN.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named -L <em class="replaceable"><code>filename</code></em></strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews causes <span class="command"><strong>named</strong></span> to send log messages to the specified file by
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews default instead of to the system log.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The rate limiter configured by the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">serial-query-rate</code> option no longer covers
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews NOTIFY messages; those are now separately controlled by
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">startup-notify-rate</code> (the latter of which
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews controls the rate of NOTIFY messages sent when the server
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews is first started up or reconfigured).
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The default number of tasks and client objects available
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews for serving lightweight resolver queries have been increased,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews and are now configurable via the new <code class="option">lwres-tasks</code>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews and <code class="option">lwres-clients</code> options in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="filename">named.conf</code>. [RT #35857]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Log output to files can now be buffered by specifying
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>buffered yes;</strong></span> when creating a channel.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>delv +tcp</strong></span> will exclusively use TCP when
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews sending queries.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named</strong></span> will now check to see whether
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews other name server processes are running before starting up.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews This is implemented in two ways: 1) by refusing to start
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews if the configured network interfaces all return "address
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in use", and 2) by attempting to acquire a lock on a file
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews specified by the <code class="option">lock-file</code> option or
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the <span class="command"><strong>-X</strong></span> command line option. The
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews default lock file is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="filename">/var/run/named/named.lock</code>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Specifying <code class="literal">none</code> will disable the lock
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>rndc delzone</strong></span> can now be applied to zones
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews which were configured in <code class="filename">named.conf</code>;
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews it is no longer restricted to zones which were added by
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>rndc addzone</strong></span>. (Note, however, that
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews this does not edit <code class="filename">named.conf</code>; the zone
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews must be removed from the configuration or it will return
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews when <span class="command"><strong>named</strong></span> is restarted or reloaded.)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>rndc modzone</strong></span> can be used to reconfigure
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a zone, using similar syntax to <span class="command"><strong>rndc addzone</strong></span>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>rndc showzone</strong></span> displays the current
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews configuration for a specified zone.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Added server-side support for pipelined TCP queries. Clients
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews may continue sending queries via TCP while previous queries are
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews processed in parallel. Responses are sent when they are
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews ready, not necessarily in the order in which the queries were
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews To revert to the former behavior for a particular
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews client address or range of addresses, specify the address prefix
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in the "keep-response-order" option. To revert to the former
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews behavior for all clients, use "keep-response-order { any; };".
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The new <span class="command"><strong>mdig</strong></span> command is a version of
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig</strong></span> that sends multiple pipelined
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews queries and then waits for responses, instead of sending one
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews query and waiting the response before sending the next. [RT #38261]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews To enable better monitoring and troubleshooting of RFC 5011
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews trust anchor management, the new <span class="command"><strong>rndc managed-keys</strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews can be used to check status of trust anchors or to force keys
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to be refreshed. Also, the managed-keys data file now has
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews easier-to-read comments. [RT #38458]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews An <span class="command"><strong>--enable-querytrace</strong></span> configure switch is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews now available to enable very verbose query tracelogging. This
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews option can only be set at compile time. This option has a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews negative performance impact and should be used only for
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews debugging. [RT #37520]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A new <span class="command"><strong>tcp-only</strong></span> option can be specified
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in <span class="command"><strong>server</strong></span> statements to force
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named</strong></span> to connect to the specified
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews server via TCP. [RT #37800]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The <span class="command"><strong>nxdomain-redirect</strong></span> option specifies
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a DNS namespace to use for NXDOMAIN redirection. When a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews recursive lookup returns NXDOMAIN, a second lookup is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews initiated with the specified name appended to the query
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews name. This allows NXDOMAIN redirection data to be supplied
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews by multiple zones configured on the server or by recursive
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews queries to other servers. (The older method, using
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a single <span class="command"><strong>type redirect</strong></span> zone, has
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews better average performance but is less flexible.) [RT #37989]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The following types have been implemented: CSYNC, NINFO, RKEY,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews SINK, TA, TALINK.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A new <span class="command"><strong>message-compression</strong></span> option can be
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews used to specify whether or not to use name compression when
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews answering queries. Setting this to <strong class="userinput"><code>no</code></strong>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews results in larger responses, but reduces CPU consumption and
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews may improve throughput. The default is <strong class="userinput"><code>yes</code></strong>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A "read-only" clause is now available for non-destructive
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews control channel access. In such cases, a restricted set of
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews rndc commands are allowed for querying information from named.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews By default, control channel access is read-write.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The timers returned by the statistics channel (indicating current
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews time, server boot time, and most recent reconfiguration time) are
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews now reported with millisecond accuracy. [RT #40082]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Updated the compiled in addresses for H.ROOT-SERVERS.NET.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews ACLs containing <span class="command"><strong>geoip asnum</strong></span> elements were
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews not correctly matched unless the full organization name was
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews specified in the ACL (as in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>geoip asnum "AS1234 Example, Inc.";</strong></span>).
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews They can now match against the AS number alone (as in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>geoip asnum "AS1234";</strong></span>).
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews When using native PKCS#11 cryptography (i.e.,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>configure --enable-native-pkcs11</strong></span>) HSM PINs
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of up to 256 characters can now be used.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews NXDOMAIN responses to queries of type DS are now cached separately
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews from those for other types. This helps when using "grafted" zones
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of type forward, for which the parent zone does not contain a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews delegation, such as local top-level domains. Previously a query
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of type DS for such a zone could cause the zone apex to be cached
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews as NXDOMAIN, blocking all subsequent queries. (Note: This
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews change is only helpful when DNSSEC validation is not enabled.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews "Grafted" zones without a delegation in the parent are not a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews recommended configuration.)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Update forwarding performance has been improved by allowing
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a single TCP connection to be shared between multiple updates.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews By default, <span class="command"><strong>nsupdate</strong></span> will now check
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the correctness of hostnames when adding records of type
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews disabled with <span class="command"><strong>check-names no</strong></span>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Added support for OPENPGPKEY type.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The names of the files used to store managed keys and added
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews zones for each view are no longer based on the SHA256 hash
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of the view name, except when this is necessary because the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews view name contains characters that would be incompatible with use
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews as a file name. For views whose names do not contain forward
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews slashes ('/'), backslashes ('\'), or capital letters - which
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews could potentially cause namespace collision problems on
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews case-insensitive filesystems - files will now be named
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews after the view (for example, <code class="filename">internal.mkeys</code>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews or <code class="filename">external.nzf</code>). However, to ensure
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews consistent behavior when upgrading, if a file using the old
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews name format is found to exist, it will continue to be used.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews "rndc" can now return text output of arbitrary size to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the caller. (Prior to this, certain commands such as
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews "rndc tsig-list" and "rndc zonestatus" could return
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews truncated output.)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Errors reported when running <span class="command"><strong>rndc addzone</strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews (e.g., when a zone file cannot be loaded) have been clarified
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to make it easier to diagnose problems.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews When encountering an authoritative name server whose name is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews an alias pointing to another name, the resolver treats
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews this as an error and skips to the next server. Previously
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews this happened silently; now the error will be logged to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the newly-created "cname" log category.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews If <span class="command"><strong>named</strong></span> is not configured to validate the answer then
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews allow fallback to plain DNS on timeout even when we know
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the server supports EDNS. This will allow the server to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews potentially resolve signed queries when TCP is being
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Large inline-signing changes should be less disruptive.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Signature generation is now done incrementally; the number
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of signatures to be generated in each quantum is controlled
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews by "sig-signing-signatures <em class="replaceable"><code>number</code></em>;".
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The experimental SIT option (code point 65001) of BIND
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews 9.10.0 through BIND 9.10.2 has been replaced with the COOKIE
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews option (code point 10). It is no longer experimental, and
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews is sent by default, by both <span class="command"><strong>named</strong></span> and
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig</strong></span>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The SIT-related named.conf options have been marked as
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews obsolete, and are otherwise ignored.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews When <span class="command"><strong>dig</strong></span> receives a truncated (TC=1)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews response or a BADCOOKIE response code from a server, it
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews will automatically retry the query using the server COOKIE
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews that was returned by the server in its initial response.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A alternative NXDOMAIN redirect method (nxdomain-redirect)
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews which allows the redirect information to be looked up from
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a namespace on the Internet rather than requiring a zone
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to be configured on the server is now available.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Retrieving the local port range from net.ipv4.ip_local_port_range
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews on Linux is now supported.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Within the <code class="option">response-policy</code> option, it is now
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews possible to configure RPZ rewrite logging on a per-zone basis
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews using the <code class="option">log</code> clause.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The default preferred glue is now the address type of the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews transport the query was received over.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews On machines with 2 or more processors (CPU), the default value
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews for the number of UDP listeners has been changed to the number
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of detected processors minus one.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Zone transfers now use smaller message sizes to improve
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews message compression. This results in reduced network usage.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_port"></a>Porting Changes</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The Microsoft Windows install tool
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>BINDInstall.exe</strong></span> which requires a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews non-free version of Visual Studio to be built, now uses two
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews files (lists of flags and files) created by the Configure
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews perl script with all the needed information which were
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews previously compiled in the binary. Read
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="filename">win32utils/build.txt</code> for more details.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A flag could be set in the wrong field when setting up
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews nonrecursive queries; this could cause the SERVFAIL cache to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews cache responses it shouldn't. New querytrace logging has been
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews added which identified this error. [RT #41155]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The server could crash due to a use-after-free if a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews zone transfer timed out. [RT #41297]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Authoritative servers that were marked as bogus (e.g. blackholed
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in configuration or with invalid addresses) were being queried
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews anyway. [RT #41321]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Some of the options for GeoIP ACLs, including "areacode",
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews "metrocode", and "timezone", were incorrectly documented
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews as "area", "metro" and "tz". Both the long and abbreviated
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews versions are now accepted.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig</strong></span>, <span class="command"><strong>host</strong></span> and
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>nslookup</strong></span> aborted when encountering
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews a name which, after appending search list elements,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews exceeded 255 bytes. Such names are now skipped, but
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews processing of other names will continue. [RT #36892]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The error message generated when
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named-checkzone</strong></span> or
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>named-checkconf -z</strong></span> encounters a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">$TTL</code> directive without a value has
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews been clarified. [RT #37138]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Semicolon characters (;) included in TXT records were
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews incorrectly escaped with a backslash when the record was
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews displayed as text. This is actually only necessary when there
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews are no quotation marks. [RT #37159]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews When files opened for writing by <span class="command"><strong>named</strong></span>,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews such as zone journal files, were referenced more than once
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in <code class="filename">named.conf</code>, it could lead to file
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews corruption as multiple threads wrote to the same file. This
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews is now detected when loading <code class="filename">named.conf</code>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews and reported as an error. [RT #37172]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews When checking for updates to trust anchors listed in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <code class="option">managed-keys</code>, <span class="command"><strong>named</strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews now revalidates keys based on the current set of
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews active trust anchors, without relying on any cached
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews record of previous validation. [RT #37506]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Large-system tuning
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews (<span class="command"><strong>configure --with-tuning=large</strong></span>) caused
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews problems on some platforms by setting a socket receive
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews buffer size that was too large. This is now detected and
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews corrected at run time. [RT #37187]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews When NXDOMAIN redirection is in use, queries for a name
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews that is present in the redirection zone but a type that
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews is not present will now return NOERROR instead of NXDOMAIN.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Due to an inadvertent removal of code in the previous
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews release, when <span class="command"><strong>named</strong></span> encountered an
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews authoritative name server which dropped all EDNS queries,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews it did not always try plain DNS. This has been corrected.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A regression caused nsupdate to use the default recursive servers
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews rather than the SOA MNAME server when sending the UPDATE.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Adjusted max-recursion-queries to accommodate the smaller
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews initial packet sizes used in BIND 9.10 and higher when
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews contacting authoritative servers for the first time.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Built-in "empty" zones did not correctly inherit the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews "allow-transfer" ACL from the options or view. [RT #38310]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Two leaks were fixed that could cause <span class="command"><strong>named</strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews processes to grow to very large sizes. [RT #38454]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Fixed some bugs in RFC 5011 trust anchor management,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews including a memory leak and a possible loss of state
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews information. [RT #38458]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Asynchronous zone loads were not handled correctly when the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews zone load was already in progress; this could trigger a crash
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in zt.c. [RT #37573]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews A race during shutdown or reconfiguration could
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews cause an assertion failure in mem.c. [RT #38979]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Some answer formatting options didn't work correctly with
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>dig +short</strong></span>. [RT #39291]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Several bugs have been fixed in the RPZ implementation:
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Policy zones that did not specifically require recursion
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews could be treated as if they did; consequently, setting
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <span class="command"><strong>qname-wait-recurse no;</strong></span> was
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews sometimes ineffective. This has been corrected.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews In most configurations, behavioral changes due to this
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews fix will not be noticeable. [RT #39229]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The server could crash if policy zones were updated (e.g.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews via <span class="command"><strong>rndc reload</strong></span> or an incoming zone
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews transfer) while RPZ processing was still ongoing for an
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews active query. [RT #39415]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews On servers with one or more policy zones configured as
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews slaves, if a policy zone updated during regular operation
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews (rather than at startup) using a full zone reload, such as
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews via AXFR, a bug could allow the RPZ summary data to fall out
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews of sync, potentially leading to an assertion failure in
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews rpz.c when further incremental updates were made to the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews zone, such as via IXFR. [RT #39567]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The server could match a shorter prefix than what was
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews available in CLIENT-IP policy triggers, and so, an
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews unexpected action could be taken. This has been
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews corrected. [RT #39481]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The server could crash if a reload of an RPZ zone was
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews initiated while another reload of the same zone was
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews already in progress. [RT #39649]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Negative trust anchors (NTAs) were incorrectly deleted
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews when the server was reloaded or reconfigured. [RT #41058]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Zones configured to use <span class="command"><strong>map</strong></span> format
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews master files can't be used as policy zones because RPZ
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews summary data isn't compiled when such zones are mapped into
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews memory. This limitation may be fixed in a future release,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews but in the meantime it has been documented, and attempting
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to use such zones in <span class="command"><strong>response-policy</strong></span>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews statements is now a configuration error. [RT #38321]
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="end_of_life"></a>End of Life</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews The end of life for BIND 9.11 is yet to be determined but
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews will not be before BIND 9.13.0 has been released for 6 months.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<div class="titlepage"><div><div><h3 class="title">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Thank you to everyone who assisted us in making this release possible.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews If you would like to contribute to ISC to assist us in continuing to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews make quality open source software, please visit our donations page at
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<table width="100%" summary="Navigation footer">
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0pre-alpha</p>