HISTORY revision 225736
1Summary of functional enhancements from prior major releases of BIND 9: 2 3BIND 9.6.0 4 5 Full NSEC3 support 6 7 Automatic zone re-signing 8 9 New update-policy methods tcp-self and 6to4-self 10 11 The BIND 8 resolver library, libbind, has been removed from the 12 BIND 9 distribution and is now available as a separate download. 13 14 Change the default pid file location from /var/run to 15 /var/run/{named,lwresd} for improved chroot/setuid support. 16 17BIND 9.5.0 18 19 GSS-TSIG support (RFC 3645). 20 21 DHCID support. 22 23 Experimental http server and statistics support for named via xml. 24 25 More detailed statistics counters including those supported in BIND 8. 26 27 Faster ACL processing. 28 29 Use Doxygen to generate internal documentation. 30 31 Efficient LRU cache-cleaning mechanism. 32 33 NSID support. 34 35BIND 9.4.0 36 37 Implemented "additional section caching (or acache)", an 38 internal cache framework for additional section content to 39 improve response performance. Several configuration options 40 were provided to control the behavior. 41 42 New notify type 'master-only'. Enable notify for master 43 zones only. 44 45 Accept 'notify-source' style syntax for query-source. 46 47 rndc now allows addresses to be set in the server clauses. 48 49 New option "allow-query-cache". This lets "allow-query" 50 be used to specify the default zone access level rather 51 than having to have every zone override the global value. 52 "allow-query-cache" can be set at both the options and view 53 levels. If "allow-query-cache" is not set then "allow-recursion" 54 is used if set, otherwise "allow-query" is used if set 55 unless "recursion no;" is set in which case "none;" is used, 56 otherwise the default (localhost; localnets;) is used. 57 58 rndc: the source address can now be specified. 59 60 ixfr-from-differences now takes master and slave in addition 61 to yes and no at the options and view levels. 62 63 Allow the journal's name to be changed via named.conf. 64 65 'rndc notify zone [class [view]]' resend the NOTIFY messages 66 for the specified zone. 67 68 'dig +trace' now randomly selects the next servers to try. 69 Report if there is a bad delegation. 70 71 Improve check-names error messages. 72 73 Make public the function to read a key file, dst_key_read_public(). 74 75 dig now returns the byte count for axfr/ixfr. 76 77 allow-update is now settable at the options / view level. 78 79 named-checkconf now checks the logging configuration. 80 81 host now can turn on memory debugging flags with '-m'. 82 83 Don't send notify messages to self. 84 85 Perform sanity checks on NS records which refer to 'in zone' names. 86 87 New zone option "notify-delay". Specify a minimum delay 88 between sets of NOTIFY messages. 89 90 Extend adjusting TTL warning messages. 91 92 Named and named-checkzone can now both check for non-terminal 93 wildcard records. 94 95 "rndc freeze/thaw" now freezes/thaws all zones. 96 97 named-checkconf now check acls to verify that they only 98 refer to existing acls. 99 100 The server syntax has been extended to support a range of 101 servers. 102 103 Report differences between hints and real NS rrset and 104 associated address records. 105 106 Preserve the case of domain names in rdata during zone 107 transfers. 108 109 Restructured the data locking framework using architecture 110 dependent atomic operations (when available), improving 111 response performance on multi-processor machines significantly. 112 x86, x86_64, alpha, powerpc, and mips are currently supported. 113 114 UNIX domain controls are now supported. 115 116 Add support for additional zone file formats for improving 117 loading performance. The masterfile-format option in 118 named.conf can be used to specify a non-default format. A 119 separate command named-compilezone was provided to generate 120 zone files in the new format. Additionally, the -I and -O 121 options for dnssec-signzone specify the input and output 122 formats. 123 124 dnssec-signzone can now randomize signature end times 125 (dnssec-signzone -j jitter). 126 127 Add support for CH A record. 128 129 Add additional zone data constancy checks. named-checkzone 130 has extended checking of NS, MX and SRV record and the hosts 131 they reference. named has extended post zone load checks. 132 New zone options: check-mx and integrity-check. 133 134 135 edns-udp-size can now be overridden on a per server basis. 136 137 dig can now specify the EDNS version when making a query. 138 139 Added framework for handling multiple EDNS versions. 140 141 Additional memory debugging support to track size and mctx 142 arguments. 143 144 Detect duplicates of UDP queries we are recursing on and 145 drop them. New stats category "duplicates". 146 147 "USE INTERNAL MALLOC" is now runtime selectable. 148 149 The lame cache is now done on a <qname,qclass,qtype> basis 150 as some servers only appear to be lame for certain query 151 types. 152 153 Limit the number of recursive clients that can be waiting 154 for a single query (<qname,qtype,qclass>) to resolve. New 155 options clients-per-query and max-clients-per-query. 156 157 dig: report the number of extra bytes still left in the 158 packet after processing all the records. 159 160 Support for IPSECKEY rdata type. 161 162 Raise the UDP recieve buffer size to 32k if it is less than 32k. 163 164 x86 and x86_64 now have seperate atomic locking implementations. 165 166 named-checkconf now validates update-policy entries. 167 168 Attempt to make the amount of work performed in a iteration 169 self tuning. The covers nodes clean from the cache per 170 iteration, nodes written to disk when rewriting a master 171 file and nodes destroyed per iteration when destroying a 172 zone or a cache. 173 174 ISC string copy API. 175 176 Automatic empty zone creation for D.F.IP6.ARPA and friends. 177 Note: RFC 1918 zones are not yet covered by this but are 178 likely to be in a future release. 179 180 New options: empty-server, empty-contact, empty-zones-enable 181 and disable-empty-zone. 182 183 dig now has a '-q queryname' and '+showsearch' options. 184 185 host/nslookup now continue (default)/fail on SERVFAIL. 186 187 dig now warns if 'RA' is not set in the answer when 'RD' 188 was set in the query. host/nslookup skip servers that fail 189 to set 'RA' when 'RD' is set unless a server is explicitly 190 set. 191 192 Integrate contibuted DLZ code into named. 193 194 Integrate contibuted IDN code from JPNIC. 195 196 libbind: corresponds to that from BIND 8.4.7. 197 198BIND 9.3.0 199 200 DNSSEC is now DS based (RFC 3658). 201 See also RFC 3845, doc/draft/draft-ietf-dnsext-dnssec-*. 202 203 DNSSEC lookaside validation. 204 205 check-names is now implemented. 206 rrset-order in more complete. 207 208 IPv4/IPv6 transition support, dual-stack-servers. 209 210 IXFR deltas can now be generated when loading master files, 211 ixfr-from-differences. 212 213 It is now possible to specify the size of a journal, max-journal-size. 214 215 It is now possible to define a named set of master servers to be 216 used in masters clause, masters. 217 218 The advertised EDNS UDP size can now be set, edns-udp-size. 219 220 allow-v6-synthesis has been obsoleted. 221 222 NOTE: 223 * Zones containing MD and MF will now be rejected. 224 * dig, nslookup name. now report "Not Implemented" as 225 NOTIMP rather than NOTIMPL. This will have impact on scripts 226 that are looking for NOTIMPL. 227 228 libbind: corresponds to that from BIND 8.4.5. 229 230BIND 9.2.0 231 232 The size of the cache can now be limited using the 233 "max-cache-size" option. 234 235 The server can now automatically convert RFC1886-style recursive 236 lookup requests into RFC2874-style lookups, when enabled using the 237 new option "allow-v6-synthesis". This allows stub resolvers that 238 support AAAA records but not A6 record chains or binary labels to 239 perform lookups in domains that make use of these IPv6 DNS 240 features. 241 242 Performance has been improved. 243 244 The man pages now use the more portable "man" macros rather than 245 the "mandoc" macros, and are installed by "make install". 246 247 The named.conf parser has been completely rewritten. It now 248 supports "include" directives in more places such as inside "view" 249 statements, and it no longer has any reserved words. 250 251 The "rndc status" command is now implemented. 252 253 rndc can now be configured automatically. 254 255 A BIND 8 compatible stub resolver library is now included in 256 lib/bind. 257 258 OpenSSL has been removed from the distribution. This means that to 259 use DNSSEC, OpenSSL must be installed and the --with-openssl option 260 must be supplied to configure. This does not apply to the use of 261 TSIG, which does not require OpenSSL. 262 263 The source distribution now builds on Windows. See 264 win32utils/readme1.txt and win32utils/win32-build.txt for details. 265 266 This distribution also includes a new lightweight stub 267 resolver library and associated resolver daemon that fully 268 support forward and reverse lookups of both IPv4 and IPv6 269 addresses. This library is considered experimental and 270 is not a complete replacement for the BIND 8 resolver library. 271 Applications that use the BIND 8 res_* functions to perform 272 DNS lookups or dynamic updates still need to be linked against 273 the BIND 8 libraries. For DNS lookups, they can also use the 274 new "getrrsetbyname()" API. 275 276 BIND 9.2 is capable of acting as an authoritative server 277 for DNSSEC secured zones. This functionality is believed to 278 be stable and complete except for lacking support for 279 verifications involving wildcard records in secure zones. 280 281 When acting as a caching server, BIND 9.2 can be configured 282 to perform DNSSEC secure resolution on behalf of its clients. 283 This part of the DNSSEC implementation is still considered 284 experimental. For detailed information about the state of the 285 DNSSEC implementation, see the file doc/misc/dnssec. 286 287 There are a few known bugs: 288 289 On some systems, IPv6 and IPv4 sockets interact in 290 unexpected ways. For details, see doc/misc/ipv6. 291 To reduce the impact of these problems, the server 292 no longer listens for requests on IPv6 addresses 293 by default. If you need to accept DNS queries over 294 IPv6, you must specify "listen-on-v6 { any; };" 295 in the named.conf options statement. 296 297 FreeBSD prior to 4.2 (and 4.2 if running as non-root) 298 and OpenBSD prior to 2.8 log messages like 299 "fcntl(8, F_SETFL, 4): Inappropriate ioctl for device". 300 This is due to a bug in "/dev/random" and impacts the 301 server's DNSSEC support. 302 303 OS X 10.1.4 (Darwin 5.4), OS X 10.1.5 (Darwin 5.5) and 304 OS X 10.2 (Darwin 6.0) reports errors like 305 "fcntl(3, F_SETFL, 4): Operation not supported by device". 306 This is due to a bug in "/dev/random" and impacts the 307 server's DNSSEC support. 308 309 --with-libtool does not work on AIX. 310 311 A bug in some versions of the Microsoft DNS server can cause zone 312 transfers from a BIND 9 server to a W2K server to fail. For details, 313 see the "Zone Transfers" section in doc/misc/migration. 314