Bv9ARM.ch09.html revision d5ece58e3bb75eb2dff7802f5ce9904dc4dce05f
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - Copyright (C) 2000-2003 Internet Software Consortium.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - Permission to use, copy, modify, and/or distribute this software for any
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - purpose with or without fee is hereby granted, provided that the above
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - copyright notice and this permission notice appear in all copies.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
f78b12e570284aa8291f4ca1add24937fd107403vboxsync - PERFORMANCE OF THIS SOFTWARE.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<!-- $Id$ -->
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<link rel="next" href="Bv9ARM.ch10.html" title="Manual pages">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<tr><th colspan="3" align="center">Appendix�A.�Appendices</th></tr>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="Bv9ARM.ch09"></a>Appendix�A.�Appendices</h2></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2580014">Release Notes for BIND Version 9.11.0pre-alpha</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2607733">Acknowledgments</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2607905">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2611116">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch09.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613271">Prerequisite</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613281">Compilation</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613305">Installation</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613814">Known Defects/Restrictions</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613891">The dns.conf File</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613917">Sample Applications</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2615095">Library References</a></span></dt>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="id2580014"></a>Release Notes for BIND Version 9.11.0pre-alpha</h2></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync This document summarizes changes since the last production release
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of BIND on the corresponding major release branch.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="relnotes_download"></a>Download</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The latest versions of BIND 9 software can always be found at
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <a href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync There you will find additional information about each release,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync source code, and pre-compiled versions for Microsoft Windows
f78b12e570284aa8291f4ca1add24937fd107403vboxsync operating systems.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync A flaw in delegation handling could be exploited to put
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">named</strong></span> into an infinite loop, in which
f78b12e570284aa8291f4ca1add24937fd107403vboxsync each lookup of a name server triggered additional lookups
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of more name servers. This has been addressed by placing
f78b12e570284aa8291f4ca1add24937fd107403vboxsync limits on the number of levels of recursion
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">named</strong></span> will allow (default 7), and
f78b12e570284aa8291f4ca1add24937fd107403vboxsync on the number of queries that it will send before
f78b12e570284aa8291f4ca1add24937fd107403vboxsync terminating a recursive query (default 50).
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The recursion depth limit is configured via the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="option">max-recursion-depth</code> option, and the query limit
f78b12e570284aa8291f4ca1add24937fd107403vboxsync via the <code class="option">max-recursion-queries</code> option.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The flaw was discovered by Florian Maury of ANSSI, and is
f78b12e570284aa8291f4ca1add24937fd107403vboxsync disclosed in CVE-2014-8500. [RT #37580]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Two separate problems were identified in BIND's GeoIP code that
f78b12e570284aa8291f4ca1add24937fd107403vboxsync could lead to an assertion failure. One was triggered by use of
f78b12e570284aa8291f4ca1add24937fd107403vboxsync both IPv4 and IPv6 address families, the other by referencing
f78b12e570284aa8291f4ca1add24937fd107403vboxsync a GeoIP database in <code class="filename">named.conf</code> which was
f78b12e570284aa8291f4ca1add24937fd107403vboxsync not installed. Both are covered by CVE-2014-8680. [RT #37672]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync [RT #37679]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync A less serious security flaw was also found in GeoIP: changes
f78b12e570284aa8291f4ca1add24937fd107403vboxsync to the <span><strong class="command">geoip-directory</strong></span> option in
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="filename">named.conf</code> were ignored when running
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">rndc reconfig</strong></span>. In theory, this could allow
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">named</strong></span> to allow access to unintended clients.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="relnotes_features"></a>New Features</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The serial number of a dynamically updatable zone can
f78b12e570284aa8291f4ca1add24937fd107403vboxsync now be set using
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync This is particularly useful with <code class="option">inline-signing</code>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync zones that have been reset. Setting the serial number to a value
f78b12e570284aa8291f4ca1add24937fd107403vboxsync larger than that on the slaves will trigger an AXFR-style
f78b12e570284aa8291f4ca1add24937fd107403vboxsync When answering recursive queries, SERVFAIL responses can now be
f78b12e570284aa8291f4ca1add24937fd107403vboxsync cached by the server for a limited time; subsequent queries for
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the same query name and type will return another SERVFAIL until
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the cache times out. This reduces the frequency of retries
f78b12e570284aa8291f4ca1add24937fd107403vboxsync when a query is persistently failing, which can be a burden
f78b12e570284aa8291f4ca1add24937fd107403vboxsync on recursive serviers. The SERVFAIL cache timeout is controlled
f78b12e570284aa8291f4ca1add24937fd107403vboxsync by <code class="option">servfail-ttl</code>, which defaults to 10 seconds
f78b12e570284aa8291f4ca1add24937fd107403vboxsync and has an upper limit of 30.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The new <span><strong class="command">rndc nta</strong></span> command can now be used to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync set a "negative trust anchor" (NTA), disabling DNSSEC validation for
f78b12e570284aa8291f4ca1add24937fd107403vboxsync a specific domain; this can be used when responses from a domain
f78b12e570284aa8291f4ca1add24937fd107403vboxsync are known to be failing validation due to administrative error
f78b12e570284aa8291f4ca1add24937fd107403vboxsync rather than because of a spoofing attack. NTAs are strictly
f78b12e570284aa8291f4ca1add24937fd107403vboxsync temporary; by default they expire after one hour, but can be
f78b12e570284aa8291f4ca1add24937fd107403vboxsync configured to last up to one week. The default NTA lifetime
f78b12e570284aa8291f4ca1add24937fd107403vboxsync can be changed by setting the <code class="option">nta-lifetime</code> in
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The EDNS Client Subnet (ECS) option is now supported for
f78b12e570284aa8291f4ca1add24937fd107403vboxsync authoritative servers; if a query contains an ECS option then
f78b12e570284aa8291f4ca1add24937fd107403vboxsync ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync elements can match against the the address encoded in the option.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync This can be used to select a view for a query, so that different
f78b12e570284aa8291f4ca1add24937fd107403vboxsync answers can be provided depending on the client network.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The EDNS EXPIRE option has been implemented on the client
f78b12e570284aa8291f4ca1add24937fd107403vboxsync side, allowing a slave server to set the expiration timer
f78b12e570284aa8291f4ca1add24937fd107403vboxsync correctly when transferring zone data from another slave
f78b12e570284aa8291f4ca1add24937fd107403vboxsync A new <code class="option">masterfile-style</code> zone option controls
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the formatting of text zone files: When set to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="literal">full</code>, the zone file will dumped in
f78b12e570284aa8291f4ca1add24937fd107403vboxsync single-line-per-record format.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig +ednsopt</strong></span> can now be used to set
f78b12e570284aa8291f4ca1add24937fd107403vboxsync arbitrary EDNS options in DNS requests.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig +ednsflags</strong></span> can now be used to set
f78b12e570284aa8291f4ca1add24937fd107403vboxsync yet-to-be-defined EDNS flags in DNS requests.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig +[no]ednsnegotiation</strong></span> can now be used enable /
f78b12e570284aa8291f4ca1add24937fd107403vboxsync disable EDNS version negotiation.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig +header-only</strong></span> can now be used to send
f78b12e570284aa8291f4ca1add24937fd107403vboxsync queries without a question section.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig +ttlunits</strong></span> causes <span><strong class="command">dig</strong></span>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync to print TTL values with time-unit suffixes: w, d, h, m, s for
f78b12e570284aa8291f4ca1add24937fd107403vboxsync weeks, days, hours, minutes, and seconds.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig +zflag</strong></span> can be used to set the last
f78b12e570284aa8291f4ca1add24937fd107403vboxsync unassigned DNS header flag bit. This bit in normally zero.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync can now be used to set the DSCP code point in outgoing query
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="option">serial-update-method</code> can now be set to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="literal">date</code>. On update, the serial number will
f78b12e570284aa8291f4ca1add24937fd107403vboxsync be set to the current date in YYYYMMDDNN format.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dnssec-signzone -N date</strong></span> also sets the serial
f78b12e570284aa8291f4ca1add24937fd107403vboxsync number to YYYYMMDDNN.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">named -L <em class="replaceable"><code>filename</code></em></strong></span>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync causes named to send log messages to the specified file by
f78b12e570284aa8291f4ca1add24937fd107403vboxsync default instead of to the system log.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The rate limiter configured by the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="option">serial-query-rate</code> option no longer covers
f78b12e570284aa8291f4ca1add24937fd107403vboxsync NOTIFY messages; those are now separately controlled by
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="option">startup-notify-rate</code> (the latter of which
f78b12e570284aa8291f4ca1add24937fd107403vboxsync controls the rate of NOTIFY messages sent when the server
f78b12e570284aa8291f4ca1add24937fd107403vboxsync is first started up or reconfigured).
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The default number of tasks and client objects available
f78b12e570284aa8291f4ca1add24937fd107403vboxsync for serving lightweight resolver queries have been increased,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync and are now configurable via the new <code class="option">lwres-tasks</code>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync and <code class="option">lwres-clients</code> options in
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="filename">named.conf</code>. [RT #35857]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Log output to files can now be buffered by specifying
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">buffered yes;</strong></span> when creating a channel.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">delv +tcp</strong></span> will exclusively use TCP when
f78b12e570284aa8291f4ca1add24937fd107403vboxsync sending queries.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">named</strong></span> will now check to see whether
f78b12e570284aa8291f4ca1add24937fd107403vboxsync other name server processes are running before starting up.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync This is implemented in two ways: 1) by refusing to start
f78b12e570284aa8291f4ca1add24937fd107403vboxsync if the configured network interfaces all return "address
f78b12e570284aa8291f4ca1add24937fd107403vboxsync in use", and 2) by acquiring a file lock on
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="filename">/var/run/named/named.lock</code>, or on a different
f78b12e570284aa8291f4ca1add24937fd107403vboxsync file specified via the <span><strong class="command">named -X</strong></span> command
f78b12e570284aa8291f4ca1add24937fd107403vboxsync line option.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
f78b12e570284aa8291f4ca1add24937fd107403vboxsync not correctly matched unless the full organization name was
f78b12e570284aa8291f4ca1add24937fd107403vboxsync specified in the ACL (as in
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
f78b12e570284aa8291f4ca1add24937fd107403vboxsync They can now match against the AS number alone (as in
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">geoip asnum "AS1234";</strong></span>).
f78b12e570284aa8291f4ca1add24937fd107403vboxsync When using native PKCS#11 cryptography (i.e.,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of up to 256 characters can now be used.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync NXDOMAIN responses to queries of type DS are now cached separately
f78b12e570284aa8291f4ca1add24937fd107403vboxsync from those for other types. This helps when using "grafted" zones
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of type forward, for which the parent zone does not contain a
f78b12e570284aa8291f4ca1add24937fd107403vboxsync delegation, such as local top-level domains. Previously a query
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of type DS for such a zone could cause the zone apex to be cached
f78b12e570284aa8291f4ca1add24937fd107403vboxsync as NXDOMAIN, blocking all subsequent queries. (Note: This
f78b12e570284aa8291f4ca1add24937fd107403vboxsync change is only helpful when DNSSEC validation is not enabled.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync "Grafted" zones without a delegation in the parent are not a
f78b12e570284aa8291f4ca1add24937fd107403vboxsync recommended configuration.)
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Update forwarding performance has been improved by allowing
f78b12e570284aa8291f4ca1add24937fd107403vboxsync a single TCP connection to be shared between multiple updates.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync By default, <span><strong class="command">nsupdate</strong></span> will now check
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the correctness of hostnames when adding records of type
f78b12e570284aa8291f4ca1add24937fd107403vboxsync A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
f78b12e570284aa8291f4ca1add24937fd107403vboxsync disabled with <span><strong class="command">check-names no</strong></span>.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Added support for OPENPGPKEY type.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The names of the files used to store managed keys and added
f78b12e570284aa8291f4ca1add24937fd107403vboxsync zones for each view are no longer based on the SHA256 hash
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of the view name, except when this is necessary because the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync view name contains characters that would be incompatible with use
f78b12e570284aa8291f4ca1add24937fd107403vboxsync as a file name. For views whose names do not contain forward
f78b12e570284aa8291f4ca1add24937fd107403vboxsync slashes ('/'), backslashes ('\'), or capital letters - which
f78b12e570284aa8291f4ca1add24937fd107403vboxsync could potentially cause namespace collision problems on
f78b12e570284aa8291f4ca1add24937fd107403vboxsync case-insensitive filesystems - files will now be named
f78b12e570284aa8291f4ca1add24937fd107403vboxsync after the view (for example, <code class="filename">internal.mkeys</code>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync or <code class="filename">external.nzf</code>). However, to ensure
f78b12e570284aa8291f4ca1add24937fd107403vboxsync consistent behavior when upgrading, if a file using the old
f78b12e570284aa8291f4ca1add24937fd107403vboxsync name format is found to exist, it will continue to be used.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync "rndc" can now return text output of arbitrary size to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the caller. (Prior to this, certain commands such as
f78b12e570284aa8291f4ca1add24937fd107403vboxsync "rndc tsig-list" and "rndc zonestatus" could return
f78b12e570284aa8291f4ca1add24937fd107403vboxsync truncated output.)
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Errors reported when running <span><strong class="command">rndc addzone</strong></span>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync (e.g., when a zone file cannot be loaded) have been clarified
f78b12e570284aa8291f4ca1add24937fd107403vboxsync to make it easier to diagnose problems.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync When encountering an authoritative name server whose name is
f78b12e570284aa8291f4ca1add24937fd107403vboxsync an alias pointing to another name, the resolver treats
f78b12e570284aa8291f4ca1add24937fd107403vboxsync this as an error and skips to the next server. Previously
f78b12e570284aa8291f4ca1add24937fd107403vboxsync this happened silently; now the error will be logged to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the newly-created "cname" log category.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync If named is not configured to validate the answer then
f78b12e570284aa8291f4ca1add24937fd107403vboxsync allow fallback to plain DNS on timeout even when we know
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the server supports EDNS. This will allow the server to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync potentially resolve signed queries when TCP is being
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">nslookup</strong></span> aborted when encountering
f78b12e570284aa8291f4ca1add24937fd107403vboxsync a name which, after appending search list elements,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync exceeded 255 bytes. Such names are now skipped, but
f78b12e570284aa8291f4ca1add24937fd107403vboxsync processing of other names will continue. [RT #36892]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The error message generated when
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">named-checkzone</strong></span> or
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span><strong class="command">named-checkconf -z</strong></span> encounters a
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="option">$TTL</code> directive without a value has
f78b12e570284aa8291f4ca1add24937fd107403vboxsync been clarified. [RT #37138]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Semicolon characters (;) included in TXT records were
f78b12e570284aa8291f4ca1add24937fd107403vboxsync incorrectly escaped with a backslash when the record was
f78b12e570284aa8291f4ca1add24937fd107403vboxsync displayed as text. This is actually only necessary when there
f78b12e570284aa8291f4ca1add24937fd107403vboxsync are no quotation marks. [RT #37159]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync When files opened for writing by <span><strong class="command">named</strong></span>,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync such as zone journal files, were referenced more than once
f78b12e570284aa8291f4ca1add24937fd107403vboxsync in <code class="filename">named.conf</code>, it could lead to file
f78b12e570284aa8291f4ca1add24937fd107403vboxsync corruption as multiple threads wrote to the same file. This
f78b12e570284aa8291f4ca1add24937fd107403vboxsync is now detected when loading <code class="filename">named.conf</code>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync and reported as an error. [RT #37172]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync When checking for updates to trust anchors listed in
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync now revalidates keys based on the current set of
f78b12e570284aa8291f4ca1add24937fd107403vboxsync active trust anchors, without relying on any cached
f78b12e570284aa8291f4ca1add24937fd107403vboxsync record of previous validation. [RT #37506]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Large-system tuning
f78b12e570284aa8291f4ca1add24937fd107403vboxsync (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
f78b12e570284aa8291f4ca1add24937fd107403vboxsync problems on some platforms by setting a socket receive
f78b12e570284aa8291f4ca1add24937fd107403vboxsync buffer size that was too large. This is now detected and
f78b12e570284aa8291f4ca1add24937fd107403vboxsync corrected at run time. [RT #37187]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync When NXDOMAIN redirection is in use, queries for a name
f78b12e570284aa8291f4ca1add24937fd107403vboxsync that is present in the redirection zone but a type that
f78b12e570284aa8291f4ca1add24937fd107403vboxsync is not present will now return NOERROR instead of NXDOMAIN.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Due to an inadvertent removal of code in the previous
f78b12e570284aa8291f4ca1add24937fd107403vboxsync release, when <span><strong class="command">named</strong></span> encountered an
f78b12e570284aa8291f4ca1add24937fd107403vboxsync authoritative name server which dropped all EDNS queries,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync it did not always try plain DNS. This has been corrected.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync [RT #37965]
f78b12e570284aa8291f4ca1add24937fd107403vboxsync A regression caused nsupdate to use the default recursive servers
f78b12e570284aa8291f4ca1add24937fd107403vboxsync rather than the SOA MNAME server when sending the UPDATE.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Adjusted max-recursion-queries to accommodate the smaller
f78b12e570284aa8291f4ca1add24937fd107403vboxsync initial packet sizes used in BIND 9.10 and higher when
f78b12e570284aa8291f4ca1add24937fd107403vboxsync contacting authoritative servers for the first time.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="end_of_life"></a>End of Life</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The end of life for BIND 9.11 is yet to be determined but
f78b12e570284aa8291f4ca1add24937fd107403vboxsync will not be before BIND 9.13.0 has been released for 6 months.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <a href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Thank you to everyone who assisted us in making this release possible.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync If you would like to contribute to ISC to assist us in continuing to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync make quality open source software, please visit our donations page at
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <a href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="id2607733"></a>Acknowledgments</h2></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="historical_dns_information"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Although the "official" beginning of the Domain Name
f78b12e570284aa8291f4ca1add24937fd107403vboxsync System occurred in 1984 with the publication of RFC 920, the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync core of the new system was described in 1983 in RFCs 882 and
f78b12e570284aa8291f4ca1add24937fd107403vboxsync 883. From 1984 to 1987, the ARPAnet (the precursor to today's
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Internet) became a testbed of experimentation for developing the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync new naming/addressing scheme in a rapidly expanding,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync operational network environment. New RFCs were written and
f78b12e570284aa8291f4ca1add24937fd107403vboxsync published in 1987 that modified the original documents to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync incorporate improvements based on the working model. RFC 1034,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync "Domain Names-Concepts and Facilities", and RFC 1035, "Domain
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Names-Implementation and Specification" were published and
f78b12e570284aa8291f4ca1add24937fd107403vboxsync became the standards upon which all <acronym class="acronym">DNS</acronym> implementations are
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The first working domain name server, called "Jeeves", was
f78b12e570284aa8291f4ca1add24937fd107403vboxsync written in 1983-84 by Paul Mockapetris for operation on DEC
f78b12e570284aa8291f4ca1add24937fd107403vboxsync machines located at the University of Southern California's
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Information
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Sciences Institute (USC-ISI) and SRI International's Network
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Information
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Center (SRI-NIC). A <acronym class="acronym">DNS</acronym> server for
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Unix machines, the Berkeley Internet
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Name Domain (<acronym class="acronym">BIND</acronym>) package, was
f78b12e570284aa8291f4ca1add24937fd107403vboxsync written soon after by a group of
f78b12e570284aa8291f4ca1add24937fd107403vboxsync graduate students at the University of California at Berkeley
f78b12e570284aa8291f4ca1add24937fd107403vboxsync a grant from the US Defense Advanced Research Projects
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Administration
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Versions of <acronym class="acronym">BIND</acronym> through
f78b12e570284aa8291f4ca1add24937fd107403vboxsync 4.8.3 were maintained by the Computer
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Painter, David Riggle and Songnian Zhou made up the initial <acronym class="acronym">BIND</acronym>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync project team. After that, additional work on the software package
f78b12e570284aa8291f4ca1add24937fd107403vboxsync was done by Ralph Campbell. Kevin Dunlap, a Digital Equipment
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Corporation
f78b12e570284aa8291f4ca1add24937fd107403vboxsync employee on loan to the CSRG, worked on <acronym class="acronym">BIND</acronym> for 2 years, from 1985
f78b12e570284aa8291f4ca1add24937fd107403vboxsync to 1987. Many other people also contributed to <acronym class="acronym">BIND</acronym> development
f78b12e570284aa8291f4ca1add24937fd107403vboxsync during that time: Doug Kingston, Craig Partridge, Smoot
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Carl-Mitchell,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Mike Muuss, Jim Bloom and Mike Schwartz. <acronym class="acronym">BIND</acronym> maintenance was subsequently
f78b12e570284aa8291f4ca1add24937fd107403vboxsync handled by Mike Karels and �ivind Kure.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <acronym class="acronym">BIND</acronym> versions 4.9 and 4.9.1 were
f78b12e570284aa8291f4ca1add24937fd107403vboxsync released by Digital Equipment
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Corporation (now Compaq Computer Corporation). Paul Vixie, then
f78b12e570284aa8291f4ca1add24937fd107403vboxsync a DEC employee, became <acronym class="acronym">BIND</acronym>'s
f78b12e570284aa8291f4ca1add24937fd107403vboxsync primary caretaker. He was assisted
f78b12e570284aa8291f4ca1add24937fd107403vboxsync by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Beecher, Andrew
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Wolfhugel, and others.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync In 1994, <acronym class="acronym">BIND</acronym> version 4.9.2 was sponsored by
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Vixie Enterprises. Paul
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Vixie became <acronym class="acronym">BIND</acronym>'s principal
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <acronym class="acronym">BIND</acronym> versions from 4.9.3 onward
f78b12e570284aa8291f4ca1add24937fd107403vboxsync have been developed and maintained
f78b12e570284aa8291f4ca1add24937fd107403vboxsync by the Internet Systems Consortium and its predecessor,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync the Internet Software Consortium, with support being provided
f78b12e570284aa8291f4ca1add24937fd107403vboxsync by ISC's sponsors.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Paul Vixie released the first production-ready version of
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <acronym class="acronym">BIND</acronym> version 8 in May 1997.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync BIND version 9 was released in September 2000 and is a
f78b12e570284aa8291f4ca1add24937fd107403vboxsync major rewrite of nearly all aspects of the underlying
f78b12e570284aa8291f4ca1add24937fd107403vboxsync BIND architecture.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync BIND versions 4 and 8 are officially deprecated.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync No additional development is done
f78b12e570284aa8291f4ca1add24937fd107403vboxsync on BIND version 4 or BIND version 8.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <acronym class="acronym">BIND</acronym> development work is made
f78b12e570284aa8291f4ca1add24937fd107403vboxsync possible today by the sponsorship
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of several corporations, and by the tireless work efforts of
f78b12e570284aa8291f4ca1add24937fd107403vboxsync numerous individuals.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="id2607905"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync<a name="ipv6addresses"></a>IPv6 addresses (AAAA)</h3></div></div></div>
f78b12e570284aa8291f4ca1add24937fd107403vboxsync IPv6 addresses are 128-bit identifiers for interfaces and
f78b12e570284aa8291f4ca1add24937fd107403vboxsync sets of interfaces which were introduced in the <acronym class="acronym">DNS</acronym> to facilitate
f78b12e570284aa8291f4ca1add24937fd107403vboxsync scalable Internet routing. There are three types of addresses: <span class="emphasis"><em>Unicast</em></span>,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync an identifier for a single interface;
f78b12e570284aa8291f4ca1add24937fd107403vboxsync an identifier for a set of interfaces; and <span class="emphasis"><em>Multicast</em></span>,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync an identifier for a set of interfaces. Here we describe the global
f78b12e570284aa8291f4ca1add24937fd107403vboxsync Unicast address scheme. For more information, see RFC 3587,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync "Global Unicast Address Format."
f78b12e570284aa8291f4ca1add24937fd107403vboxsync IPv6 unicast addresses consist of a
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span class="emphasis"><em>global routing prefix</em></span>, a
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span class="emphasis"><em>subnet identifier</em></span>, and an
f78b12e570284aa8291f4ca1add24937fd107403vboxsync <span class="emphasis"><em>interface identifier</em></span>.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The global routing prefix is provided by the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync upstream provider or ISP, and (roughly) corresponds to the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync IPv4 <span class="emphasis"><em>network</em></span> section
f78b12e570284aa8291f4ca1add24937fd107403vboxsync of the address range.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The subnet identifier is for local subnetting, much the
f78b12e570284aa8291f4ca1add24937fd107403vboxsync same as subnetting an
f78b12e570284aa8291f4ca1add24937fd107403vboxsync IPv4 /16 network into /24 subnets.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The interface identifier is the address of an individual
f78b12e570284aa8291f4ca1add24937fd107403vboxsync interface on a given network; in IPv6, addresses belong to
f78b12e570284aa8291f4ca1add24937fd107403vboxsync interfaces rather than to machines.
f78b12e570284aa8291f4ca1add24937fd107403vboxsync The subnetting capability of IPv6 is much more flexible than
f78b12e570284aa8291f4ca1add24937fd107403vboxsync that of IPv4: subnetting can be carried out on bit boundaries,
f78b12e570284aa8291f4ca1add24937fd107403vboxsync in much the same way as Classless InterDomain Routing
f78b12e570284aa8291f4ca1add24937fd107403vboxsync (CIDR), and the DNS PTR representation ("nibble" format)
f78b12e570284aa8291f4ca1add24937fd107403vboxsync makes setting up reverse zones easier.
<a name="id2608103"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p>
<a name="id2608126"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p>
<a name="id2608218"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names — Implementation and
<a name="id2608254"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym>
<a name="id2608281"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym>
<a name="id2608307"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p>
<a name="id2608331"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p>
<a name="id2608355"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p>
<a name="id2608410"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p>
<a name="id2608437"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p>
<a name="id2608464"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p>
<a name="id2608525"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p>
<a name="id2608555"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p>
<a name="id2608585"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p>
<a name="id2608612"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret
<a name="id2608694"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p>
<a name="id2608721"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p>
<a name="id2608757"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p>
<a name="id2608822"></a><p>[<abbr class="abbrev">RFC4034</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p>
<a name="id2608887"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS
<a name="id2608961"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely
Deployed <acronym class="acronym">DNS</acronym> Software</i>. </span><span class="pubdate">October 1993. </span></p>
<a name="id2608986"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation
<a name="id2609054"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p>
<a name="id2609090"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym>
<a name="id2609136"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p>
<a name="id2609193"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p>
<a name="id2609230"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using
<a name="id2609266"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the
<a name="id2609320"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the
<a name="id2609427"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to
<a name="id2609452"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p>
<a name="id2609478"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
<a name="id2609505"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
<a name="id2609531"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
<a name="id2609571"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
<a name="id2609601"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p>
<a name="id2609630"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p>
<a name="id2609673"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p>
<a name="id2609706"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p>
<a name="id2609733"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p>
<a name="id2609756"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP
<a name="id2609814"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p>
<a name="id2609846"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names
<a name="id2609872"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and
<a name="id2609894"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p>
<a name="id2609917"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p>
<a name="id2609963"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p>
<a name="id2609987"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p>
<a name="id2610044"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide</i>. </span><span class="pubdate">November 1987. </span></p>
<a name="id2610068"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File
<a name="id2610094"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and
<a name="id2610121"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers</i>. </span><span class="pubdate">October 1996. </span></p>
<a name="id2610157"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for
<a name="id2610203"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names,
<a name="id2610235"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p>
<a name="id2610281"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p>
<a name="id2610316"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode
<a name="id2610361"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String
<a name="id2610384"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p>
<a name="id2610409"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load
<a name="id2610435"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p>
<a name="id2610458"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p>
<a name="id2610504"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p>
<a name="id2610528"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p>
<a name="id2610554"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via
<a name="id2610580"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p>
<a name="id2610624"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical
<a name="id2610681"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p>
<a name="id2610708"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation
<a name="id2610756"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p>
<a name="id2610795"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p>
<a name="id2610822"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p>
<a name="id2610852"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC)
<a name="id2610877"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p>
<a name="id2610904"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p>
<a name="id2610940"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p>
<a name="id2610977"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p>
<a name="id2611003"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p>
<a name="id2611030"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record
<a name="id2611075"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p>
<a name="id2611128"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright � 1998 Sebastopol, CA: O'Reilly and Associates. </span></p>
It provides an interface to parse the traditional resolv.conf
$ <strong class="userinput"><code>/configure --enable-exportlib <em class="replaceable"><code>[other flags]</code></em></code></strong>
$ <strong class="userinput"><code>/configure --enable-fixed-rrset <em class="replaceable"><code>[other flags, but not --enable-exportlib]</code></em></code></strong>
$ <strong class="userinput"><code>/configure --enable-exportlib <em class="replaceable"><code>[other flags, but not --enable-fixed-rrset]</code></em></code></strong>
<a href="Bv9ARM.ch06.html#trusted-keys" title="trusted-keys Statement Grammar">the section called “<span><strong class="command">trusted-keys</strong></span> Statement Grammar”</a> for details.)</p>
example, to specify the following DNSKEY of example.com:
-e -k example.com -K "xxx"
"domain". Example: -s example.com:2001:db8::1234
<a name="id2614221"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
<a name="id2614339"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
returned by getaddrinfo(). If the dns.conf file exists and
<a name="id2614354"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
dynamic.example.com zone has an IPv6 address 2001:db8::1234,
$ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1"</code></strong></pre>
adds an A RR for foo.dynamic.example.com using the given key.
$ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A"</code></strong></pre>
removes all A RRs for foo.dynamic.example.com using the given key.
$ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"</code></strong></pre>
removes all RRs for foo.dynamic.example.com using the given key.
<a name="id2615031"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
"example.com". In general this domain name must be the apex
"www.example.com"). nsprobe first identifies the NS RRsets for