1 Summary of functional enhancements from prior major releases of BIND 9:
7 Automatic zone re-signing
9 New update-policy methods tcp-self and 6to4-self
11 The BIND 8 resolver library, libbind, has been removed from the
12 BIND 9 distribution and is now available as a separate download.
14 Change the default pid file location from /var/run to
15 /var/run/{named,lwresd} for improved chroot/setuid support.
19 GSS-TSIG support (RFC 3645).
23 Experimental http server and statistics support for named via xml.
25 More detailed statistics counters including those supported in BIND 8.
27 Faster ACL processing.
29 Use Doxygen to generate internal documentation.
31 Efficient LRU cache-cleaning mechanism.
37 Implemented "additional section caching (or acache)", an
38 internal cache framework for additional section content to
39 improve response performance. Several configuration options
40 were provided to control the behavior.
42 New notify type 'master-only'. Enable notify for master
45 Accept 'notify-source' style syntax for query-source.
47 rndc now allows addresses to be set in the server clauses.
49 New option "allow-query-cache". This lets "allow-query"
50 be used to specify the default zone access level rather
51 than having to have every zone override the global value.
52 "allow-query-cache" can be set at both the options and view
53 levels. If "allow-query-cache" is not set then "allow-recursion"
54 is used if set, otherwise "allow-query" is used if set
55 unless "recursion no;" is set in which case "none;" is used,
56 otherwise the default (localhost; localnets;) is used.
58 rndc: the source address can now be specified.
60 ixfr-from-differences now takes master and slave in addition
61 to yes and no at the options and view levels.
63 Allow the journal's name to be changed via named.conf.
65 'rndc notify zone [class [view]]' resend the NOTIFY messages
66 for the specified zone.
68 'dig +trace' now randomly selects the next servers to try.
69 Report if there is a bad delegation.
71 Improve check-names error messages.
73 Make public the function to read a key file, dst_key_read_public().
75 dig now returns the byte count for axfr/ixfr.
77 allow-update is now settable at the options / view level.
79 named-checkconf now checks the logging configuration.
81 host now can turn on memory debugging flags with '-m'.
83 Don't send notify messages to self.
85 Perform sanity checks on NS records which refer to 'in zone' names.
87 New zone option "notify-delay". Specify a minimum delay
88 between sets of NOTIFY messages.
90 Extend adjusting TTL warning messages.
92 Named and named-checkzone can now both check for non-terminal
95 "rndc freeze/thaw" now freezes/thaws all zones.
97 named-checkconf now check acls to verify that they only
98 refer to existing acls.
100 The server syntax has been extended to support a range of
103 Report differences between hints and real NS rrset and
104 associated address records.
106 Preserve the case of domain names in rdata during zone
109 Restructured the data locking framework using architecture
110 dependent atomic operations (when available), improving
111 response performance on multi-processor machines significantly.
112 x86, x86_64, alpha, powerpc, and mips are currently supported.
114 UNIX domain controls are now supported.
116 Add support for additional zone file formats for improving
117 loading performance. The masterfile-format option in
118 named.conf can be used to specify a non-default format. A
119 separate command named-compilezone was provided to generate
120 zone files in the new format. Additionally, the -I and -O
121 options for dnssec-signzone specify the input and output
124 dnssec-signzone can now randomize signature end times
125 (dnssec-signzone -j jitter).
127 Add support for CH A record.
129 Add additional zone data constancy checks. named-checkzone
130 has extended checking of NS, MX and SRV record and the hosts
131 they reference. named has extended post zone load checks.
132 New zone options: check-mx and integrity-check.
135 edns-udp-size can now be overridden on a per server basis.
137 dig can now specify the EDNS version when making a query.
139 Added framework for handling multiple EDNS versions.
141 Additional memory debugging support to track size and mctx
144 Detect duplicates of UDP queries we are recursing on and
145 drop them. New stats category "duplicates".
147 "USE INTERNAL MALLOC" is now runtime selectable.
149 The lame cache is now done on a <qname,qclass,qtype> basis
150 as some servers only appear to be lame for certain query
153 Limit the number of recursive clients that can be waiting
154 for a single query (<qname,qtype,qclass>) to resolve. New
155 options clients-per-query and max-clients-per-query.
157 dig: report the number of extra bytes still left in the
158 packet after processing all the records.
160 Support for IPSECKEY rdata type.
162 Raise the UDP recieve buffer size to 32k if it is less than 32k.
164 x86 and x86_64 now have seperate atomic locking implementations.
166 named-checkconf now validates update-policy entries.
168 Attempt to make the amount of work performed in a iteration
169 self tuning. The covers nodes clean from the cache per
170 iteration, nodes written to disk when rewriting a master
171 file and nodes destroyed per iteration when destroying a
176 Automatic empty zone creation for D.F.IP6.ARPA and friends.
177 Note: RFC 1918 zones are not yet covered by this but are
178 likely to be in a future release.
180 New options: empty-server, empty-contact, empty-zones-enable
181 and disable-empty-zone.
183 dig now has a '-q queryname' and '+showsearch' options.
185 host/nslookup now continue (default)/fail on SERVFAIL.
187 dig now warns if 'RA' is not set in the answer when 'RD'
188 was set in the query. host/nslookup skip servers that fail
189 to set 'RA' when 'RD' is set unless a server is explicitly
192 Integrate contibuted DLZ code into named.
194 Integrate contibuted IDN code from JPNIC.
196 libbind: corresponds to that from BIND 8.4.7.
200 DNSSEC is now DS based (RFC 3658).
201 See also RFC 3845, doc/draft/draft-ietf-dnsext-dnssec-*.
203 DNSSEC lookaside validation.
205 check-names is now implemented.
206 rrset-order in more complete.
208 IPv4/IPv6 transition support, dual-stack-servers.
210 IXFR deltas can now be generated when loading master files,
211 ixfr-from-differences.
213 It is now possible to specify the size of a journal, max-journal-size.
215 It is now possible to define a named set of master servers to be
216 used in masters clause, masters.
218 The advertised EDNS UDP size can now be set, edns-udp-size.
220 allow-v6-synthesis has been obsoleted.
223 * Zones containing MD and MF will now be rejected.
224 * dig, nslookup name. now report "Not Implemented" as
225 NOTIMP rather than NOTIMPL. This will have impact on scripts
226 that are looking for NOTIMPL.
228 libbind: corresponds to that from BIND 8.4.5.
232 The size of the cache can now be limited using the
233 "max-cache-size" option.
235 The server can now automatically convert RFC1886-style recursive
236 lookup requests into RFC2874-style lookups, when enabled using the
237 new option "allow-v6-synthesis". This allows stub resolvers that
238 support AAAA records but not A6 record chains or binary labels to
239 perform lookups in domains that make use of these IPv6 DNS
242 Performance has been improved.
244 The man pages now use the more portable "man" macros rather than
245 the "mandoc" macros, and are installed by "make install".
247 The named.conf parser has been completely rewritten. It now
248 supports "include" directives in more places such as inside "view"
249 statements, and it no longer has any reserved words.
251 The "rndc status" command is now implemented.
253 rndc can now be configured automatically.
255 A BIND 8 compatible stub resolver library is now included in
258 OpenSSL has been removed from the distribution. This means that to
259 use DNSSEC, OpenSSL must be installed and the --with-openssl option
260 must be supplied to configure. This does not apply to the use of
261 TSIG, which does not require OpenSSL.
263 The source distribution now builds on Windows. See
264 win32utils/readme1.txt and win32utils/win32-build.txt for details.
266 This distribution also includes a new lightweight stub
267 resolver library and associated resolver daemon that fully
268 support forward and reverse lookups of both IPv4 and IPv6
269 addresses. This library is considered experimental and
270 is not a complete replacement for the BIND 8 resolver library.
271 Applications that use the BIND 8 res_* functions to perform
272 DNS lookups or dynamic updates still need to be linked against
273 the BIND 8 libraries. For DNS lookups, they can also use the
274 new "getrrsetbyname()" API.
276 BIND 9.2 is capable of acting as an authoritative server
277 for DNSSEC secured zones. This functionality is believed to
278 be stable and complete except for lacking support for
279 verifications involving wildcard records in secure zones.
281 When acting as a caching server, BIND 9.2 can be configured
282 to perform DNSSEC secure resolution on behalf of its clients.
283 This part of the DNSSEC implementation is still considered
284 experimental. For detailed information about the state of the
285 DNSSEC implementation, see the file doc/misc/dnssec.
287 There are a few known bugs:
289 On some systems, IPv6 and IPv4 sockets interact in
290 unexpected ways. For details, see doc/misc/ipv6.
291 To reduce the impact of these problems, the server
292 no longer listens for requests on IPv6 addresses
293 by default. If you need to accept DNS queries over
294 IPv6, you must specify "listen-on-v6 { any; };"
295 in the named.conf options statement.
297 FreeBSD prior to 4.2 (and 4.2 if running as non-root)
298 and OpenBSD prior to 2.8 log messages like
299 "fcntl(8, F_SETFL, 4): Inappropriate ioctl for device".
300 This is due to a bug in "/dev/random" and impacts the
301 server's DNSSEC support.
303 OS X 10.1.4 (Darwin 5.4), OS X 10.1.5 (Darwin 5.5) and
304 OS X 10.2 (Darwin 6.0) reports errors like
305 "fcntl(3, F_SETFL, 4): Operation not supported by device".
306 This is due to a bug in "/dev/random" and impacts the
307 server's DNSSEC support.
309 --with-libtool does not work on AIX.
311 A bug in some versions of the Microsoft DNS server can cause zone
312 transfers from a BIND 9 server to a W2K server to fail. For details,
313 see the "Zone Transfers" section in doc/misc/migration.