notes.html revision 6758b59e57af88bdf466e63c0856043df44f8dd0
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - Permission to use, copy, modify, and/or distribute this software for any
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - purpose with or without fee is hereby granted, provided that the above
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - copyright notice and this permission notice appear in all copies.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland - PERFORMANCE OF THIS SOFTWARE.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article"><div class="section">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<span style="color: red"><title>Release Notes for BIND Version 9.11.0pre-alpha</title></span><div class="section">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="titlepage"><div><div><h3 class="title">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This document summarizes changes since the last production release
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of BIND on the corresponding major release branch.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="titlepage"><div><div><h3 class="title">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a name="relnotes_download"></a>Download</h3></div></div></div>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The latest versions of BIND 9 software can always be found at
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland There you will find additional information about each release,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland source code, and pre-compiled versions for Microsoft Windows
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland operating systems.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="titlepage"><div><div><h3 class="title">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Insufficient testing when parsing a message allowed
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland records with an incorrect class to be be accepted,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland triggering a REQUIRE failure when those records
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland were subsequently cached. This flaw is disclosed
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in CVE-2015-8000. [RT #40987]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Incorrect reference counting could result in an INSIST
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland failure if a socket error occurred while performing a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland An incorrect boundary check in the OPENPGPKEY rdatatype
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland could trigger an assertion failure. This flaw is disclosed
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in CVE-2015-5986. [RT #40286]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A buffer accounting error could trigger an assertion failure
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland when parsing certain malformed DNSSEC keys.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This flaw was discovered by Hanno B�ck of the Fuzzing
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Project, and is disclosed in CVE-2015-5722. [RT #40212]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A specially crafted query could trigger an assertion failure
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This flaw was discovered by Jonathan Foote, and is disclosed
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in CVE-2015-5477. [RT #40046]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland On servers configured to perform DNSSEC validation, an
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland assertion failure could be triggered on answers from
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a specially configured server.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This flaw was discovered by Breno Silveira Soares, and is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland disclosed in CVE-2015-4620. [RT #39795]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland On servers configured to perform DNSSEC validation using
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland managed trust anchors (i.e., keys configured explicitly
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland via <span class="command"><strong>managed-keys</strong></span>, or implicitly
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland via <span class="command"><strong>dnssec-validation auto;</strong></span> or
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dnssec-lookaside auto;</strong></span>), revoking
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a trust anchor and sending a new untrusted replacement
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland could cause <span class="command"><strong>named</strong></span> to crash with an
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland assertion failure. This could occur in the event of a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland botched key rollover, or potentially as a result of a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland deliberate attack if the attacker was in position to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland monitor the victim's DNS traffic.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This flaw was discovered by Jan-Piet Mens, and is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland disclosed in CVE-2015-1349. [RT #38344]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A flaw in delegation handling could be exploited to put
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>named</strong></span> into an infinite loop, in which
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland each lookup of a name server triggered additional lookups
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of more name servers. This has been addressed by placing
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland limits on the number of levels of recursion
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>named</strong></span> will allow (default 7), and
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland on the number of queries that it will send before
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland terminating a recursive query (default 50).
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The recursion depth limit is configured via the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">max-recursion-depth</code> option, and the query limit
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland via the <code class="option">max-recursion-queries</code> option.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The flaw was discovered by Florian Maury of ANSSI, and is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland disclosed in CVE-2014-8500. [RT #37580]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Two separate problems were identified in BIND's GeoIP code that
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland could lead to an assertion failure. One was triggered by use of
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland both IPv4 and IPv6 address families, the other by referencing
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a GeoIP database in <code class="filename">named.conf</code> which was
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland not installed. Both are covered by CVE-2014-8680. [RT #37672]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A less serious security flaw was also found in GeoIP: changes
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland to the <span class="command"><strong>geoip-directory</strong></span> option in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="filename">named.conf</code> were ignored when running
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>rndc reconfig</strong></span>. In theory, this could allow
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>named</strong></span> to allow access to unintended clients.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Specific APL data could trigger an INSIST. This flaw
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland was discovered by Brian Mitchell and is disclosed in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland CVE-2015-8704. [RT #41396]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Certain errors that could be encountered when printing out
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland or logging an OPT record containing a CLIENT-SUBNET option
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland could be mishandled, resulting in an assertion failure.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This flaw was discovered by Brian Mitchell and is disclosed
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in CVE-2015-8705. [RT #41397]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="titlepage"><div><div><h3 class="title">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a name="relnotes_features"></a>New Features</h3></div></div></div>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Added support for DynDB, a new interface for loading zone data
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland from an external database, developed by Red Hat for the FreeIPA
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland project. (Thanks in particular to Adam Tkac and Petr
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Spacek of Red Hat for the contribution.)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Unlike the existing DLZ and SDB interfaces, which provide a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland limited subset of database functionality within BIND —
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland translating DNS queries into real-time database lookups with
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland relatively poor performance and with no ability to handle
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland DNSSEC-signed data — DynDB is able to fully implement
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland and extend the database API used natively by BIND.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A DynDB module could pre-load data from an external data
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland source, then serve it with the same performance and
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland functionality as conventional BIND zones, and with the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland ability to take advantage of database features not
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland available in BIND, such as multi-master replication.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland New quotas have been added to limit the queries that are
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland sent by recursive resolvers to authoritative servers
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland experiencing denial-of-service attacks. When configured,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland these options can both reduce the harm done to authoritative
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland servers and also avoid the resource exhaustion that can be
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland experienced by recursives when they are being used as a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland vehicle for such an attack.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">fetches-per-server</code> limits the number of
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland simultaneous queries that can be sent to any single
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland authoritative server. The configured value is a starting
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland point; it is automatically adjusted downward if the server is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland partially or completely non-responsive. The algorithm used to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland adjust the quota can be configured via the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">fetch-quota-params</code> option.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">fetches-per-zone</code> limits the number of
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland simultaneous queries that can be sent for names within a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland single domain. (Note: Unlike "fetches-per-server", this
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland value is not self-tuning.)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Statistics counters have also been added to track the number
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of queries affected by these quotas.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Added support for <span class="command"><strong>dnstap</strong></span>, a fast,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland flexible method for capturing and logging DNS traffic,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland developed by Robert Edmonds at Farsight Security, Inc.,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland whose assistance is gratefully acknowledged.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland To enable <span class="command"><strong>dnstap</strong></span> at compile time,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the <span class="command"><strong>fstrm</strong></span> and <span class="command"><strong>protobuf-c</strong></span>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland libraries must be available, and BIND must be configured with
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">--enable-dnstap</code>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A new utility <span class="command"><strong>dnstap-read</strong></span> has been added
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland to allow <span class="command"><strong>dnstap</strong></span> data to be presented in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a human-readable format.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland For more information on <span class="command"><strong>dnstap</strong></span>, see
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland New statistics counters have been added to track traffic
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland sizes, as specified in RSSAC002. Query and response
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland message sizes are broken up into ranges of histogram buckets:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland and 4096+. These values can be accessed via the XML and JSON
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland statistics channels at, for example,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <a class="link" href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <a class="link" href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The serial number of a dynamically updatable zone can
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland now be set using
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This is particularly useful with <code class="option">inline-signing</code>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland zones that have been reset. Setting the serial number to a value
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland larger than that on the slaves will trigger an AXFR-style
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland When answering recursive queries, SERVFAIL responses can now be
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland cached by the server for a limited time; subsequent queries for
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the same query name and type will return another SERVFAIL until
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the cache times out. This reduces the frequency of retries
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland when a query is persistently failing, which can be a burden
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland on recursive serviers. The SERVFAIL cache timeout is controlled
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland by <code class="option">servfail-ttl</code>, which defaults to 1 second
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland and has an upper limit of 30.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The new <span class="command"><strong>rndc nta</strong></span> command can now be used to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland set a "negative trust anchor" (NTA), disabling DNSSEC validation for
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a specific domain; this can be used when responses from a domain
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland are known to be failing validation due to administrative error
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland rather than because of a spoofing attack. NTAs are strictly
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland temporary; by default they expire after one hour, but can be
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland configured to last up to one week. The default NTA lifetime
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland can be changed by setting the <code class="option">nta-lifetime</code> in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="filename">named.conf</code>. When added, NTAs are stored in a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in order to persist across restarts of the <span class="command"><strong>named</strong></span> server.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The EDNS Client Subnet (ECS) option is now supported for
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland authoritative servers; if a query contains an ECS option then
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland elements can match against the the address encoded in the option.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This can be used to select a view for a query, so that different
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland answers can be provided depending on the client network.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The EDNS EXPIRE option has been implemented on the client
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland side, allowing a slave server to set the expiration timer
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland correctly when transferring zone data from another slave
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A new <code class="option">masterfile-style</code> zone option controls
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the formatting of text zone files: When set to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="literal">full</code>, the zone file will dumped in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland single-line-per-record format.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +ednsopt</strong></span> can now be used to set
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland arbitrary EDNS options in DNS requests.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +ednsflags</strong></span> can now be used to set
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland yet-to-be-defined EDNS flags in DNS requests.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +[no]ednsnegotiation</strong></span> can now be used enable /
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland disable EDNS version negotiation.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +header-only</strong></span> can now be used to send
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland queries without a question section.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +ttlunits</strong></span> causes <span class="command"><strong>dig</strong></span>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland to print TTL values with time-unit suffixes: w, d, h, m, s for
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland weeks, days, hours, minutes, and seconds.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +zflag</strong></span> can be used to set the last
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland unassigned DNS header flag bit. This bit in normally zero.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland can now be used to set the DSCP code point in outgoing query
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig +mapped</strong></span> can now be used to determine
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland if mapped IPv4 addresses can be used.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">serial-update-method</code> can now be set to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="literal">date</code>. On update, the serial number will
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland be set to the current date in YYYYMMDDNN format.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dnssec-signzone -N date</strong></span> also sets the serial
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland number to YYYYMMDDNN.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>named -L <em class="replaceable"><code>filename</code></em></strong></span>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland causes <span class="command"><strong>named</strong></span> to send log messages to the specified file by
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland default instead of to the system log.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The rate limiter configured by the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">serial-query-rate</code> option no longer covers
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland NOTIFY messages; those are now separately controlled by
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">notify-rate</code> and
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="option">startup-notify-rate</code> (the latter of which
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland controls the rate of NOTIFY messages sent when the server
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland is first started up or reconfigured).
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The default number of tasks and client objects available
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland for serving lightweight resolver queries have been increased,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland and are now configurable via the new <code class="option">lwres-tasks</code>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland and <code class="option">lwres-clients</code> options in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="filename">named.conf</code>. [RT #35857]
62224350e5355e6834f7deb9d8a7d062a50cb7c2Casper H.S. Dik Log output to files can now be buffered by specifying
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>buffered yes;</strong></span> when creating a channel.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>delv +tcp</strong></span> will exclusively use TCP when
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland sending queries.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>named</strong></span> will now check to see whether
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland other name server processes are running before starting up.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland This is implemented in two ways: 1) by refusing to start
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland if the configured network interfaces all return "address
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in use", and 2) by attempting to acquire a lock on a file
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland specified by the <code class="option">lock-file</code> option or
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the <span class="command"><strong>-X</strong></span> command line option. The
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland default lock file is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <code class="filename">/var/run/named/named.lock</code>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Specifying <code class="literal">none</code> will disable the lock
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>rndc delzone</strong></span> can now be applied to zones
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland which were configured in <code class="filename">named.conf</code>;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland it is no longer restricted to zones which were added by
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>rndc addzone</strong></span>. (Note, however, that
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland this does not edit <code class="filename">named.conf</code>; the zone
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland must be removed from the configuration or it will return
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland when <span class="command"><strong>named</strong></span> is restarted or reloaded.)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>rndc modzone</strong></span> can be used to reconfigure
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a zone, using similar syntax to <span class="command"><strong>rndc addzone</strong></span>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>rndc showzone</strong></span> displays the current
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland configuration for a specified zone.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Added server-side support for pipelined TCP queries. Clients
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland may continue sending queries via TCP while previous queries are
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland processed in parallel. Responses are sent when they are
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland ready, not necessarily in the order in which the queries were
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland To revert to the former behavior for a particular
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland client address or range of addresses, specify the address prefix
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in the "keep-response-order" option. To revert to the former
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland behavior for all clients, use "keep-response-order { any; };".
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The new <span class="command"><strong>mdig</strong></span> command is a version of
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig</strong></span> that sends multiple pipelined
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland queries and then waits for responses, instead of sending one
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland query and waiting the response before sending the next. [RT #38261]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland To enable better monitoring and troubleshooting of RFC 5011
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland trust anchor management, the new <span class="command"><strong>rndc managed-keys</strong></span>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland can be used to check status of trust anchors or to force keys
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland to be refreshed. Also, the managed-keys data file now has
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland easier-to-read comments. [RT #38458]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland An <span class="command"><strong>--enable-querytrace</strong></span> configure switch is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland now available to enable very verbose query tracelogging. This
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland option can only be set at compile time. This option has a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland negative performance impact and should be used only for
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland debugging. [RT #37520]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A new <span class="command"><strong>tcp-only</strong></span> option can be specified
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland in <span class="command"><strong>server</strong></span> statements to force
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>named</strong></span> to connect to the specified
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland server via TCP. [RT #37800]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The <span class="command"><strong>nxdomain-redirect</strong></span> option specifies
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a DNS namespace to use for NXDOMAIN redirection. When a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland recursive lookup returns NXDOMAIN, a second lookup is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland initiated with the specified name appended to the query
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland name. This allows NXDOMAIN redirection data to be supplied
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland by multiple zones configured on the server or by recursive
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland queries to other servers. (The older method, using
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a single <span class="command"><strong>type redirect</strong></span> zone, has
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland better average performance but is less flexible.) [RT #37989]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The following types have been implemented: CSYNC, NINFO, RKEY,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland SINK, TA, TALINK.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A new <span class="command"><strong>message-compression</strong></span> option can be
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland used to specify whether or not to use name compression when
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland answering queries. Setting this to <strong class="userinput"><code>no</code></strong>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland results in larger responses, but reduces CPU consumption and
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland may improve throughput. The default is <strong class="userinput"><code>yes</code></strong>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A "read-only" clause is now available for non-destructive
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland control channel access. In such cases, a restricted set of
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland rndc commands are allowed for querying information from named.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland By default, control channel access is read-write.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="titlepage"><div><div><h3 class="title">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The timers returned by the statistics channel (indicating current
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland time, server boot time, and most recent reconfiguration time) are
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland now reported with millisecond accuracy. [RT #40082]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Updated the compiled in addresses for H.ROOT-SERVERS.NET.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland ACLs containing <span class="command"><strong>geoip asnum</strong></span> elements were
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland not correctly matched unless the full organization name was
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland specified in the ACL (as in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>geoip asnum "AS1234 Example, Inc.";</strong></span>).
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland They can now match against the AS number alone (as in
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>geoip asnum "AS1234";</strong></span>).
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland When using native PKCS#11 cryptography (i.e.,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>configure --enable-native-pkcs11</strong></span>) HSM PINs
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of up to 256 characters can now be used.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland NXDOMAIN responses to queries of type DS are now cached separately
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland from those for other types. This helps when using "grafted" zones
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of type forward, for which the parent zone does not contain a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland delegation, such as local top-level domains. Previously a query
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of type DS for such a zone could cause the zone apex to be cached
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland as NXDOMAIN, blocking all subsequent queries. (Note: This
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland change is only helpful when DNSSEC validation is not enabled.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland "Grafted" zones without a delegation in the parent are not a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland recommended configuration.)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Update forwarding performance has been improved by allowing
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a single TCP connection to be shared between multiple updates.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland By default, <span class="command"><strong>nsupdate</strong></span> will now check
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the correctness of hostnames when adding records of type
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland disabled with <span class="command"><strong>check-names no</strong></span>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Added support for OPENPGPKEY type.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The names of the files used to store managed keys and added
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland zones for each view are no longer based on the SHA256 hash
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of the view name, except when this is necessary because the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland view name contains characters that would be incompatible with use
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland as a file name. For views whose names do not contain forward
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland slashes ('/'), backslashes ('\'), or capital letters - which
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland could potentially cause namespace collision problems on
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland case-insensitive filesystems - files will now be named
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland after the view (for example, <code class="filename">internal.mkeys</code>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland or <code class="filename">external.nzf</code>). However, to ensure
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland consistent behavior when upgrading, if a file using the old
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland name format is found to exist, it will continue to be used.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland "rndc" can now return text output of arbitrary size to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the caller. (Prior to this, certain commands such as
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland "rndc tsig-list" and "rndc zonestatus" could return
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland truncated output.)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Errors reported when running <span class="command"><strong>rndc addzone</strong></span>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland (e.g., when a zone file cannot be loaded) have been clarified
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland to make it easier to diagnose problems.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland When encountering an authoritative name server whose name is
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland an alias pointing to another name, the resolver treats
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland this as an error and skips to the next server. Previously
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland this happened silently; now the error will be logged to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the newly-created "cname" log category.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland If <span class="command"><strong>named</strong></span> is not configured to validate the answer then
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland allow fallback to plain DNS on timeout even when we know
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland the server supports EDNS. This will allow the server to
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland potentially resolve signed queries when TCP is being
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Large inline-signing changes should be less disruptive.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Signature generation is now done incrementally; the number
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland of signatures to be generated in each quantum is controlled
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland by "sig-signing-signatures <em class="replaceable"><code>number</code></em>;".
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The experimental SIT option (code point 65001) of BIND
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland 9.10.0 through BIND 9.10.2 has been replaced with the COOKIE
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland option (code point 10). It is no longer experimental, and
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland is sent by default, by both <span class="command"><strong>named</strong></span> and
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland <span class="command"><strong>dig</strong></span>.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland The SIT-related named.conf options have been marked as
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland obsolete, and are otherwise ignored.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland When <span class="command"><strong>dig</strong></span> receives a truncated (TC=1)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland response or a BADCOOKIE response code from a server, it
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland will automatically retry the query using the server COOKIE
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland that was returned by the server in its initial response.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland A alternative NXDOMAIN redirect method (nxdomain-redirect)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland which allows the redirect information to be looked up from
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland a namespace on the Internet rather than requiring a zone
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland to be configured on the server is now available.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Retrieving the local port range from net.ipv4.ip_local_port_range
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland on Linux is now supported.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland Within the <code class="option">response-policy</code> option, it is now
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland possible to configure RPZ rewrite logging on a per-zone basis
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland using the <code class="option">log</code> clause.
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
Authoritative servers that were marked as bogus (e.g. blackholed
<span class="command"><strong>dig</strong></span>, <span class="command"><strong>host</strong></span> and
in zt.c. [RT #37573]
cause an assertion failure in mem.c. [RT #38979]
The server could crash if policy zones were updated (e.g.
rpz.c when further incremental updates were made to the
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>