564 lines
26 KiB
HTML
564 lines
26 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||
<!--
|
||
- Copyright (C) 2000-2020 Internet Systems Consortium, Inc. ("ISC")
|
||
-
|
||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||
-->
|
||
<html lang="en">
|
||
<head>
|
||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||
<title>Appendix A. Release Notes</title>
|
||
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
|
||
<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
|
||
<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
|
||
<link rel="prev" href="Bv9ARM.ch07.html" title="Chapter 7. Troubleshooting">
|
||
<link rel="next" href="Bv9ARM.ch09.html" title="Appendix B. A Brief History of the DNS and BIND">
|
||
</head>
|
||
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
|
||
<div class="navheader">
|
||
<table width="100%" summary="Navigation header">
|
||
<tr><th colspan="3" align="center">Appendix A. Release Notes</th></tr>
|
||
<tr>
|
||
<td width="20%" align="left">
|
||
<a accesskey="p" href="Bv9ARM.ch07.html">Prev</a> </td>
|
||
<th width="60%" align="center"> </th>
|
||
<td width="20%" align="right"> <a accesskey="n" href="Bv9ARM.ch09.html">Next</a>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
<hr>
|
||
</div>
|
||
<div class="appendix">
|
||
<div class="titlepage"><div><div><h1 class="title">
|
||
<a name="Bv9ARM.ch08"></a>Release Notes</h1></div></div></div>
|
||
<div class="toc">
|
||
<p><b>Table of Contents</b></p>
|
||
<dl class="toc">
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.16.2</a></span></dt>
|
||
<dd><dl>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_platforms">Supported Platforms</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.16.2">Notes for BIND 9.16.2</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.16.1">Notes for BIND 9.16.1</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.16.0">Notes for BIND 9.16.0</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_license">License</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#end_of_life">End of Life</a></span></dt>
|
||
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_thanks">Thank You</a></span></dt>
|
||
</dl></dd>
|
||
</dl>
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
|
||
<a name="id-1.9.2"></a>Release Notes for BIND Version 9.16.2</h2></div></div></div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
|
||
<p>
|
||
BIND 9.16 is a stable branch of BIND.
|
||
This document summarizes significant changes since the last
|
||
production release on that branch.
|
||
</p>
|
||
<p>
|
||
Please see the file <code class="filename">CHANGES</code> for a more
|
||
detailed list of changes and bug fixes.
|
||
</p>
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes_versions"></a>Note on Version Numbering</h3></div></div></div>
|
||
<p>
|
||
As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable"
|
||
release numbering convention. BIND 9.16 contains new features added
|
||
during the BIND 9.15 development process. Henceforth, the 9.16 branch
|
||
will be limited to bug fixes and new feature development will proceed
|
||
in the unstable 9.17 branch.
|
||
</p>
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes_platforms"></a>Supported Platforms</h3></div></div></div>
|
||
<p>
|
||
To build on UNIX-like systems, BIND requires support for POSIX.1c
|
||
threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for
|
||
IPv6 (RFC 3542), and standard atomic operations provided by the
|
||
C compiler.
|
||
</p>
|
||
<p>
|
||
The <code class="filename">libuv</code> asynchronous I/O library and the
|
||
OpenSSL cryptography library must be available for the target
|
||
platform. A PKCS#11 provider can be used instead of OpenSSL for
|
||
Public Key cryptography (i.e., DNSSEC signing and validation),
|
||
but OpenSSL is still required for general cryptography operations
|
||
such as hashing and random number generation.
|
||
</p>
|
||
<p>
|
||
More information can be found in the <code class="filename">PLATFORMS.md</code>
|
||
file that is included in the source distribution of BIND 9. If your
|
||
compiler and system libraries provide the above features, BIND 9
|
||
should compile and run. If that isn't the case, the BIND
|
||
development team will generally accept patches that add support
|
||
for systems that are still supported by their respective vendors.
|
||
</p>
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes_download"></a>Download</h3></div></div></div>
|
||
<p>
|
||
The latest versions of BIND 9 software can always be found at
|
||
<a class="link" href="https://www.isc.org/download/" target="_top">https://www.isc.org/download/</a>.
|
||
There you will find additional information about each release,
|
||
source code, and pre-compiled versions for Microsoft Windows
|
||
operating systems.
|
||
</p>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes-9.16.2"></a>Notes for BIND 9.16.2</h3></div></div></div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.2-security"></a>Security Fixes</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||
<p>
|
||
DNS rebinding protection was ineffective when BIND 9 is configured as
|
||
a forwarding DNS server. Found and responsibly reported by Tobias
|
||
Klein. [GL #1574]
|
||
</p>
|
||
</li></ul></div>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.2-known"></a>Known Issues</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||
<p>
|
||
We have received reports that in some circumstances, receipt of an
|
||
IXFR can cause the processing of queries to slow significantly. Some
|
||
of these were related to RPZ processing, which has been fixed in this
|
||
release (see below). Others appear to occur where there are
|
||
NSEC3-related changes (such as an operator changing the NSEC3 salt
|
||
used in the hash calculation). These are being investigated.
|
||
[GL #1685]
|
||
</p>
|
||
</li></ul></div>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.2-changes"></a>Feature Changes</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||
<p>
|
||
The previous DNSSEC sign statistics used lots of memory. The number of
|
||
keys to track is reduced to four per zone, which should be enough for
|
||
99% of all signed zones. [GL #1179]
|
||
</p>
|
||
</li></ul></div>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.2-bugs"></a>Bug Fixes</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||
<li class="listitem">
|
||
<p>
|
||
When an RPZ policy zone was updated via zone transfer and a large
|
||
number of records was deleted, <span class="command"><strong>named</strong></span> could become
|
||
nonresponsive for a short period while deleted names were removed from
|
||
the RPZ summary database. This database cleanup is now done
|
||
incrementally over a longer period of time, reducing such delays.
|
||
[GL #1447]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
When trying to migrate an already-signed zone from
|
||
<span class="command"><strong>auto-dnssec maintain</strong></span> to one based on
|
||
<span class="command"><strong>dnssec-policy</strong></span>, the existing keys were immediately
|
||
deleted and replaced with new ones. As the key rollover timing
|
||
constraints were not being followed, it was possible that some clients
|
||
would not have been able to validate responses until all old DNSSEC
|
||
information had timed out from caches. BIND now looks at the time
|
||
metadata of the existing keys and incorporates it into its DNSSEC
|
||
policy operation. [GL #1706]
|
||
</p>
|
||
</li>
|
||
</ul></div>
|
||
</div>
|
||
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes-9.16.1"></a>Notes for BIND 9.16.1</h3></div></div></div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.1-known"></a>Known Issues</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||
<p>
|
||
UDP network ports used for listening can no longer simultaneously be
|
||
used for sending traffic. An example configuration which triggers
|
||
this issue would be one which uses the same
|
||
<em class="replaceable"><code>address:port</code></em> pair for
|
||
<span class="command"><strong>listen-on(-v6)</strong></span> statements as for
|
||
<span class="command"><strong>notify-source(-v6)</strong></span> or
|
||
<span class="command"><strong>transfer-source(-v6)</strong></span>. While this issue affects all
|
||
operating systems, it only triggers log messages (e.g. "unable to
|
||
create dispatch for reserved port") on some of them. There are
|
||
currently no plans to make such a combination of settings work again.
|
||
</p>
|
||
</li></ul></div>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.1-changes"></a>Feature Changes</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||
<p>
|
||
The system-provided POSIX Threads read-write lock implementation is
|
||
now used by default instead of the native BIND 9 implementation.
|
||
Please be aware that glibc versions 2.26 through 2.29 had a
|
||
<a class="link" href="https://sourceware.org/bugzilla/show_bug.cgi?id=23844" target="_top">bug</a>
|
||
that could cause BIND 9 to deadlock. A fix was released in glibc 2.30,
|
||
and most current Linux distributions have patched or updated glibc,
|
||
with the notable exception of Ubuntu 18.04 (Bionic) which is a work in
|
||
progress. If you are running on an affected operating system, compile
|
||
BIND 9 with <span class="command"><strong>--disable-pthread-rwlock</strong></span> until a fixed
|
||
version of glibc is available. [GL !3125]
|
||
</p>
|
||
</li></ul></div>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.1-bugs"></a>Bug Fixes</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||
<p>
|
||
Fixed re-signing issues with inline zones which resulted in
|
||
records being re-signed late or not at all.
|
||
</p>
|
||
</li></ul></div>
|
||
</div>
|
||
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes-9.16.0"></a>Notes for BIND 9.16.0</h3></div></div></div>
|
||
|
||
<p>
|
||
<span class="emphasis"><em>Note: this section only lists changes from BIND 9.14 (the
|
||
previous stable branch of BIND).</em></span>
|
||
</p>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.0-new"></a>New Features</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||
<li class="listitem">
|
||
<p>
|
||
A new asynchronous network communications system based on
|
||
<span class="command"><strong>libuv</strong></span> is now used by <span class="command"><strong>named</strong></span>
|
||
for listening for incoming requests and responding to them.
|
||
This change will make it easier to improve performance and
|
||
implement new protocol layers (for example, DNS over TLS) in
|
||
the future. [GL #29]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
The new <span class="command"><strong>dnssec-policy</strong></span> option allows the
|
||
configuration of a key and signing policy (KASP) for zones. This
|
||
option enables <span class="command"><strong>named</strong></span> to generate new keys
|
||
as needed and automatically roll both ZSK and KSK keys.
|
||
(Note that the syntax for this statement differs from the DNSSEC
|
||
policy used by <span class="command"><strong>dnssec-keymgr</strong></span>.) [GL #1134]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
In order to clarify the configuration of DNSSEC keys,
|
||
the <span class="command"><strong>trusted-keys</strong></span> and
|
||
<span class="command"><strong>managed-keys</strong></span> statements have been
|
||
deprecated, and the new <span class="command"><strong>trust-anchors</strong></span>
|
||
statement should now be used for both types of key.
|
||
</p>
|
||
<p>
|
||
When used with the keyword <span class="command"><strong>initial-key</strong></span>,
|
||
<span class="command"><strong>trust-anchors</strong></span> has the same behavior as
|
||
<span class="command"><strong>managed-keys</strong></span>, i.e., it configures
|
||
a trust anchor that is to be maintained via RFC 5011.
|
||
</p>
|
||
<p>
|
||
When used with the new keyword <span class="command"><strong>static-key</strong></span>,
|
||
<span class="command"><strong>trust-anchors</strong></span> has the same behavior as
|
||
<span class="command"><strong>trusted-keys</strong></span>, i.e., it configures a permanent
|
||
trust anchor that will not automatically be updated. (This usage
|
||
is not recommended for the root key.) [GL #6]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
Two new keywords have been added to the
|
||
<span class="command"><strong>trust-anchors</strong></span> statement:
|
||
<span class="command"><strong>initial-ds</strong></span> and <span class="command"><strong>static-ds</strong></span>.
|
||
These allow the use of trust anchors in DS format instead of
|
||
DNSKEY format. DS format allows trust anchors to be configured
|
||
for keys that have not yet been published; this is the format
|
||
used by IANA when announcing future root keys.
|
||
</p>
|
||
<p>
|
||
As with the <span class="command"><strong>initial-key</strong></span> and
|
||
<span class="command"><strong>static-key</strong></span> keywords, <span class="command"><strong>initial-ds</strong></span>
|
||
configures a dynamic trust anchor to be maintained via RFC 5011, and
|
||
<span class="command"><strong>static-ds</strong></span> configures a permanent trust anchor.
|
||
[GL #6] [GL #622]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
<span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
|
||
<span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
|
||
option to print output in a detailed YAML format. [GL #1145]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
<span class="command"><strong>dig</strong></span> now has a new command line option:
|
||
<span class="command"><strong>+[no]unexpected</strong></span>. By default, <span class="command"><strong>dig</strong></span>
|
||
won't accept a reply from a source other than the one to which
|
||
it sent the query. Add the <span class="command"><strong>+unexpected</strong></span> argument
|
||
to enable it to process replies from unexpected sources. [RT #44978]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
<span class="command"><strong>dig</strong></span> now accepts a new command line option,
|
||
<span class="command"><strong>+[no]expandaaaa</strong></span>, which causes the IPv6
|
||
addresses in AAAA records to be printed in full 128-bit
|
||
notation rather than the default RFC 5952 format. [GL #765]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
Statistics channel groups can now be toggled. [GL #1030]
|
||
</p>
|
||
</li>
|
||
</ul></div>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.0-changes"></a>Feature Changes</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||
<li class="listitem">
|
||
<p>
|
||
When static and managed DNSSEC keys were both configured for the
|
||
same name, or when a static key was used to
|
||
configure a trust anchor for the root zone and
|
||
<span class="command"><strong>dnssec-validation</strong></span> was set to the default
|
||
value of <code class="literal">auto</code>, automatic RFC 5011 key
|
||
rollovers would be disabled. This combination of settings was
|
||
never intended to work, but there was no check for it in the
|
||
parser. This has been corrected, and it is now a fatal
|
||
configuration error. [GL #868]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
DS and CDS records are now generated with SHA-256 digests
|
||
only, instead of both SHA-1 and SHA-256. This affects the
|
||
default output of <span class="command"><strong>dnssec-dsfromkey</strong></span>, the
|
||
<code class="filename">dsset</code> files generated by
|
||
<span class="command"><strong>dnssec-signzone</strong></span>, the DS records added to
|
||
a zone by <span class="command"><strong>dnssec-signzone</strong></span> based on
|
||
<code class="filename">keyset</code> files, the CDS records added to
|
||
a zone by <span class="command"><strong>named</strong></span> and
|
||
<span class="command"><strong>dnssec-signzone</strong></span> based on "sync" timing
|
||
parameters in key files, and the checks performed by
|
||
<span class="command"><strong>dnssec-checkds</strong></span>. [GL #1015]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
<span class="command"><strong>named</strong></span> will now log a warning if
|
||
a static key is configured for the root zone. [GL #6]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||
have been removed, and only the default AES algorithm is being kept
|
||
for legacy reasons. This change has no operational impact in most
|
||
common scenarios. [GL #605]
|
||
</p>
|
||
<p>
|
||
If you are running multiple DNS servers (different versions of BIND 9
|
||
or DNS servers from multiple vendors) responding from the same IP
|
||
address (anycast or load-balancing scenarios), make sure that all the
|
||
servers are configured with the same DNS Cookie algorithm and same
|
||
Server Secret for the best performance.
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
The information from the <span class="command"><strong>dnssec-signzone</strong></span> and
|
||
<span class="command"><strong>dnssec-verify</strong></span> commands is now printed to standard
|
||
output. The standard error output is only used to print warnings and
|
||
errors, and in case the user requests the signed zone to be printed to
|
||
standard output with the <span class="command"><strong>-f -</strong></span> option. A new
|
||
configuration option <span class="command"><strong>-q</strong></span> has been added to silence
|
||
all output on standard output except for the name of the signed zone.
|
||
[GL #1151]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
The DNSSEC validation code has been refactored for clarity and to
|
||
reduce code duplication. [GL #622]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
Compile-time settings enabled by the
|
||
<span class="command"><strong>--with-tuning=large</strong></span> option for
|
||
<span class="command"><strong>configure</strong></span> are now in effect by default.
|
||
Previously used default compile-time settings can be enabled
|
||
by passing <span class="command"><strong>--with-tuning=small</strong></span> to
|
||
<span class="command"><strong>configure</strong></span>. [GL !2989]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
JSON-C is now the only supported library for enabling JSON
|
||
support for BIND statistics. The <span class="command"><strong>configure</strong></span>
|
||
option has been renamed from <span class="command"><strong>--with-libjson</strong></span>
|
||
to <span class="command"><strong>--with-json-c</strong></span>. Set the
|
||
<span class="command"><strong>PKG_CONFIG_PATH</strong></span> environment variable
|
||
accordingly to specify a custom path to the
|
||
<span class="command"><strong>json-c</strong></span> library, as the new
|
||
<span class="command"><strong>configure</strong></span> option does not take the library
|
||
installation path as an optional argument. [GL #855]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
<span class="command"><strong>./configure</strong></span> no longer sets
|
||
<span class="command"><strong>--sysconfdir</strong></span> to <span class="command"><strong>/etc</strong></span> or
|
||
<span class="command"><strong>--localstatedir</strong></span> to <span class="command"><strong>/var</strong></span>
|
||
when <span class="command"><strong>--prefix</strong></span> is not specified and the
|
||
aforementioned options are not specified explicitly. Instead,
|
||
Autoconf's defaults of <span class="command"><strong>$prefix/etc</strong></span> and
|
||
<span class="command"><strong>$prefix/var</strong></span> are respected. [GL #658]
|
||
</p>
|
||
</li>
|
||
</ul></div>
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="relnotes-9.16.0-removed"></a>Removed Features</h4></div></div></div>
|
||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||
<li class="listitem">
|
||
<p>
|
||
The <span class="command"><strong>dnssec-enable</strong></span> option has been obsoleted and
|
||
no longer has any effect. DNSSEC responses are always enabled
|
||
if signatures and other DNSSEC data are present. [GL #866]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
DNSSEC Lookaside Validation (DLV) is now obsolete.
|
||
The <span class="command"><strong>dnssec-lookaside</strong></span> option has been
|
||
marked as deprecated; when used in <code class="filename">named.conf</code>,
|
||
it will generate a warning but will otherwise be ignored.
|
||
All code enabling the use of lookaside validation has been removed
|
||
from the validator, <span class="command"><strong>delv</strong></span>, and the DNSSEC tools.
|
||
[GL #7]
|
||
</p>
|
||
</li>
|
||
<li class="listitem">
|
||
<p>
|
||
The <span class="command"><strong>cleaning-interval</strong></span> option has been
|
||
removed. [GL !1731]
|
||
</p>
|
||
</li>
|
||
</ul></div>
|
||
</div>
|
||
|
||
</div>
|
||
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes_license"></a>License</h3></div></div></div>
|
||
<p>
|
||
BIND 9 is open source software licensed under the terms of the Mozilla
|
||
Public License, version 2.0 (see the <code class="filename">LICENSE</code>
|
||
file for the full text).
|
||
</p>
|
||
<p>
|
||
The license requires that if you make changes to BIND and distribute
|
||
them outside your organization, those changes must be published under
|
||
the same license. It does not require that you publish or disclose
|
||
anything other than the changes you have made to our software. This
|
||
requirement does not affect anyone who is using BIND, with or without
|
||
modifications, without redistributing it, nor anyone redistributing
|
||
BIND without changes.
|
||
</p>
|
||
<p>
|
||
Those wishing to discuss license compliance may contact ISC at
|
||
<a class="link" href="https://www.isc.org/contact/" target="_top">
|
||
https://www.isc.org/contact/</a>.
|
||
</p>
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="end_of_life"></a>End of Life</h3></div></div></div>
|
||
<p>
|
||
The end of life date for BIND 9.16 has not yet been determined.
|
||
At some point in the future BIND 9.16 will be designated as an
|
||
Extended Support Version (ESV). Until then, the current ESV is
|
||
BIND 9.11, which will be supported until at least December 2021.
|
||
</p>
|
||
<p>
|
||
See
|
||
<a class="link" href="https://kb.isc.org/docs/aa-00896" target="_top">https://kb.isc.org/docs/aa-00896</a>
|
||
for details of ISC's software support policy.
|
||
</p>
|
||
</div>
|
||
<div class="section">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
|
||
<p>
|
||
Thank you to everyone who assisted us in making this release possible.
|
||
</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="navfooter">
|
||
<hr>
|
||
<table width="100%" summary="Navigation footer">
|
||
<tr>
|
||
<td width="40%" align="left">
|
||
<a accesskey="p" href="Bv9ARM.ch07.html">Prev</a> </td>
|
||
<td width="20%" align="center"> </td>
|
||
<td width="40%" align="right"> <a accesskey="n" href="Bv9ARM.ch09.html">Next</a>
|
||
</td>
|
||
</tr>
|
||
<tr>
|
||
<td width="40%" align="left" valign="top">Chapter 7. Troubleshooting </td>
|
||
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
|
||
<td width="40%" align="right" valign="top"> Appendix B. A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.16.2 (Stable Release)</p>
|
||
</body>
|
||
</html>
|