fa9e4066f08beec538e775443c5be79dd423fcabahrensCopyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")

fa9e4066f08beec538e775443c5be79dd423fcabahrensCopyright (C) 2000, 2001, 2003 Internet Software Consortium.

fa9e4066f08beec538e775443c5be79dd423fcabahrensSee COPYRIGHT in the source root or http://isc.org/copyright.html for terms.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock BIND 8 to BIND 9 Migration Notes

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock

fa9e4066f08beec538e775443c5be79dd423fcabahrensBIND 9 is designed to be mostly upwards compatible with BIND 8, but

fa9e4066f08beec538e775443c5be79dd423fcabahrensthere is still a number of caveats you should be aware of when

fa9e4066f08beec538e775443c5be79dd423fcabahrensupgrading an existing BIND 8 installation to use BIND 9.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrens1. Configuration File Compatibility

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrens1.1. Unimplemented Options and Changed Defaults

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensBIND 9 supports most, but not all of the named.conf options of BIND 8.

fa9e4066f08beec538e775443c5be79dd423fcabahrensFor a complete list of implemented options, see doc/misc/options.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensIf your named.conf file uses an unimplemented option, named will log a

fa9e4066f08beec538e775443c5be79dd423fcabahrenswarning message. A message is also logged about each option whose

fa9e4066f08beec538e775443c5be79dd423fcabahrensdefault has changed unless the option is set explicitly in named.conf.

c717a56157ae0e6fca6a1e3689ae1edc385716a3maybee

fa9e4066f08beec538e775443c5be79dd423fcabahrensThe default of the "transfer-format" option has changed from

fa9e4066f08beec538e775443c5be79dd423fcabahrens"one-answer" to "many-answers". If you have slave servers that do not

fa9e4066f08beec538e775443c5be79dd423fcabahrensunderstand the many-answers zone transfer format (e.g., BIND 4.9.5 or

fa9e4066f08beec538e775443c5be79dd423fcabahrensolder) you need to explicitly specify "transfer-format one-answer;" in

fa9e4066f08beec538e775443c5be79dd423fcabahrenseither the options block or a server statement.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensBIND 9.4 onwards implements "allow-query-cache". The "allow-query"

fa9e4066f08beec538e775443c5be79dd423fcabahrensoption is no longer used to specify access to the cache. The

fa9e4066f08beec538e775443c5be79dd423fcabahrens"allow-query" option continues to specify which hosts are allowed

fa9e4066f08beec538e775443c5be79dd423fcabahrensto ask ordinary DNS questions. The new "allow-query-cache" option

fa9e4066f08beec538e775443c5be79dd423fcabahrensis used to specify which hosts are allowed to get answers from the

fa9e4066f08beec538e775443c5be79dd423fcabahrenscache. Since BIND 9.4.1, if "allow-query-cache" is not set then

fa9e4066f08beec538e775443c5be79dd423fcabahrens"allow-recursion" is used if it is set, otherwise "allow-query" is

fa9e4066f08beec538e775443c5be79dd423fcabahrensused if it is set, otherwise the default localnets and localhost

fa9e4066f08beec538e775443c5be79dd423fcabahrensis used.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrens1.2. Handling of Configuration File Errors

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensIn BIND 9, named refuses to start if it detects an error in

fa9e4066f08beec538e775443c5be79dd423fcabahrensnamed.conf. Earlier versions would start despite errors, causing the

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrockserver to run with a partial configuration. Errors detected during

fa9e4066f08beec538e775443c5be79dd423fcabahrenssubsequent reloads do not cause the server to exit.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensErrors in master files do not cause the server to exit, but they

fa9e4066f08beec538e775443c5be79dd423fcabahrensdo cause the zone not to load.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrens1.3. Logging

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensThe set of logging categories in BIND 9 is different from that

fa9e4066f08beec538e775443c5be79dd423fcabahrensin BIND 8. If you have customised your logging on a per-category

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrockbasis, you need to modify your logging statement to use the

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrocknew categories.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensAnother difference is that the "logging" statement only takes effect

ad23a2db4cfc94c0ed1d58554479ce8d2e7e5768johansenafter the entire named.conf file has been read. This means that when

ad23a2db4cfc94c0ed1d58554479ce8d2e7e5768johansenthe server starts up, any messages about errors in the configuration

0e8c61582669940ab28fea7e6dd2935372681236maybeefile are always logged to the default destination (syslog) when the

0e8c61582669940ab28fea7e6dd2935372681236maybeeserver first starts up, regardless of the contents of the "logging"

ad23a2db4cfc94c0ed1d58554479ce8d2e7e5768johansenstatement. In BIND 8, the new logging configuration took effect

fa9e4066f08beec538e775443c5be79dd423fcabahrensimmediately after the "logging" statement was read.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrens1.4. Notify messages and Refresh queries

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensThe source address and port for these is now controlled by

fa9e4066f08beec538e775443c5be79dd423fcabahrens"notify-source" and "transfer-source", respectively, rather that

13506d1eefbbc37e2f12a0528831d9f6d4c361d7maybeequery-source as in BIND 8.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

0e8c61582669940ab28fea7e6dd2935372681236maybee1.5. Multiple Classes.

0e8c61582669940ab28fea7e6dd2935372681236maybee

0e8c61582669940ab28fea7e6dd2935372681236maybeeMultiple classes have to be put into explicit views for each class.

0e8c61582669940ab28fea7e6dd2935372681236maybee

ad23a2db4cfc94c0ed1d58554479ce8d2e7e5768johansen

ad23a2db4cfc94c0ed1d58554479ce8d2e7e5768johansen2. Zone File Compatibility

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock2.1. Strict RFC1035 Interpretation of TTLs in Zone Files

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensBIND 9 strictly complies with the RFC1035 and RFC2308 rules regarding

fa9e4066f08beec538e775443c5be79dd423fcabahrensomitted TTLs in zone files. Omitted TTLs are replaced by the value

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrockspecified with the $TTL directive, or by the previous explicit TTL if

6b4acc8bd9d480535a4d057e291dc7c049f664d9ahrensthere is no $TTL directive.

6b4acc8bd9d480535a4d057e291dc7c049f664d9ahrens

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrockIf there is no $TTL directive and the first RR in the file does not

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrockhave an explicit TTL field, the zone file is illegal according to

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrockRFC1035 since the TTL of the first RR is undefined. Unfortunately,

fa9e4066f08beec538e775443c5be79dd423fcabahrensBIND 4 and many versions of BIND 8 accept such files without warning

fa9e4066f08beec538e775443c5be79dd423fcabahrensand use the value of the SOA MINTTL field as a default for missing TTL

fa9e4066f08beec538e775443c5be79dd423fcabahrensvalues.

13506d1eefbbc37e2f12a0528831d9f6d4c361d7maybee

c717a56157ae0e6fca6a1e3689ae1edc385716a3maybeeBIND 9.0 and 9.1 completely refused to load such files. BIND 9.2

c717a56157ae0e6fca6a1e3689ae1edc385716a3maybeeemulates the nonstandard BIND 4/8 SOA MINTTL behaviour and loads the

c717a56157ae0e6fca6a1e3689ae1edc385716a3maybeefiles anyway (provided the SOA is the first record in the file), but

c717a56157ae0e6fca6a1e3689ae1edc385716a3maybeewill issue the warning message "no TTL specified; using SOA MINTTL

fa9e4066f08beec538e775443c5be79dd423fcabahrensinstead".

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensTo avoid problems, we recommend that you use a $TTL directive in each

fa9e4066f08beec538e775443c5be79dd423fcabahrenszone file.

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock2.2. Periods in SOA Serial Numbers Deprecated

ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock

fa9e4066f08beec538e775443c5be79dd423fcabahrensSome versions of BIND allow SOA serial numbers with an embedded

fa9e4066f08beec538e775443c5be79dd423fcabahrensperiod, like "3.002", and convert them into integers in a rather

fa9e4066f08beec538e775443c5be79dd423fcabahrensunintuitive way. This feature is not supported by BIND 9; serial

fa9e4066f08beec538e775443c5be79dd423fcabahrensnumbers must be integers.

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrens2.3. Handling of Unbalanced Quotes

fa9e4066f08beec538e775443c5be79dd423fcabahrens

fa9e4066f08beec538e775443c5be79dd423fcabahrensTXT records with unbalanced quotes, like 'host TXT "foo', were not

fa9e4066f08beec538e775443c5be79dd423fcabahrenstreated as errors in some versions of BIND. If your zone files

fa9e4066f08beec538e775443c5be79dd423fcabahrenscontain such records, you will get potentially confusing error

fa9e4066f08beec538e775443c5be79dd423fcabahrensmessages like "unexpected end of file" because BIND 9 will interpret

fa9e4066f08beec538e775443c5be79dd423fcabahrenseverything up to the next quote character as a literal string.

2.4. Handling of Line Breaks

Some versions of BIND accept RRs containing line breaks that are not

properly quoted with parentheses, like the following SOA:

@ IN SOA ns.example. hostmaster.example.

( 1 3600 1800 1814400 3600 )

This is not legal master file syntax and will be treated as an error

by BIND 9. The fix is to move the opening parenthesis to the first

line.

2.5. Unimplemented BIND 8 Extensions

$GENERATE: The "$$" construct for getting a literal $ into a domain

name is deprecated. Use \$ instead.

2.6. TXT records are no longer automatically split.

Some versions of BIND accepted strings in TXT RDATA consisting of more

than 255 characters and silently split them to be able to encode the

strings in a protocol conformant way. You may now see errors like this

dns_rdata_fromtext: local.db:119: ran out of space

if you have TXT RRs with too longs strings. Make sure to split the

string in the zone data file at or before a single one reaches 255

characters.

3. Interoperability Impact of New Protocol Features

3.1. EDNS0

BIND 9 uses EDNS0 (RFC2671) to advertise its receive buffer size. It

also sets DO EDNS flag bit in queries to indicate that it wishes to

receive DNSSEC responses.

Most older servers that do not support EDNS0, including prior versions

of BIND, will send a FORMERR or NOTIMP response to these queries.

When this happens, BIND 9 will automatically retry the query without

EDNS0.

Unfortunately, there exists at least one non-BIND name server

implementation that silently ignores these queries instead of sending

an error response. Resolving names in zones where all or most

authoritative servers use this server will be very slow or fail

completely. We have contacted the manufacturer of the name server in

case, and they are working on a solution.

When BIND 9 communicates with a server that does support EDNS0, such as

another BIND 9 server, responses of up to 4096 bytes may be

transmitted as a single UDP datagram which is subject to fragmentation

at the IP level. If a firewall incorrectly drops IP fragments, it can

cause resolution to slow down dramatically or fail.

3.2. Zone Transfers

Outgoing zone transfers now use the "many-answers" format by default.

This format is not understood by certain old versions of BIND 4.

You can work around this problem using the option "transfer-format

one-answer;", but since these old versions all have known security

problems, the correct fix is to upgrade the slave servers.

Zone transfers to Windows 2000 DNS servers sometimes fail due to a

bug in the Windows 2000 DNS server where DNS messages larger than

16K are not handled properly. Obtain the latest service pack for

Windows 2000 from Microsoft to address this issue. In the meantime,

the problem can be worked around by setting "transfer-format one-answer;".

4. Unrestricted Character Set

BIND 9.2 only

BIND 9 does not restrict the character set of domain names - it is

fully 8-bit clean in accordance with RFC2181 section 11.

It is strongly recommended that hostnames published in the DNS follow

the RFC952 rules, but BIND 9 will not enforce this restriction.

Historically, some applications have suffered from security flaws

where data originating from the network, such as names returned by

gethostbyaddr(), are used with insufficient checking and may cause a

breach of security when containing unexpected characters; see

<http://www.cert.org/advisories/CA-96.04.corrupt_info_from_servers.html>

for details. Some earlier versions of BIND attempt to protect these

flawed applications from attack by discarding data containing

characters deemed inappropriate in host names or mail addresses, under

the control of the "check-names" option in named.conf and/or "options

no-check-names" in resolv.conf. BIND 9 provides no such protection;

if applications with these flaws are still being used, they should

be upgraded.

BIND 9.3 onwards implements check-names.

5. Server Administration Tools

5.1 Ndc Replaced by Rndc

The "ndc" program has been replaced by "rndc", which is capable of

remote operation. Unlike ndc, rndc requires a configuration file.

The easiest way to generate a configuration file is to run

"rndc-confgen -a"; see the man pages for rndc(8), rndc-confgen(8),

and rndc.conf(5) for details.

5.2. Nsupdate Differences

The BIND 8 implementation of nsupdate had an undocumented feature

where an update request would be broken down into multiple requests

based upon the discovered zones that contained the records. This

behaviour has not been implemented in BIND 9. Each update request

must pertain to a single zone, but it is still possible to do multiple

updates in a single invocation of nsupdate by terminating each update

with an empty line or a "send" command.

6. No Information Leakage between Zones

BIND 9 stores the authoritative data for each zone in a separate data

structure, as recommended in RFC1035 and as required by DNSSEC and

IXFR. When a BIND 9 server is authoritative for both a child zone and

its parent, it will have two distinct sets of NS records at the

delegation point: the authoritative NS records at the child's apex,

and a set of glue NS records in the parent.

BIND 8 was unable to properly distinguish between these two sets of NS

records and would "leak" the child's NS records into the parent,

effectively causing the parent zone to be silently modified: responses

and zone transfers from the parent contained the child's NS records

rather than the glue configured into the parent (if any). In the case

of children of type "stub", this behaviour was documented as a feature,

allowing the glue NS records to be omitted from the parent

configuration.

Sites that were relying on this BIND 8 behaviour need to add any

omitted glue NS records, and any necessary glue A records, to the

parent zone.

Although stub zones can no longer be used as a mechanism for injecting

NS records into their parent zones, they are still useful as a way of

directing queries for a given domain to a particular set of name

servers.

7. Umask not Modified

The BIND 8 named unconditionally sets the umask to 022. BIND 9 does

not; the umask inherited from the parent process remains in effect.

This may cause files created by named, such as journal files, to be

created with different file permissions than they did in BIND 8. If

necessary, the umask should be set explicitly in the script used to

start the named process.

$Id: migration,v 1.49 2008/03/18 15:42:53 jreed Exp $