notes.xml revision 7be3c12291467fa7450b2123c161ea8bfe13f1a1
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - Permission to use, copy, modify, and/or distribute this software for any
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - purpose with or without fee is hereby granted, provided that the above
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - copyright notice and this permission notice appear in all copies.
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt - PERFORMANCE OF THIS SOFTWARE.
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt This document summarizes changes since the last production release
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt of BIND on the corresponding major release branch.
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt The latest versions of BIND 9 software can always be found at
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt There you will find additional information about each release,
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt source code, and pre-compiled versions for Microsoft Windows
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt operating systems.
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt <itemizedlist>
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt Errors reported when running <command>rndc addzone</command>
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt (e.g., when a zone file cannot be loaded) have been clarified
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt to make it easier to diagnose problems.
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt </itemizedlist>
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt <itemizedlist>
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt The serial number of a dynamically updatable zone can
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt now be set using
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <command>rndc signing -serial <replaceable>number</replaceable> <replaceable>zonename</replaceable></command>.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt This is particularly useful with <option>inline-signing</option>
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt zones that have been reset. Setting the serial number to a value
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt larger than that on the slaves will trigger an AXFR-style
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt When answering recursive queries, SERVFAIL responses can now be
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt cached by the server for a limited time; subsequent queries for
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt the same query name and type will return another SERVFAIL until
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt the cache times out. This reduces the frequency of retries
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt when a query is persistently failing, which can be a burden
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt on recursive serviers. The SERVFAIL cache timeout is controlled
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt by <option>servfail-ttl</option>, which defaults to 10 seconds
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt and has an upper limit of 30.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt The new <command>rndc nta</command> command can now be used to
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt set a "negative trust anchor" (NTA), disabling DNSSEC validation for
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt a specific domain; this can be used when responses from a domain
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt are known to be failing validation due to administrative error
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt rather than because of a spoofing attack. NTAs are strictly
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt temporary; by default they expire after one hour, but can be
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt configured to last up to one week. The default NTA lifetime
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt can be changed by setting the <option>nta-lifetime</option> in
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt The EDNS Client Subnet (ECS) option is now supported for
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt authoritative servers; if a query contains an ECS option then
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt ACLs containing <option>geoip</option> or <option>ecs</option>
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt elements can match against the the address encoded in the option.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt This can be used to select a view for a query, so that different
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt answers can be provided depending on the client network.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt The EDNS EXPIRE option has been implemented on the client
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt side, allowing a slave server to set the expiration timer
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt correctly when transferring zone data from another slave
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt A new <option>masterfile-style</option> zone option controls
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt the formatting of text zone files: When set to
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <literal>full</literal>, the zone file will dumped in
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt single-line-per-record format.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <command>dig +ednsopt</command> can now be used to set
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt arbitrary EDNS options in DNS requests.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <command>dig +ednsflags</command> can now be used to set
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt yet-to-be-defined EDNS flags in DNS requests.
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt <command>dig +ttlunits</command> causes <command>dig</command>
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt to print TTL values with time-unit suffixes: w, d, h, m, s for
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt weeks, days, hours, minutes, and seconds.
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt <command>dig +dscp=<replaceable>value</replaceable></command>
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt can now be used to set the DSCP code point in outgoing query
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <option>serial-update-method</option> can now be set to
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <literal>date</literal>. On update, the serial number will
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt be set to the current date in YYYYMMDDNN format.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <command>dnssec-signzone -N date</command> also sets the serial
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt number to YYYYMMDDNN.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <command>named -L <replaceable>filename</replaceable></command>
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt causes named to send log messages to the specified file by
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt default instead of to the system log.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt The rate limiter configured by the
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <option>serial-query-rate</option> option no longer covers
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt NOTIFY messages; those are now separately controlled by
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt <option>startup-notify-rate</option> (the latter of which
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt controls the rate of NOTIFY messages sent when the server
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt is first started up or reconfigured).
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt </itemizedlist>
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt <itemizedlist>
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt NXDOMAIN responses to queries of type DS are now cached separately
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt from those for other types. This helps when using "grafted" zones
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt of type forward, for which the parent zone does not contain a
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt delegation, such as local top-level domains. Previously a query
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt of type DS for such a zone could cause the zone apex to be cached
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt as NXDOMAIN, blocking all subsequent queries. (Note: This
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt change is only helpful when DNSSEC validation is not enabled.
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt "Grafted" zones without a delegation in the parent are not a
7be3c12291467fa7450b2123c161ea8bfe13f1a1Evan Hunt recommended configuration.)
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt Update forwarding performance has been improved by allowing
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt a single TCP connection to be shared between multiple updates.
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt By default, <command>nsupdate</command> will now check
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt the correctness of hostnames when adding records of type
67c6b5edd034c445ccb6c36097d9fac4de21a542Evan Hunt A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt </itemizedlist>
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt <itemizedlist>
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt </itemizedlist>
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt Thank you to everyone who assisted us in making this release possible.
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt If you would like to contribute to ISC to assist us in continuing to
90e0af6bc6c1bcafad126e1779fc478c0aeaeb8fEvan Hunt make quality open source software, please visit our donations page at