notes.html revision 9d557856c2a19ec95ee73245f60a92f8675cf5ba
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - Permission to use, copy, modify, and/or distribute this software for any
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - purpose with or without fee is hereby granted, provided that the above
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - copyright notice and this permission notice appear in all copies.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<!-- $Id$ -->
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article"><div class="section">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<span style="color: red"><title>Release Notes for BIND Version 9.11.0pre-alpha</title></span><div class="section">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This document summarizes changes since the last production release
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of BIND on the corresponding major release branch.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_download"></a>Download</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The latest versions of BIND 9 software can always be found at
02d54949f0f1db4729e14c3322b207f58d2578a4Mark Andrews <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
02d54949f0f1db4729e14c3322b207f58d2578a4Mark Andrews There you will find additional information about each release,
02d54949f0f1db4729e14c3322b207f58d2578a4Mark Andrews source code, and pre-compiled versions for Microsoft Windows
02d54949f0f1db4729e14c3322b207f58d2578a4Mark Andrews operating systems.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews An incorrect boundary check in the OPENPGPKEY rdatatype
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews could trigger an assertion failure. This flaw is disclosed
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in CVE-2015-5986. [RT #40286]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A buffer accounting error could trigger an assertion failure
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews when parsing certain malformed DNSSEC keys.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This flaw was discovered by Hanno B�ck of the Fuzzing
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Project, and is disclosed in CVE-2015-5722. [RT #40212]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A specially crafted query could trigger an assertion failure
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This flaw was discovered by Jonathan Foote, and is disclosed
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in CVE-2015-5477. [RT #40046]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews On servers configured to perform DNSSEC validation, an
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews assertion failure could be triggered on answers from
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a specially configured server.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This flaw was discovered by Breno Silveira Soares, and is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews disclosed in CVE-2015-4620. [RT #39795]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews On servers configured to perform DNSSEC validation using
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews managed trust anchors (i.e., keys configured explicitly
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews via <span class="command"><strong>managed-keys</strong></span>, or implicitly
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews via <span class="command"><strong>dnssec-validation auto;</strong></span> or
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dnssec-lookaside auto;</strong></span>), revoking
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a trust anchor and sending a new untrusted replacement
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews could cause <span class="command"><strong>named</strong></span> to crash with an
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews assertion failure. This could occur in the event of a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews botched key rollover, or potentially as a result of a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews deliberate attack if the attacker was in position to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews monitor the victim's DNS traffic.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This flaw was discovered by Jan-Piet Mens, and is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews disclosed in CVE-2015-1349. [RT #38344]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A flaw in delegation handling could be exploited to put
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named</strong></span> into an infinite loop, in which
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews each lookup of a name server triggered additional lookups
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of more name servers. This has been addressed by placing
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews limits on the number of levels of recursion
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named</strong></span> will allow (default 7), and
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews on the number of queries that it will send before
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews terminating a recursive query (default 50).
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The recursion depth limit is configured via the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">max-recursion-depth</code> option, and the query limit
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews via the <code class="option">max-recursion-queries</code> option.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The flaw was discovered by Florian Maury of ANSSI, and is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews disclosed in CVE-2014-8500. [RT #37580]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Two separate problems were identified in BIND's GeoIP code that
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews could lead to an assertion failure. One was triggered by use of
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews both IPv4 and IPv6 address families, the other by referencing
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a GeoIP database in <code class="filename">named.conf</code> which was
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews not installed. Both are covered by CVE-2014-8680. [RT #37672]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A less serious security flaw was also found in GeoIP: changes
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews to the <span class="command"><strong>geoip-directory</strong></span> option in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="filename">named.conf</code> were ignored when running
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>rndc reconfig</strong></span>. In theory, this could allow
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named</strong></span> to allow access to unintended clients.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_features"></a>New Features</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Added support for DynDB, a new interface for loading zone data
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews from an external database, developed by Red Hat for the FreeIPA
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews project. (Thanks in particular to Adam Tkac and Petr
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Spacek of Red Hat for the contribution.)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Unlike the existing DLZ and SDB interfaces, which provide a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews limited subset of database functionality within BIND —
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews translating DNS queries into real-time database lookups with
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews relatively poor performance and with no ability to handle
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews DNSSEC-signed data — DynDB is able to fully implement
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews and extend the database API used natively by BIND.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A DynDB module could pre-load data from an external data
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews source, then serve it with the same performance and
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews functionality as conventional BIND zones, and with the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews ability to take advantage of database features not
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews available in BIND, such as multi-master replication.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews New quotas have been added to limit the queries that are
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews sent by recursive resolvers to authoritative servers
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews experiencing denial-of-service attacks. When configured,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews these options can both reduce the harm done to authoritative
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews servers and also avoid the resource exhaustion that can be
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews experienced by recursives when they are being used as a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews vehicle for such an attack.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">fetches-per-server</code> limits the number of
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews simultaneous queries that can be sent to any single
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews authoritative server. The configured value is a starting
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews point; it is automatically adjusted downward if the server is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews partially or completely non-responsive. The algorithm used to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews adjust the quota can be configured via the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">fetch-quota-params</code> option.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">fetches-per-zone</code> limits the number of
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews simultaneous queries that can be sent for names within a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews single domain. (Note: Unlike "fetches-per-server", this
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews value is not self-tuning.)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Statistics counters have also been added to track the number
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of queries affected by these quotas.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Added support for <span class="command"><strong>dnstap</strong></span>, a fast,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews flexible method for capturing and logging DNS traffic,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews developed by Robert Edmonds at Farsight Security, Inc.,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews whose assistance is gratefully acknowledged.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews To enable <span class="command"><strong>dnstap</strong></span> at compile time,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the <span class="command"><strong>fstrm</strong></span> and <span class="command"><strong>protobuf-c</strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews libraries must be available, and BIND must be configured with
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A new utility <span class="command"><strong>dnstap-read</strong></span> has been added
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews to allow <span class="command"><strong>dnstap</strong></span> data to be presented in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a human-readable format.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews For more information on <span class="command"><strong>dnstap</strong></span>, see
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews New statistics counters have been added to track traffic
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews sizes, as specified in RSSAC002. Query and response
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews message sizes are broken up into ranges of histogram buckets:
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews and 4096+. These values can be accessed via the XML and JSON
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews statistics channels at, for example,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <a class="link" href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <a class="link" href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The serial number of a dynamically updatable zone can
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews now be set using
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This is particularly useful with <code class="option">inline-signing</code>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews zones that have been reset. Setting the serial number to a value
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews larger than that on the slaves will trigger an AXFR-style
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews When answering recursive queries, SERVFAIL responses can now be
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews cached by the server for a limited time; subsequent queries for
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the same query name and type will return another SERVFAIL until
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the cache times out. This reduces the frequency of retries
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews when a query is persistently failing, which can be a burden
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews on recursive serviers. The SERVFAIL cache timeout is controlled
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews by <code class="option">servfail-ttl</code>, which defaults to 1 second
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews and has an upper limit of 30.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The new <span class="command"><strong>rndc nta</strong></span> command can now be used to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews set a "negative trust anchor" (NTA), disabling DNSSEC validation for
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a specific domain; this can be used when responses from a domain
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews are known to be failing validation due to administrative error
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews rather than because of a spoofing attack. NTAs are strictly
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews temporary; by default they expire after one hour, but can be
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews configured to last up to one week. The default NTA lifetime
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews can be changed by setting the <code class="option">nta-lifetime</code> in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="filename">named.conf</code>. When added, NTAs are stored in a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in order to persist across restarts of the <span class="command"><strong>named</strong></span> server.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The EDNS Client Subnet (ECS) option is now supported for
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews authoritative servers; if a query contains an ECS option then
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews elements can match against the the address encoded in the option.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This can be used to select a view for a query, so that different
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews answers can be provided depending on the client network.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The EDNS EXPIRE option has been implemented on the client
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews side, allowing a slave server to set the expiration timer
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews correctly when transferring zone data from another slave
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A new <code class="option">masterfile-style</code> zone option controls
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the formatting of text zone files: When set to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="literal">full</code>, the zone file will dumped in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews single-line-per-record format.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +ednsopt</strong></span> can now be used to set
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews arbitrary EDNS options in DNS requests.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +ednsflags</strong></span> can now be used to set
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews yet-to-be-defined EDNS flags in DNS requests.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +[no]ednsnegotiation</strong></span> can now be used enable /
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews disable EDNS version negotiation.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +header-only</strong></span> can now be used to send
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews queries without a question section.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +ttlunits</strong></span> causes <span class="command"><strong>dig</strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews to print TTL values with time-unit suffixes: w, d, h, m, s for
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews weeks, days, hours, minutes, and seconds.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +zflag</strong></span> can be used to set the last
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews unassigned DNS header flag bit. This bit in normally zero.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews can now be used to set the DSCP code point in outgoing query
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">serial-update-method</code> can now be set to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="literal">date</code>. On update, the serial number will
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews be set to the current date in YYYYMMDDNN format.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dnssec-signzone -N date</strong></span> also sets the serial
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews number to YYYYMMDDNN.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named -L <em class="replaceable"><code>filename</code></em></strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews causes <span class="command"><strong>named</strong></span> to send log messages to the specified file by
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews default instead of to the system log.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The rate limiter configured by the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">serial-query-rate</code> option no longer covers
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews NOTIFY messages; those are now separately controlled by
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">startup-notify-rate</code> (the latter of which
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews controls the rate of NOTIFY messages sent when the server
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews is first started up or reconfigured).
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The default number of tasks and client objects available
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews for serving lightweight resolver queries have been increased,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews and are now configurable via the new <code class="option">lwres-tasks</code>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews and <code class="option">lwres-clients</code> options in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="filename">named.conf</code>. [RT #35857]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Log output to files can now be buffered by specifying
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>buffered yes;</strong></span> when creating a channel.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>delv +tcp</strong></span> will exclusively use TCP when
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews sending queries.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named</strong></span> will now check to see whether
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews other name server processes are running before starting up.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews This is implemented in two ways: 1) by refusing to start
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews if the configured network interfaces all return "address
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in use", and 2) by attempting to acquire a lock on a file
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews specified by the <code class="option">lock-file</code> option or
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the <span class="command"><strong>-X</strong></span> command line option. The
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews default lock file is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="filename">/var/run/named/named.lock</code>.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Specifying <code class="literal">none</code> will disable the lock
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>rndc delzone</strong></span> can now be applied to zones
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews which were configured in <code class="filename">named.conf</code>;
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews it is no longer restricted to zones which were added by
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>rndc addzone</strong></span>. (Note, however, that
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews this does not edit <code class="filename">named.conf</code>; the zone
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews must be removed from the configuration or it will return
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews when <span class="command"><strong>named</strong></span> is restarted or reloaded.)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>rndc modzone</strong></span> can be used to reconfigure
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a zone, using similar syntax to <span class="command"><strong>rndc addzone</strong></span>.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>rndc showzone</strong></span> displays the current
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews configuration for a specified zone.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Added server-side support for pipelined TCP queries. Clients
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews may continue sending queries via TCP while previous queries are
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews processed in parallel. Responses are sent when they are
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews ready, not necessarily in the order in which the queries were
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews To revert to the former behavior for a particular
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews client address or range of addresses, specify the address prefix
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in the "keep-response-order" option. To revert to the former
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews behavior for all clients, use "keep-response-order { any; };".
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The new <span class="command"><strong>mdig</strong></span> command is a version of
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig</strong></span> that sends multiple pipelined
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews queries and then waits for responses, instead of sending one
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews query and waiting the response before sending the next. [RT #38261]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews To enable better monitoring and troubleshooting of RFC 5011
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews trust anchor management, the new <span class="command"><strong>rndc managed-keys</strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews can be used to check status of trust anchors or to force keys
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews to be refreshed. Also, the managed-keys data file now has
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews easier-to-read comments. [RT #38458]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews An <span class="command"><strong>--enable-querytrace</strong></span> configure switch is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews now available to enable very verbose query tracelogging. This
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews option can only be set at compile time. This option has a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews negative performance impact and should be used only for
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews debugging. [RT #37520]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A new <span class="command"><strong>tcp-only</strong></span> option can be specified
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in <span class="command"><strong>server</strong></span> statements to force
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named</strong></span> to connect to the specified
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews server via TCP. [RT #37800]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The <span class="command"><strong>nxdomain-redirect</strong></span> option specifies
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a DNS namespace to use for NXDOMAIN redirection. When a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews recursive lookup returns NXDOMAIN, a second lookup is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews initiated with the specified name appended to the query
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews name. This allows NXDOMAIN redirection data to be supplied
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews by multiple zones configured on the server or by recursive
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews queries to other servers. (The older method, using
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a single <span class="command"><strong>type redirect</strong></span> zone, has
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews better average performance but is less flexible.) [RT #37989]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The following types have been implemented: CSYNC, NINFO, RKEY,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews SINK, TA, TALINK.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews ACLs containing <span class="command"><strong>geoip asnum</strong></span> elements were
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews not correctly matched unless the full organization name was
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews specified in the ACL (as in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>geoip asnum "AS1234 Example, Inc.";</strong></span>).
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews They can now match against the AS number alone (as in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>geoip asnum "AS1234";</strong></span>).
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews When using native PKCS#11 cryptography (i.e.,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>configure --enable-native-pkcs11</strong></span>) HSM PINs
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of up to 256 characters can now be used.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews NXDOMAIN responses to queries of type DS are now cached separately
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews from those for other types. This helps when using "grafted" zones
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of type forward, for which the parent zone does not contain a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews delegation, such as local top-level domains. Previously a query
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of type DS for such a zone could cause the zone apex to be cached
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews as NXDOMAIN, blocking all subsequent queries. (Note: This
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews change is only helpful when DNSSEC validation is not enabled.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews "Grafted" zones without a delegation in the parent are not a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews recommended configuration.)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Update forwarding performance has been improved by allowing
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a single TCP connection to be shared between multiple updates.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews By default, <span class="command"><strong>nsupdate</strong></span> will now check
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the correctness of hostnames when adding records of type
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews disabled with <span class="command"><strong>check-names no</strong></span>.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Added support for OPENPGPKEY type.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The names of the files used to store managed keys and added
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews zones for each view are no longer based on the SHA256 hash
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of the view name, except when this is necessary because the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews view name contains characters that would be incompatible with use
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews as a file name. For views whose names do not contain forward
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews slashes ('/'), backslashes ('\'), or capital letters - which
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews could potentially cause namespace collision problems on
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews case-insensitive filesystems - files will now be named
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews after the view (for example, <code class="filename">internal.mkeys</code>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews or <code class="filename">external.nzf</code>). However, to ensure
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews consistent behavior when upgrading, if a file using the old
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews name format is found to exist, it will continue to be used.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews "rndc" can now return text output of arbitrary size to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the caller. (Prior to this, certain commands such as
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews "rndc tsig-list" and "rndc zonestatus" could return
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews truncated output.)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Errors reported when running <span class="command"><strong>rndc addzone</strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews (e.g., when a zone file cannot be loaded) have been clarified
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews to make it easier to diagnose problems.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews When encountering an authoritative name server whose name is
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews an alias pointing to another name, the resolver treats
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews this as an error and skips to the next server. Previously
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews this happened silently; now the error will be logged to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the newly-created "cname" log category.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews If <span class="command"><strong>named</strong></span> is not configured to validate the answer then
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews allow fallback to plain DNS on timeout even when we know
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews the server supports EDNS. This will allow the server to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews potentially resolve signed queries when TCP is being
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Large inline-signing changes should be less disruptive.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Signature generation is now done incrementally; the number
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of signatures to be generated in each quantum is controlled
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews by "sig-signing-signatures <em class="replaceable"><code>number</code></em>;".
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The experimental SIT option (code point 65001) of BIND
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews 9.10.0 through BIND 9.10.2 has been replaced with the COOKIE
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews option (code point 10). It is no longer experimental, and
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews is sent by default, by both <span class="command"><strong>named</strong></span> and
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig</strong></span>.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The SIT-related named.conf options have been marked as
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews obsolete, and are otherwise ignored.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews When <span class="command"><strong>dig</strong></span> receives a truncated (TC=1)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews response or a BADCOOKIE response code from a server, it
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews will automatically retry the query using the server COOKIE
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews that was returned by the server in its initial response.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A alternative NXDOMAIN redirect method (nxdomain-redirect)
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews which allows the redirect information to be looked up from
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a namespace on the Internet rather than requiring a zone
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews to be configured on the server is now available.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Retrieving the local port range from net.ipv4.ip_local_port_range
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews on Linux is now supported.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Within the <code class="option">response-policy</code> option, it is now
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews possible to configure RPZ rewrite logging on a per-zone basis
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews using the <code class="option">log</code> clause.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The default preferred glue is now the address type of the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews transport the query was received over.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews On machines with 2 or more processors (CPU), the default value
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews for the number of UDP listeners has been changed to the number
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of detected processors minus one.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_port"></a>Porting Changes</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The Microsoft Windows install tool
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>BINDInstall.exe</strong></span> which requires a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews non-free version of Visual Studio to be built, now uses two
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews files (lists of flags and files) created by the Configure
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews perl script with all the needed information which were
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews previously compiled in the binary. Read
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="filename">win32utils/build.txt</code> for more details.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig</strong></span>, <span class="command"><strong>host</strong></span> and
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>nslookup</strong></span> aborted when encountering
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews a name which, after appending search list elements,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews exceeded 255 bytes. Such names are now skipped, but
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews processing of other names will continue. [RT #36892]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The error message generated when
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named-checkzone</strong></span> or
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>named-checkconf -z</strong></span> encounters a
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">$TTL</code> directive without a value has
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews been clarified. [RT #37138]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Semicolon characters (;) included in TXT records were
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews incorrectly escaped with a backslash when the record was
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews displayed as text. This is actually only necessary when there
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews are no quotation marks. [RT #37159]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews When files opened for writing by <span class="command"><strong>named</strong></span>,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews such as zone journal files, were referenced more than once
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in <code class="filename">named.conf</code>, it could lead to file
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews corruption as multiple threads wrote to the same file. This
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews is now detected when loading <code class="filename">named.conf</code>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews and reported as an error. [RT #37172]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews When checking for updates to trust anchors listed in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <code class="option">managed-keys</code>, <span class="command"><strong>named</strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews now revalidates keys based on the current set of
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews active trust anchors, without relying on any cached
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews record of previous validation. [RT #37506]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Large-system tuning
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews (<span class="command"><strong>configure --with-tuning=large</strong></span>) caused
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews problems on some platforms by setting a socket receive
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews buffer size that was too large. This is now detected and
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews corrected at run time. [RT #37187]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews When NXDOMAIN redirection is in use, queries for a name
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews that is present in the redirection zone but a type that
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews is not present will now return NOERROR instead of NXDOMAIN.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Due to an inadvertent removal of code in the previous
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews release, when <span class="command"><strong>named</strong></span> encountered an
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews authoritative name server which dropped all EDNS queries,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews it did not always try plain DNS. This has been corrected.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A regression caused nsupdate to use the default recursive servers
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews rather than the SOA MNAME server when sending the UPDATE.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Adjusted max-recursion-queries to accommodate the smaller
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews initial packet sizes used in BIND 9.10 and higher when
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews contacting authoritative servers for the first time.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Built-in "empty" zones did not correctly inherit the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews "allow-transfer" ACL from the options or view. [RT #38310]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Two leaks were fixed that could cause <span class="command"><strong>named</strong></span>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews processes to grow to very large sizes. [RT #38454]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Fixed some bugs in RFC 5011 trust anchor management,
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews including a memory leak and a possible loss of state
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews information. [RT #38458]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Asynchronous zone loads were not handled correctly when the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews zone load was already in progress; this could trigger a crash
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews in zt.c. [RT #37573]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews A race during shutdown or reconfiguration could
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews cause an assertion failure in mem.c. [RT #38979]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Some answer formatting options didn't work correctly with
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>dig +short</strong></span>. [RT #39291]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Several bugs have been fixed in the RPZ implementation:
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Policy zones that did not specifically require recursion
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews could be treated as if they did; consequently, setting
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <span class="command"><strong>qname-wait-recurse no;</strong></span> was
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews sometimes ineffective. This has been corrected.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews In most configurations, behavioral changes due to this
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews fix will not be noticeable. [RT #39229]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The server could crash if policy zones were updated (e.g.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews via <span class="command"><strong>rndc reload</strong></span> or an incoming zone
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews transfer) while RPZ processing was still ongoing for an
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews active query. [RT #39415]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews On servers with one or more policy zones configured as
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews slaves, if a policy zone updated during regular operation
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews (rather than at startup) using a full zone reload, such as
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews via AXFR, a bug could allow the RPZ summary data to fall out
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews of sync, potentially leading to an assertion failure in
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews rpz.c when further incremental updates were made to the
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews zone, such as via IXFR. [RT #39567]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The server could match a shorter prefix than what was
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews available in CLIENT-IP policy triggers, and so, an
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews unexpected action could be taken. This has been
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews corrected. [RT #39481]
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The server could crash if a reload of an RPZ zone was
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews initiated while another reload of the same zone was
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews already in progress. [RT #39649]
41e55d04032c0eefd39d74ffb73657b04fb821ecEvan Hunt<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="end_of_life"></a>End of Life</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews The end of life for BIND 9.11 is yet to be determined but
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews will not be before BIND 9.13.0 has been released for 6 months.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<div class="titlepage"><div><div><h3 class="title">
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews Thank you to everyone who assisted us in making this release possible.
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews If you would like to contribute to ISC to assist us in continuing to
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews make quality open source software, please visit our donations page at
03e200df5dc283f24a6a349f0b31d3eab26da893Mark Andrews <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.