.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
..
.. SPDX-License-Identifier: MPL-2.0
..
.. This Source Code Form is subject to the terms of the Mozilla Public
.. License, v. 2.0.  If a copy of the MPL was not distributed with this
.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
..
.. See the COPYRIGHT file distributed with this work for additional
.. information regarding copyright ownership.

Notes for BIND 9.17.18
----------------------

New Features
~~~~~~~~~~~~

- Support for HTTPS and SVCB record types has been added. :gl:`#1132`

Feature Changes
~~~~~~~~~~~~~~~

- When :iscman:`dnssec-signzone` signs a zone using a successor key whose
  predecessor is still published, it now only refreshes signatures for
  RRsets which have an invalid signature, an expired signature, or a
  signature which expires within the provided cycle interval. This
  allows :iscman:`dnssec-signzone` to gradually replace signatures in a zone
  whose ZSK is being rolled over (similarly to what ``auto-dnssec
  maintain;`` does). :gl:`#1551`

- :iscman:`dnssec-cds` now only generates SHA-2 DS records by default and
  avoids copying deprecated SHA-1 records from a child zone to its
  delegation in the parent. If the child zone does not publish SHA-2 CDS
  records, :iscman:`dnssec-cds` will generate them from the CDNSKEY records.
  The ``-a algorithm`` option now affects the process of generating DS
  digest records from both CDS and CDNSKEY records. Thanks to Tony
  Finch. :gl:`#2871`

- When reporting zone types in the statistics channel, the terms
  ``primary`` and ``secondary`` are now used instead of ``master`` and
  ``slave``, respectively. :gl:`#1944`

Bug Fixes
~~~~~~~~~

- A recent change to the internal memory structure of zone databases
  inadvertently neglected to update the MAPAPI value for zone files in
  ``map`` format. This caused version 9.17.17 of :iscman:`named` to attempt to
  load files into memory that were no longer compatible, triggering an
  assertion failure on startup. The MAPAPI value has now been updated,
  so :iscman:`named` rejects outdated files when encountering them.
  :gl:`#2872`

- Zone files in ``map`` format whose size exceeded 2 GB failed to load.
  This has been fixed. :gl:`#2878`

- Stale data in the cache could cause :iscman:`named` to send non-minimized
  queries despite QNAME minimization being enabled. This has been fixed.
  :gl:`#2665`

- When a DNSSEC-signed zone which only has a single signing key
  available is migrated to ``dnssec-policy``, that key is now treated as
  a Combined Signing Key (CSK). :gl:`#2857`

- When a dynamic zone was made available in another view using the
  ``in-view`` statement, running :option:`rndc freeze` always reported an
  ``already frozen`` error even though the zone was successfully
  frozen. This has been fixed. :gl:`#2844`
