BIND 9.4.3-P3

BIND 9.4 has a number of new features over 9.3, including:

Implemented "additional section caching" (or "acache"), an internal cache framework for additional section content to improve response performance. Several configuration options were provided to control the behavior.

New notify type 'master-only'. Enable notify for master zones only.

Accept 'notify-source' style syntax for query-source.

rndc now allows addresses to be set in the server clauses.

New option "allow-query-cache". This lets allow-query be used to specify the default zone access level rather than having to have every zone override the global value. allow-query-cache can be set at both the options and view levels. If allow-query-cache is not set allow-query applies.

rndc: the source address can now be specified.

ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.

Allow the journal's name to be changed via named.conf.

'rndc notify zone [class [view]]' resend the NOTIFY messages for the specified zone.

'dig +trace' now randomly selects the next servers to try. Report if there is a bad delegation.

Improve check-names error messages.

Make public the function to read a key file, dst_key_read_public().

dig now returns the byte count for axfr/ixfr.

allow-update is now settable at the options / view level.

named-checkconf now checks the logging configuration.

host now can turn on memory debugging flags with '-m'.

Don't send notify messages to self.

Perform sanity checks on NS records which refer to 'in zone' names.

New zone option "notify-delay". Specify a minimum delay between sets of NOTIFY messages.

Extend adjusting TTL warning messages.

Named and named-checkzone can now both check for non-terminal wildcard records.

"rndc freeze/thaw" now freezes/thaws all zones.

named-checkconf now check acls to verify that they only refer to existing acls.

The server syntax has been extended to support a range of servers.

Report differences between hints and real NS rrset and associated address records.

Preserve the case of domain names in rdata during zone transfers.

Restructured the data locking framework using architecture dependent atomic operations (when available), improving response performance on multi-processor machines significantly. x86, x86_64, alpha, powerpc, and mips are currently supported.

UNIX domain controls are now supported.

Add support for additional zone file formats for improving loading performance. The masterfile-format option in named.conf can be used to specify a non-default format. A separate command named-compilezone was provided to generate zone files in the new format. Additionally, the -I and -O options for dnssec-signzone specify the input and output formats.

dnssec-signzone can now randomize signature end times (dnssec-signzone -j jitter).

Add support for CH A record.

Add additional zone data constancy checks. named-checkzone has extended checking of NS, MX and SRV record and the hosts they reference. named has extended post zone load checks. New zone options: check-mx and integrity-check.

edns-udp-size can now be overridden on a per server basis.

dig can now specify the EDNS version when making a query.

Added framework for handling multiple EDNS versions.

Additional memory debugging support to track size and mctx arguments.

Detect duplicates of UDP queries we are recursing on and drop them. New stats category "duplicates".

Memory management. "USE INTERNAL MALLOC" is now runtime selectable.

The lame cache is now done on a basis as some servers only appear to be lame for certain query types.

Limit the number of recursive clients that can be waiting for a single query () to resolve. New options clients-per-query and max-clients-per-query.

dig: report the number of extra bytes still left in the packet after processing all the records.

Support for IPSECKEY rdata type.

Raise the UDP recieve buffer size to 32k if it is less than 32k.

x86 and x86_64 now have separate atomic locking implementations.

named-checkconf now validates update-policy entries.

Attempt to make the amount of work performed in a iteration self tuning. The covers nodes clean from the cache per iteration, nodes written to disk when rewriting a master file and nodes destroyed per iteration when destroying a zone or a cache.

ISC string copy API.

Automatic empty zone creation for D.F.IP6.ARPA and friends. Note: RFC 1918 zones are not yet covered by this but are likely to be in a future release.

New options: empty-server, empty-contact, empty-zones-enable and disable-empty-zone.

dig now has a '-q queryname' and '+showsearch' options.

host/nslookup now continue (default)/fail on SERVFAIL.

dig now warns if 'RA' is not set in the answer when 'RD' was set in the query. host/nslookup skip servers that fail to set 'RA' when 'RD' is set unless a server is explicitly set.

Integrate contributed DLZ code into named.

Integrate contributed IDN code from JPNIC.

Validate pending NS RRsets, in the authority section, prior to returning them if it can be done without requiring DNSKEYs to be fetched.

It is now possible to configure named to accept expired RRSIGs. Default "dnssec-accept-expired no;". Setting "dnssec-accept-expired yes;" leaves named vulnerable to replay attacks.

Addition memory leakage checks.

The maximum EDNS UDP response named will send can now be set in named.conf (max-udp-size). This is independent of the advertised receive buffer (edns-udp-size).

Named now falls back to advertising EDNS with a 512 byte receive buffer if the initial EDNS queries fail.

Control the zeroing of the negative response TTL to a soa query. Defaults "zero-no-soa-ttl yes;" and "zero-no-soa-ttl-cache no;".

Seperate out MX and SRV to CNAME checks.

dig/nslookup/host: warn about missing "QR".

TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and HMACSHA512 support.

dnssec-signzone: output the SOA record as the first record in the signed zone.

Two new update policies. "selfsub" and "selfwild".

dig, nslookup and host now advertise a 4096 byte EDNS UDP buffer size by default.

Report when a zone is removed.

DS/DLV SHA256 digest algorithm support.

Implement "rrset-order fixed".

Check the KSK flag when updating a secure dynamic zone. New zone option "update-check-ksk yes;".

It is now possible to explicitly enable DNSSEC validation. default dnssec-validation no; to be changed to yes in 9.5.0.

It is now posssible to enable/disable DNSSEC validation from rndc. This is useful for the mobile hosts where the current connection point breaks DNSSEC (firewall/proxy).

rndc validation newstate [view]

dnssec-signzone can now update the SOA record of the signed zone, either as an increment or as the system time().

Statistics about acache now recorded and sent to log.

libbind: corresponds to that from BIND 8.4.7.