<?xml version="1.0" encoding="utf-8"?>

<sect1 xmlns:xi="http://www.w3.org/2001/XInclude">

<xi:include href="noteversion.xml"/>

<sect2 id="relnotes_intro">

<title>Introduction</title>

<para>

This document summarizes changes since the last production release

of BIND on the corresponding major release branch.

</para>

</sect2>

<sect2 id="relnotes_download">

<title>Download</title>

<para>

The latest versions of BIND 9 software can always be found at

<ulink url="http://www.isc.org/downloads/"

>http://www.isc.org/downloads/</ulink>.

There you will find additional information about each release,

source code, and pre-compiled versions for Microsoft Windows

operating systems.

</para>

</sect2>

<sect2 id="relnotes_security">

<title>Security Fixes</title>

<itemizedlist>

<listitem>

<para>None</para>

</listitem>

<listitem>

<para>

Errors reported when running <command>rndc addzone</command>

(e.g., when a zone file cannot be loaded) have been clarified

to make it easier to diagnose problems.

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_features">

<title>New Features</title>

<itemizedlist>

<listitem>

<para>

The serial number of a dynamically updatable zone can

now be set using

<command>rndc signing -serial <replaceable>number</replaceable> <replaceable>zonename</replaceable></command>.

This is particularly useful with <option>inline-signing</option>

zones that have been reset. Setting the serial number to a value

larger than that on the slaves will trigger an AXFR-style

transfer.

</para>

</listitem>

<listitem>

<para>

When answering recursive queries, SERVFAIL responses can now be

cached by the server for a limited time; subsequent queries for

the same query name and type will return another SERVFAIL until

the cache times out. This reduces the frequency of retries

when a query is persistently failing, which can be a burden

on recursive serviers. The SERVFAIL cache timeout is controlled

by <option>servfail-ttl</option>, which defaults to 10 seconds

and has an upper limit of 30.

</para>

</listitem>

<listitem>

<para>

The new <command>rndc nta</command> command can now be used to

set a "negative trust anchor" (NTA), disabling DNSSEC validation for

a specific domain; this can be used when responses from a domain

are known to be failing validation due to administrative error

rather than because of a spoofing attack. NTAs are strictly

temporary; by default they expire after one hour, but can be

configured to last up to one week. The default NTA lifetime

can be changed by setting the <option>nta-lifetime</option> in

<filename>named.conf</filename>.

</para>

</listitem>

<listitem>

<para>

The EDNS Client Subnet (ECS) option is now supported for

authoritative servers; if a query contains an ECS option then

ACLs containing <option>geoip</option> or <option>ecs</option>

elements can match against the the address encoded in the option.

This can be used to select a view for a query, so that different

answers can be provided depending on the client network.

</para>

</listitem>

<listitem>

<para>

The EDNS EXPIRE option has been implemented on the client

side, allowing a slave server to set the expiration timer

correctly when transferring zone data from another slave

server.

</para>

</listitem>

<listitem>

<para>

A new <option>masterfile-style</option> zone option controls

the formatting of text zone files: When set to

<literal>full</literal>, the zone file will dumped in

single-line-per-record format.

</para>

</listitem>

<listitem>

<para>

<command>dig +ednsopt</command> can now be used to set

arbitrary EDNS options in DNS requests.

</para>

</listitem>

<listitem>

<para>

<command>dig +ednsflags</command> can now be used to set

yet-to-be-defined EDNS flags in DNS requests.

</para>

</listitem>

<listitem>

<para>

<command>dig +ttlunits</command> causes <command>dig</command>

to print TTL values with time-unit suffixes: w, d, h, m, s for

weeks, days, hours, minutes, and seconds.

</para>

</listitem>

<listitem>

<para>

<command>dig +dscp=<replaceable>value</replaceable></command>

can now be used to set the DSCP code point in outgoing query

packets.

</para>

</listitem>

<listitem>

<para>

<option>serial-update-method</option> can now be set to

<literal>date</literal>. On update, the serial number will

be set to the current date in YYYYMMDDNN format.

</para>

</listitem>

<listitem>

<para>

<command>dnssec-signzone -N date</command> also sets the serial

number to YYYYMMDDNN.

</para>

</listitem>

<listitem>

<para>

<command>named -L <replaceable>filename</replaceable></command>

causes named to send log messages to the specified file by

default instead of to the system log.

</para>

</listitem>

<listitem>

<para>

The rate limiter configured by the

<option>serial-query-rate</option> option no longer covers

NOTIFY messages; those are now separately controlled by

<option>notify-rate</option> and

<option>startup-notify-rate</option> (the latter of which

controls the rate of NOTIFY messages sent when the server

is first started up or reconfigured).

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_changes">

<title>Feature Changes</title>

<itemizedlist>

<listitem>

<para>

When using native PKCS#11 cryptography (i.e.,

<command>configure --enable-native-pkcs11</command>) HSM PINs

of up to 256 characters can now be used.

</para>

</listitem>

<listitem>

<para>

NXDOMAIN responses to queries of type DS are now cached separately

from those for other types. This helps when using "grafted" zones

of type forward, for which the parent zone does not contain a

delegation, such as local top-level domains. Previously a query

of type DS for such a zone could cause the zone apex to be cached

as NXDOMAIN, blocking all subsequent queries. (Note: This

change is only helpful when DNSSEC validation is not enabled.

"Grafted" zones without a delegation in the parent are not a

recommended configuration.)

</para>

</listitem>

<listitem>

<para>

Update forwarding performance has been improved by allowing

a single TCP connection to be shared between multiple updates.

</para>

</listitem>

<listitem>

<para>

By default, <command>nsupdate</command> will now check

the correctness of hostnames when adding records of type

A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be

disabled with <command>check-names no</command>.

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_bugs">

<title>Bug Fixes</title>

<itemizedlist>

<listitem>

<para>

When checking for updates to trust anchors listed in

<option>managed-keys</option>, <command>named</command>

now revalidates keys based on the current set of

active trust anchors, without relying on any cached

record of previous validation. [RT #37506]

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_thanks">

<title>Thank You</title>

<para>

Thank you to everyone who assisted us in making this release possible.

If you would like to contribute to ISC to assist us in continuing to

make quality open source software, please visit our donations page at

<ulink url="http://www.isc.org/donate/"

>http://www.isc.org/donate/</ulink>.

</para>

</sect2>

</sect1>