380c874925f684847d9278b909cf511cb5b0289aShawn Routhier<?xml version="1.0" encoding="utf-8"?>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier<sect1 xmlns:xi="http://www.w3.org/2001/XInclude">

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <xi:include href="noteversion.xml"/>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <sect2 id="relnotes_intro">

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <title>Introduction</title>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <para>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier This document summarizes changes since the last production release

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier of BIND on the corresponding major release branch.

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </para>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </sect2>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <sect2 id="relnotes_download">

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <title>Download</title>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <para>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier The latest versions of BIND 9 software can always be found at

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <ulink url="http://www.isc.org/downloads/"

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier >http://www.isc.org/downloads/</ulink>.

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier There you will find additional information about each release,

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier source code, and pre-compiled versions for Microsoft Windows

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier operating systems.

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </para>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </sect2>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <sect2 id="relnotes_security">

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <title>Security Fixes</title>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <itemizedlist>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <listitem>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <para>None</para>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </listitem>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <listitem>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <para>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier Errors reported when running <command>rndc addzone</command>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier (e.g., when a zone file cannot be loaded) have been clarified

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier to make it easier to diagnose problems.

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </para>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </listitem>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </itemizedlist>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier </sect2>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <sect2 id="relnotes_features">

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <title>New Features</title>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <itemizedlist>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <listitem>

380c874925f684847d9278b909cf511cb5b0289aShawn Routhier <para>

The serial number of a dynamically updatable zone can

now be set using

<command>rndc signing -serial <replaceable>number</replaceable> <replaceable>zonename</replaceable></command>.

This is particularly useful with <option>inline-signing</option>

zones that have been reset. Setting the serial number to a value

larger than that on the slaves will trigger an AXFR-style

transfer.

</para>

</listitem>

<listitem>

<para>

When answering recursive queries, SERVFAIL responses can now be

cached by the server for a limited time; subsequent queries for

the same query name and type will return another SERVFAIL until

the cache times out. This reduces the frequency of retries

when a query is persistently failing, which can be a burden

on recursive serviers. The SERVFAIL cache timeout is controlled

by <option>servfail-ttl</option>, which defaults to 10 seconds

and has an upper limit of 30.

</para>

</listitem>

<listitem>

<para>

The new <command>rndc nta</command> command can now be used to

set a "negative trust anchor" (NTA), disabling DNSSEC validation for

a specific domain; this can be used when responses from a domain

are known to be failing validation due to administrative error

rather than because of a spoofing attack. NTAs are strictly

temporary; by default they expire after one hour, but can be

configured to last up to one week. The default NTA lifetime

can be changed by setting the <option>nta-lifetime</option> in

<filename>named.conf</filename>.

</para>

</listitem>

<listitem>

<para>

The EDNS Client Subnet (ECS) option is now supported for

authoritative servers; if a query contains an ECS option then

ACLs containing <option>geoip</option> or <option>ecs</option>

elements can match against the the address encoded in the option.

This can be used to select a view for a query, so that different

answers can be provided depending on the client network.

</para>

</listitem>

<listitem>

<para>

The EDNS EXPIRE option has been implemented on the client

side, allowing a slave server to set the expiration timer

correctly when transferring zone data from another slave

server.

</para>

</listitem>

<listitem>

<para>

A new <option>masterfile-style</option> zone option controls

the formatting of text zone files: When set to

<literal>full</literal>, the zone file will dumped in

single-line-per-record format.

</para>

</listitem>

<listitem>

<para>

<command>dig +ednsopt</command> can now be used to set

arbitrary EDNS options in DNS requests.

</para>

</listitem>

<listitem>

<para>

<command>dig +ednsflags</command> can now be used to set

yet-to-be-defined EDNS flags in DNS requests.

</para>

</listitem>

<listitem>

<para>

<command>dig +ttlunits</command> causes <command>dig</command>

to print TTL values with time-unit suffixes: w, d, h, m, s for

weeks, days, hours, minutes, and seconds.

</para>

</listitem>

<listitem>

<para>

<command>dig +dscp=<replaceable>value</replaceable></command>

can now be used to set the DSCP code point in outgoing query

packets.

</para>

</listitem>

<listitem>

<para>

<option>serial-update-method</option> can now be set to

<literal>date</literal>. On update, the serial number will

be set to the current date in YYYYMMDDNN format.

</para>

</listitem>

<listitem>

<para>

<command>dnssec-signzone -N date</command> also sets the serial

number to YYYYMMDDNN.

</para>

</listitem>

<listitem>

<para>

<command>named -L <replaceable>filename</replaceable></command>

causes named to send log messages to the specified file by

default instead of to the system log.

</para>

</listitem>

<listitem>

<para>

The rate limiter configured by the

<option>serial-query-rate</option> option no longer covers

NOTIFY messages; those are now separately controlled by

<option>notify-rate</option> and

<option>startup-notify-rate</option> (the latter of which

controls the rate of NOTIFY messages sent when the server

is first started up or reconfigured).

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_changes">

<title>Feature Changes</title>

<itemizedlist>

<listitem>

<para>

ACLs containing <command>geoip asnum</command> elements were

not correctly matched unless the full organization name was

specified in the ACL (as in

<command>geoip asnum "AS1234 Example, Inc.";</command>).

They can now match against the AS number alone (as in

<command>geoip asnum "AS1234";</command>).

</para>

</listitem>

<listitem>

<para>

When using native PKCS#11 cryptography (i.e.,

<command>configure --enable-native-pkcs11</command>) HSM PINs

of up to 256 characters can now be used.

</para>

</listitem>

<listitem>

<para>

NXDOMAIN responses to queries of type DS are now cached separately

from those for other types. This helps when using "grafted" zones

of type forward, for which the parent zone does not contain a

delegation, such as local top-level domains. Previously a query

of type DS for such a zone could cause the zone apex to be cached

as NXDOMAIN, blocking all subsequent queries. (Note: This

change is only helpful when DNSSEC validation is not enabled.

"Grafted" zones without a delegation in the parent are not a

recommended configuration.)

</para>

</listitem>

<listitem>

<para>

Update forwarding performance has been improved by allowing

a single TCP connection to be shared between multiple updates.

</para>

</listitem>

<listitem>

<para>

By default, <command>nsupdate</command> will now check

the correctness of hostnames when adding records of type

A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be

disabled with <command>check-names no</command>.

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_bugs">

<title>Bug Fixes</title>

<itemizedlist>

<listitem>

<para>

<command>dig</command>, <command>host</command> and

<command>nslookup</command> aborted when encountering

a name which, after appending search list elements,

exceeded 255 bytes. Such names are now skipped, but

processing of other names will continue. [RT #36892]

</para>

</listitem>

<listitem>

<para>

The error message generated when

<command>named-checkzone</command> or

<command>named-checkconf -z</command> encounters a

<option>$TTL</option> directive without a value has

been clarified. [RT #37138]

</para>

</listitem>

<listitem>

<para>

Semicolon characters (;) included in TXT records were

incorrectly escaped with a backslash when the record was

displayed as text. This is actually only necessary when there

are no quotation marks. [RT #37159]

</para>

</listitem>

<listitem>

<para>

When files opened for writing by <command>named</command>,

such as zone journal files, were referenced more than once

in <filename>named.conf</filename>, it could lead to file

corruption as multiple threads wrote to the same file. This

is now detected when loading <filename>named.conf</filename>

and reported as an error. [RT #37172]

</para>

</listitem>

<listitem>

<para>

When checking for updates to trust anchors listed in

<option>managed-keys</option>, <command>named</command>

now revalidates keys based on the current set of

active trust anchors, without relying on any cached

record of previous validation. [RT #37506]

</para>

</listitem>

<listitem>

<para>

Large-system tuning

(<command>configure --with-tuning=large</command>) caused

problems on some platforms by setting a socket receive

buffer size that was too large. This is now detected and

corrected at run time.

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_thanks">

<title>Thank You</title>

<para>

Thank you to everyone who assisted us in making this release possible.

If you would like to contribute to ISC to assist us in continuing to

make quality open source software, please visit our donations page at

<ulink url="http://www.isc.org/donate/"

>http://www.isc.org/donate/</ulink>.

</para>

</sect2>

</sect1>