number (E(#)), if TCP was used (T), if DO
(DNSSEC Ok) was set (D), if CD (Checking
Disabled) was set (C), if a valid DNS Server
- COOKIE was recieved (V), or if a DNS COOKIE
+ COOKIE was received (V), or if a DNS COOKIE
option without a valid Server COOKIE was
present (K). After this the destination
address the query was sent to is reported.
<div class="appendix" lang="en">
<div class="titlepage"><div><div><h2 class="title">
<a name="Bv9ARM.ch09"></a>Appendix A. Release Notes</h2></div></div></div>
-<div class="toc">
-<p><b>Table of Contents</b></p>
-<dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2573876">Release Notes for BIND Version 9.11.0pre-alpha</a></span></dt>
-<dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
-</dl></dd>
-</dl>
-</div>
-<div class="sect1" lang="en">
-<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2573876"></a>Release Notes for BIND Version 9.11.0pre-alpha</h2></div></div></div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
-<p>
- This document summarizes changes since the last production release
- of BIND on the corresponding major release branch.
- </p>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_download"></a>Download</h3></div></div></div>
-<p>
- The latest versions of BIND 9 software can always be found at
- <a href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
- There you will find additional information about each release,
- source code, and pre-compiled versions for Microsoft Windows
- operating systems.
- </p>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li>
-<p>
- A specially crafted query could trigger an assertion failure
- in message.c
- </p>
-<p>
- This flaw was discovered by Jonathan Foote, and is disclosed
- in CVE-2015-5477. [RT #39795]
- </p>
-</li>
-<li>
-<p>
- On servers configured to perform DNSSEC validation, an
- assertion failure could be triggered on answers from
- a specially configured server.
- </p>
-<p>
- This flaw was discovered by Breno Silveira Soares, and is
- disclosed in CVE-2015-4620. [RT #39795]
- </p>
-</li>
-<li>
-<p>
- On servers configured to perform DNSSEC validation using
- managed trust anchors (i.e., keys configured explicitly
- via <span><strong class="command">managed-keys</strong></span>, or implicitly
- via <span><strong class="command">dnssec-validation auto;</strong></span> or
- <span><strong class="command">dnssec-lookaside auto;</strong></span>), revoking
- a trust anchor and sending a new untrusted replacement
- could cause <span><strong class="command">named</strong></span> to crash with an
- assertion failure. This could occur in the event of a
- botched key rollover, or potentially as a result of a
- deliberate attack if the attacker was in position to
- monitor the victim's DNS traffic.
- </p>
-<p>
- This flaw was discovered by Jan-Piet Mens, and is
- disclosed in CVE-2015-1349. [RT #38344]
- </p>
-</li>
-<li>
-<p>
- A flaw in delegation handling could be exploited to put
- <span><strong class="command">named</strong></span> into an infinite loop, in which
- each lookup of a name server triggered additional lookups
- of more name servers. This has been addressed by placing
- limits on the number of levels of recursion
- <span><strong class="command">named</strong></span> will allow (default 7), and
- on the number of queries that it will send before
- terminating a recursive query (default 50).
- </p>
-<p>
- The recursion depth limit is configured via the
- <code class="option">max-recursion-depth</code> option, and the query limit
- via the <code class="option">max-recursion-queries</code> option.
- </p>
-<p>
- The flaw was discovered by Florian Maury of ANSSI, and is
- disclosed in CVE-2014-8500. [RT #37580]
- </p>
-</li>
-<li>
-<p>
- Two separate problems were identified in BIND's GeoIP code that
- could lead to an assertion failure. One was triggered by use of
- both IPv4 and IPv6 address families, the other by referencing
- a GeoIP database in <code class="filename">named.conf</code> which was
- not installed. Both are covered by CVE-2014-8680. [RT #37672]
- [RT #37679]
- </p>
-<p>
- A less serious security flaw was also found in GeoIP: changes
- to the <span><strong class="command">geoip-directory</strong></span> option in
- <code class="filename">named.conf</code> were ignored when running
- <span><strong class="command">rndc reconfig</strong></span>. In theory, this could allow
- <span><strong class="command">named</strong></span> to allow access to unintended clients.
- </p>
-</li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_features"></a>New Features</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li>
-<p>
- New quotas have been added to limit the queries that are
- sent by recursive resolvers to authoritative servers
- experiencing denial-of-service attacks. When configured,
- these options can both reduce the harm done to authoritative
- servers and also avoid the resource exhaustion that can be
- experienced by recursives when they are being used as a
- vehicle for such an attack.
- </p>
-<div class="itemizedlist"><ul type="circle">
-<li><p>
- <code class="option">fetches-per-server</code> limits the number of
- simultaneous queries that can be sent to any single
- authoritative server. The configured value is a starting
- point; it is automatically adjusted downward if the server is
- partially or completely non-responsive. The algorithm used to
- adjust the quota can be configured via the
- <code class="option">fetch-quota-params</code> option.
- </p></li>
-<li><p>
- <code class="option">fetches-per-zone</code> limits the number of
- simultaneous queries that can be sent for names within a
- single domain. (Note: Unlike "fetches-per-server", this
- value is not self-tuning.)
- </p></li>
-</ul></div>
-<p>
- Statistics counters have also been added to track the number
- of queries affected by these quotas.
- </p>
-</li>
-<li><p>
- New statistics counters have been added to track traffic
- sizes, as specified in RSSAC002. Query and response
- message sizes are broken up into ranges of histogram buckets:
- TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
- and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
- and 4096+. These values can be accessed via the XML and JSON
- statistics channels at, for example,
- <a href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
- or
- <a href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
- </p></li>
-<li><p>
- The serial number of a dynamically updatable zone can
- now be set using
- <span><strong class="command">rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
- This is particularly useful with <code class="option">inline-signing</code>
- zones that have been reset. Setting the serial number to a value
- larger than that on the slaves will trigger an AXFR-style
- transfer.
- </p></li>
-<li><p>
- When answering recursive queries, SERVFAIL responses can now be
- cached by the server for a limited time; subsequent queries for
- the same query name and type will return another SERVFAIL until
- the cache times out. This reduces the frequency of retries
- when a query is persistently failing, which can be a burden
- on recursive serviers. The SERVFAIL cache timeout is controlled
- by <code class="option">servfail-ttl</code>, which defaults to 10 seconds
- and has an upper limit of 30.
- </p></li>
-<li><p>
- The new <span><strong class="command">rndc nta</strong></span> command can now be used to
- set a "negative trust anchor" (NTA), disabling DNSSEC validation for
- a specific domain; this can be used when responses from a domain
- are known to be failing validation due to administrative error
- rather than because of a spoofing attack. NTAs are strictly
- temporary; by default they expire after one hour, but can be
- configured to last up to one week. The default NTA lifetime
- can be changed by setting the <code class="option">nta-lifetime</code> in
- <code class="filename">named.conf</code>. When added, NTAs are stored in a
- file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
- in order to persist across restarts of the <span><strong class="command">named</strong></span> server.
- </p></li>
-<li><p>
- The EDNS Client Subnet (ECS) option is now supported for
- authoritative servers; if a query contains an ECS option then
- ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
- elements can match against the the address encoded in the option.
- This can be used to select a view for a query, so that different
- answers can be provided depending on the client network.
- </p></li>
-<li><p>
- The EDNS EXPIRE option has been implemented on the client
- side, allowing a slave server to set the expiration timer
- correctly when transferring zone data from another slave
- server.
- </p></li>
-<li><p>
- A new <code class="option">masterfile-style</code> zone option controls
- the formatting of text zone files: When set to
- <code class="literal">full</code>, the zone file will dumped in
- single-line-per-record format.
- </p></li>
-<li><p>
- <span><strong class="command">dig +ednsopt</strong></span> can now be used to set
- arbitrary EDNS options in DNS requests.
- </p></li>
-<li><p>
- <span><strong class="command">dig +ednsflags</strong></span> can now be used to set
- yet-to-be-defined EDNS flags in DNS requests.
- </p></li>
-<li><p>
- <span><strong class="command">dig +[no]ednsnegotiation</strong></span> can now be used enable /
- disable EDNS version negotiation.
- </p></li>
-<li><p>
- <span><strong class="command">dig +header-only</strong></span> can now be used to send
- queries without a question section.
- </p></li>
-<li><p>
- <span><strong class="command">dig +ttlunits</strong></span> causes <span><strong class="command">dig</strong></span>
- to print TTL values with time-unit suffixes: w, d, h, m, s for
- weeks, days, hours, minutes, and seconds.
- </p></li>
-<li><p>
- <span><strong class="command">dig +zflag</strong></span> can be used to set the last
- unassigned DNS header flag bit. This bit in normally zero.
- </p></li>
-<li><p>
- <span><strong class="command">dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
- can now be used to set the DSCP code point in outgoing query
- packets.
- </p></li>
-<li><p>
- <code class="option">serial-update-method</code> can now be set to
- <code class="literal">date</code>. On update, the serial number will
- be set to the current date in YYYYMMDDNN format.
- </p></li>
-<li><p>
- <span><strong class="command">dnssec-signzone -N date</strong></span> also sets the serial
- number to YYYYMMDDNN.
- </p></li>
-<li><p>
- <span><strong class="command">named -L <em class="replaceable"><code>filename</code></em></strong></span>
- causes <span><strong class="command">named</strong></span> to send log messages to the specified file by
- default instead of to the system log.
- </p></li>
-<li><p>
- The rate limiter configured by the
- <code class="option">serial-query-rate</code> option no longer covers
- NOTIFY messages; those are now separately controlled by
- <code class="option">notify-rate</code> and
- <code class="option">startup-notify-rate</code> (the latter of which
- controls the rate of NOTIFY messages sent when the server
- is first started up or reconfigured).
- </p></li>
-<li><p>
- The default number of tasks and client objects available
- for serving lightweight resolver queries have been increased,
- and are now configurable via the new <code class="option">lwres-tasks</code>
- and <code class="option">lwres-clients</code> options in
- <code class="filename">named.conf</code>. [RT #35857]
- </p></li>
-<li><p>
- Log output to files can now be buffered by specifying
- <span><strong class="command">buffered yes;</strong></span> when creating a channel.
- </p></li>
-<li><p>
- <span><strong class="command">delv +tcp</strong></span> will exclusively use TCP when
- sending queries.
- </p></li>
-<li><p>
- <span><strong class="command">named</strong></span> will now check to see whether
- other name server processes are running before starting up.
- This is implemented in two ways: 1) by refusing to start
- if the configured network interfaces all return "address
- in use", and 2) by attempting to acquire a lock on a file
- specified by the <code class="option">lock-file</code> option or
- the <span><strong class="command">-X</strong></span> command line option. The
- default lock file is
- <code class="filename">/var/run/named/named.lock</code>.
- Specifying <code class="literal">none</code> will disable the lock
- file check.
- </p></li>
-<li><p>
- <span><strong class="command">rndc delzone</strong></span> can now be applied to zones
- which were configured in <code class="filename">named.conf</code>;
- it is no longer restricted to zones which were added by
- <span><strong class="command">rndc addzone</strong></span>. (Note, however, that
- this does not edit <code class="filename">named.conf</code>; the zone
- must be removed from the configuration or it will return
- when <span><strong class="command">named</strong></span> is restarted or reloaded.)
- </p></li>
-<li><p>
- <span><strong class="command">rndc modzone</strong></span> can be used to reconfigure
- a zone, using similar syntax to <span><strong class="command">rndc addzone</strong></span>.
- </p></li>
-<li><p>
- <span><strong class="command">rndc showzone</strong></span> displays the current
- configuration for a specified zone.
- </p></li>
-<li>
-<p>
- Added server-side support for pipelined TCP queries. Clients
- may continue sending queries via TCP while previous queries are
- processed in parallel. Responses are sent when they are
- ready, not necessarily in the order in which the queries were
- received.
- </p>
-<p>
- To revert to the former behavior for a particular
- client address or range of addresses, specify the address prefix
- in the "keep-response-order" option. To revert to the former
- behavior for all clients, use "keep-response-order { any; };".
- </p>
-</li>
-<li><p>
- The new <span><strong class="command">mdig</strong></span> command is a version of
- <span><strong class="command">dig</strong></span> that sends multiple pipelined
- queries and then waits for responses, instead of sending one
- query and waiting the response before sending the next. [RT #38261]
- </p></li>
-<li><p>
- To enable better monitoring and troubleshooting of RFC 5011
- trust anchor management, the new <span><strong class="command">rndc managed-keys</strong></span>
- can be used to check status of trust anchors or to force keys
- to be refreshed. Also, the managed-keys data file now has
- easier-to-read comments. [RT #38458]
- </p></li>
-<li><p>
- An <span><strong class="command">--enable-querytrace</strong></span> configure switch is
- now available to enable very verbose query tracelogging. This
- option can only be set at compile time. This option has a
- negative performance impact and should be used only for
- debugging. [RT #37520]
- </p></li>
-<li><p>
- A new <span><strong class="command">tcp-only</strong></span> option can be specified
- in <span><strong class="command">server</strong></span> statements to force
- <span><strong class="command">named</strong></span> to connect to the specified
- server via TCP. [RT #37800]
- </p></li>
-<li><p>
- The <span><strong class="command">nxdomain-redirect</strong></span> option specifies
- a DNS namespace to use for NXDOMAIN redirection. When a
- recursive lookup returns NXDOMAIN, a second lookup is
- initiated with the specified name appended to the query
- name. This allows NXDOMAIN redirection data to be supplied
- by multiple zones configured on the server or by recursive
- queries to other servers. (The older method, using
- a single <span><strong class="command">type redirect</strong></span> zone, has
- better average performance but is less flexible.) [RT #37989]
- </p></li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
- ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
- not correctly matched unless the full organization name was
- specified in the ACL (as in
- <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
- They can now match against the AS number alone (as in
- <span><strong class="command">geoip asnum "AS1234";</strong></span>).
- </p></li>
-<li><p>
- When using native PKCS#11 cryptography (i.e.,
- <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
- of up to 256 characters can now be used.
- </p></li>
-<li><p>
- NXDOMAIN responses to queries of type DS are now cached separately
- from those for other types. This helps when using "grafted" zones
- of type forward, for which the parent zone does not contain a
- delegation, such as local top-level domains. Previously a query
- of type DS for such a zone could cause the zone apex to be cached
- as NXDOMAIN, blocking all subsequent queries. (Note: This
- change is only helpful when DNSSEC validation is not enabled.
- "Grafted" zones without a delegation in the parent are not a
- recommended configuration.)
- </p></li>
-<li><p>
- Update forwarding performance has been improved by allowing
- a single TCP connection to be shared between multiple updates.
- </p></li>
-<li><p>
- By default, <span><strong class="command">nsupdate</strong></span> will now check
- the correctness of hostnames when adding records of type
- A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
- disabled with <span><strong class="command">check-names no</strong></span>.
- </p></li>
-<li><p>
- Added support for OPENPGPKEY type.
- </p></li>
-<li><p>
- The names of the files used to store managed keys and added
- zones for each view are no longer based on the SHA256 hash
- of the view name, except when this is necessary because the
- view name contains characters that would be incompatible with use
- as a file name. For views whose names do not contain forward
- slashes ('/'), backslashes ('\'), or capital letters - which
- could potentially cause namespace collision problems on
- case-insensitive filesystems - files will now be named
- after the view (for example, <code class="filename">internal.mkeys</code>
- or <code class="filename">external.nzf</code>). However, to ensure
- consistent behavior when upgrading, if a file using the old
- name format is found to exist, it will continue to be used.
- </p></li>
-<li><p>
- "rndc" can now return text output of arbitrary size to
- the caller. (Prior to this, certain commands such as
- "rndc tsig-list" and "rndc zonestatus" could return
- truncated output.)
- </p></li>
-<li><p>
- Errors reported when running <span><strong class="command">rndc addzone</strong></span>
- (e.g., when a zone file cannot be loaded) have been clarified
- to make it easier to diagnose problems.
- </p></li>
-<li><p>
- When encountering an authoritative name server whose name is
- an alias pointing to another name, the resolver treats
- this as an error and skips to the next server. Previously
- this happened silently; now the error will be logged to
- the newly-created "cname" log category.
- </p></li>
-<li><p>
- If <span><strong class="command">named</strong></span> is not configured to validate the answer then
- allow fallback to plain DNS on timeout even when we know
- the server supports EDNS. This will allow the server to
- potentially resolve signed queries when TCP is being
- blocked.
- </p></li>
-<li><p>
- Large inline-signing changes should be less disruptive.
- Signature generation is now done incrementally; the number
- of signatures to be generated in each quantum is controlled
- by "sig-signing-signatures <em class="replaceable"><code>number</code></em>;".
- [RT #37927]
- </p></li>
-<li>
-<p>
- The experimental SIT option (code point 65001) of BIND
- 9.10.0 through BIND 9.10.2 has be replace the COOKIE
- option (code point 10) and is no longer experimental and
- is sent by default.
- </p>
-<p>
- The SIT related named.conf options have been marked as
- obsolete and are otherwise ignored.
- </p>
-</li>
-<li><p>
- When retrying a query via TCP due to the first answer
- being truncated, <span><strong class="command">dig</strong></span> will now correctly
- send the Server COOKIE returned by the server in the prior
- response. [RT #39047]
- </p></li>
-<li><p>
- A alternative NXDOMAIN redirect method (nxdomain-redirect)
- which allows the redirect information to be looked up from
- a namespace on the Internet rather than requiring a zone
- to be configured on the server is now available.
- </p></li>
-<li><p>
- Retrieving the local port range from net.ipv4.ip_local_port_range
- on Linux is now supported.
- </p></li>
-<li><p>
- Within the <code class="option">response-policy</code> option, it is now
- possible to configure RPZ rewrite logging on a per-zone basis
- using the <code class="option">log</code> clause.
- </p></li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
- <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
- <span><strong class="command">nslookup</strong></span> aborted when encountering
- a name which, after appending search list elements,
- exceeded 255 bytes. Such names are now skipped, but
- processing of other names will continue. [RT #36892]
- </p></li>
-<li><p>
- The error message generated when
- <span><strong class="command">named-checkzone</strong></span> or
- <span><strong class="command">named-checkconf -z</strong></span> encounters a
- <code class="option">$TTL</code> directive without a value has
- been clarified. [RT #37138]
- </p></li>
-<li><p>
- Semicolon characters (;) included in TXT records were
- incorrectly escaped with a backslash when the record was
- displayed as text. This is actually only necessary when there
- are no quotation marks. [RT #37159]
- </p></li>
-<li><p>
- When files opened for writing by <span><strong class="command">named</strong></span>,
- such as zone journal files, were referenced more than once
- in <code class="filename">named.conf</code>, it could lead to file
- corruption as multiple threads wrote to the same file. This
- is now detected when loading <code class="filename">named.conf</code>
- and reported as an error. [RT #37172]
- </p></li>
-<li><p>
- When checking for updates to trust anchors listed in
- <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
- now revalidates keys based on the current set of
- active trust anchors, without relying on any cached
- record of previous validation. [RT #37506]
- </p></li>
-<li><p>
- Large-system tuning
- (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
- problems on some platforms by setting a socket receive
- buffer size that was too large. This is now detected and
- corrected at run time. [RT #37187]
- </p></li>
-<li><p>
- When NXDOMAIN redirection is in use, queries for a name
- that is present in the redirection zone but a type that
- is not present will now return NOERROR instead of NXDOMAIN.
- </p></li>
-<li><p>
- Due to an inadvertent removal of code in the previous
- release, when <span><strong class="command">named</strong></span> encountered an
- authoritative name server which dropped all EDNS queries,
- it did not always try plain DNS. This has been corrected.
- [RT #37965]
- </p></li>
-<li><p>
- A regression caused nsupdate to use the default recursive servers
- rather than the SOA MNAME server when sending the UPDATE.
- </p></li>
-<li><p>
- Adjusted max-recursion-queries to accommodate the smaller
- initial packet sizes used in BIND 9.10 and higher when
- contacting authoritative servers for the first time.
- </p></li>
-<li><p>
- Built-in "empty" zones did not correctly inherit the
- "allow-transfer" ACL from the options or view. [RT #38310]
- </p></li>
-<li><p>
- Two leaks were fixed that could cause <span><strong class="command">named</strong></span>
- processes to grow to very large sizes. [RT #38454]
- </p></li>
-<li><p>
- Fixed some bugs in RFC 5011 trust anchor management,
- including a memory leak and a possible loss of state
- information. [RT #38458]
- </p></li>
-<li><p>
- Asynchronous zone loads were not handled correctly when the
- zone load was already in progress; this could trigger a crash
- in zt.c. [RT #37573]
- </p></li>
-<li><p>
- A race during shutdown or reconfiguration could
- cause an assertion failure in mem.c. [RT #38979]
- </p></li>
-<li><p>
- Some answer formatting options didn't work correctly with
- <span><strong class="command">dig +short</strong></span>. [RT #39291]
- </p></li>
-<li>
-<p>
- Several bugs have been fixed in the RPZ implementation:
- </p>
-<div class="itemizedlist"><ul type="circle">
-<li><p>
- Policy zones that did not specifically require recursion
- could be treated as if they did; consequently, setting
- <span><strong class="command">qname-wait-recurse no;</strong></span> was
- sometimes ineffective. This has been corrected.
- In most configurations, behavioral changes due to this
- fix will not be noticeable. [RT #39229]
- </p></li>
-<li><p>
- The server could crash if policy zones were updated (e.g.
- via <span><strong class="command">rndc reload</strong></span> or an incoming zone
- transfer) while RPZ processing was still ongoing for an
- active query. [RT #39415]
- </p></li>
-<li><p>
- On servers with one or more policy zones configured as
- slaves, if a policy zone updated during regular operation
- (rather than at startup) using a full zone reload, such as
- via AXFR, a bug could allow the RPZ summary data to fall out
- of sync, potentially leading to an assertion failure in
- rpz.c when further incremental updates were made to the
- zone, such as via IXFR. [RT #39567]
- </p></li>
-<li><p>
- The server could match a shorter prefix than what was
- available in CLIENT-IP policy triggers, and so, an
- unexpected action could be taken. This has been
- corrected. [RT #39481]
- </p></li>
-<li><p>
- The server could crash if a reload of an RPZ zone was
- initiated while another reload of the same zone was
- already in progress. [RT #39649]
- </p></li>
-</ul></div>
-</li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="end_of_life"></a>End of Life</h3></div></div></div>
-<p>
- The end of life for BIND 9.11 is yet to be determined but
- will not be before BIND 9.13.0 has been released for 6 months.
- <a href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
- </p>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
-<p>
- Thank you to everyone who assisted us in making this release possible.
- If you would like to contribute to ISC to assist us in continuing to
- make quality open source software, please visit our donations page at
- <a href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
- </p>
-</div>
-</div>
+<font color="red"><xi:include></xi:include></font>
</div>
<div class="navfooter">
<hr>
<dl>
<dt><span class="sect1"><a href="Bv9ARM.ch12.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
<dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2616167">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2616177">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613266">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613297">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2614670">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2614697">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2616284">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613210">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613220">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613244">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613821">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613898">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613925">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2614898">Library References</a></span></dt>
</dl></dd>
</dl>
</div>
</ul></div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2616167"></a>Prerequisite</h3></div></div></div>
+<a name="id2613210"></a>Prerequisite</h3></div></div></div>
<p>GNU make is required to build the export libraries (other
part of BIND 9 can still be built with other types of make). In
the reminder of this document, "make" means GNU make. Note that
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2616177"></a>Compilation</h3></div></div></div>
+<a name="id2613220"></a>Compilation</h3></div></div></div>
<pre class="screen">
$ <strong class="userinput"><code>./configure --enable-exportlib <em class="replaceable"><code>[other flags]</code></em></code></strong>
$ <strong class="userinput"><code>make</code></strong>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2613266"></a>Installation</h3></div></div></div>
+<a name="id2613244"></a>Installation</h3></div></div></div>
<pre class="screen">
$ <strong class="userinput"><code>cd lib/export</code></strong>
$ <strong class="userinput"><code>make install</code></strong>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2613297"></a>Known Defects/Restrictions</h3></div></div></div>
+<a name="id2613821"></a>Known Defects/Restrictions</h3></div></div></div>
<div class="itemizedlist"><ul type="disc">
<li><p>Currently, win32 is not supported for the export
library. (Normal BIND 9 application can be built as
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2614670"></a>The dns.conf File</h3></div></div></div>
+<a name="id2613898"></a>The dns.conf File</h3></div></div></div>
<p>The IRS library supports an "advanced" configuration file
related to the DNS library for configuration parameters that
would be beyond the capability of the
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2614697"></a>Sample Applications</h3></div></div></div>
+<a name="id2613925"></a>Sample Applications</h3></div></div></div>
<p>Some sample application programs using this API are
provided for reference. The following is a brief description of
these applications.
</p>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2614706"></a>sample: a simple stub resolver utility</h4></div></div></div>
+<a name="id2613933"></a>sample: a simple stub resolver utility</h4></div></div></div>
<p>
It sends a query of a given name (of a given optional RR type) to a
specified recursive server, and prints the result as a list of
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2614796"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
+<a name="id2614024"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
<p>
Similar to "sample", but accepts a list
of (query) domain names as a separate file and resolves the names
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2614850"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
+<a name="id2614077"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
<p>
It sends a query to a specified server, and
prints the response with minimal processing. It doesn't act as a
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2614982"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
+<a name="id2614141"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
<p>
This is a test program
to check getaddrinfo() and getnameinfo() behavior. It takes a
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2614997"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
+<a name="id2614156"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
<p>
It accepts a single update command as a
command-line argument, sends an update request message to the
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2616220"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
+<a name="id2614834"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
<p>
It checks a set
of domains to see the name servers of the domains behave
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2616284"></a>Library References</h3></div></div></div>
+<a name="id2614898"></a>Library References</h3></div></div></div>
<p>As of this writing, there is no formal "manual" of the
libraries, except this document, header files (some of them
provide pretty detailed explanations), and sample application
<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2608416">Where Can I Get Help?</a></span></dt>
</dl></dd>
<dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Release Notes</a></span></dt>
-<dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2573876">Release Notes for BIND Version 9.11.0pre-alpha</a></span></dt>
-<dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
-</dl></dd>
-</dl></dd>
<dt><span class="appendix"><a href="Bv9ARM.ch10.html">B. A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt>
<dd><dl><dt><span class="sect1"><a href="Bv9ARM.ch10.html#historical_dns_information"></a></span></dt></dl></dd>
<dt><span class="appendix"><a href="Bv9ARM.ch11.html">C. General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
<dd><dl>
<dt><span class="sect1"><a href="Bv9ARM.ch12.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
<dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2616167">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2616177">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613266">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613297">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2614670">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2614697">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2616284">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613210">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613220">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613244">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613821">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613898">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613925">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2614898">Library References</a></span></dt>
</dl></dd>
</dl></dd>
<dt><span class="reference"><a href="Bv9ARM.ch13.html">I. Manual pages</a></span></dt>
<div class="cmdsynopsis"><p><code class="command">arpaname</code> {<em class="replaceable"><code>ipaddress </code></em>...}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2625858"></a><h2>DESCRIPTION</h2>
+<a name="id2623037"></a><h2>DESCRIPTION</h2>
<p>
<span><strong class="command">arpaname</strong></span> translates IP addresses (IPv4 and
IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2625873"></a><h2>SEE ALSO</h2>
+<a name="id2623052"></a><h2>SEE ALSO</h2>
<p>
<em class="citetitle">BIND 9 Administrator Reference Manual</em>.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2670055"></a><h2>AUTHOR</h2>
+<a name="id2623066"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">ddns-confgen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em> | -z <em class="replaceable"><code>zone</code></em> ]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2665587"></a><h2>DESCRIPTION</h2>
+<a name="id2664610"></a><h2>DESCRIPTION</h2>
<p>
<span><strong class="command">tsig-keygen</strong></span> and <span><strong class="command">ddns-confgen</strong></span>
are invocation methods for a utility that generates keys for use
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2665690"></a><h2>OPTIONS</h2>
+<a name="id2665328"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2669934"></a><h2>SEE ALSO</h2>
+<a name="id2665544"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
<span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2669973"></a><h2>AUTHOR</h2>
+<a name="id2665582"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">delv</code> [queryopt...] [query...]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2618481"></a><h2>DESCRIPTION</h2>
+<a name="id2616957"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">delv</strong></span>
(Domain Entity Lookup & Validation) is a tool for sending
DNS queries and validating the results, using the same internal
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2618826"></a><h2>SIMPLE USAGE</h2>
+<a name="id2618190"></a><h2>SIMPLE USAGE</h2>
<p>
A typical invocation of <span><strong class="command">delv</strong></span> looks like:
</p>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2618957"></a><h2>OPTIONS</h2>
+<a name="id2618322"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
<dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2674803"></a><h2>QUERY OPTIONS</h2>
+<a name="id2673211"></a><h2>QUERY OPTIONS</h2>
<p><span><strong class="command">delv</strong></span>
provides a number of query options which affect the way results are
displayed, and in some cases the way lookups are performed.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2675401"></a><h2>FILES</h2>
+<a name="id2673741"></a><h2>FILES</h2>
<p><code class="filename">/etc/bind.keys</code></p>
<p><code class="filename">/etc/resolv.conf</code></p>
</div>
<div class="refsect1" lang="en">
-<a name="id2675420"></a><h2>SEE ALSO</h2>
+<a name="id2673761"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
<em class="citetitle">RFC4034</em>,
<div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2616689"></a><h2>DESCRIPTION</h2>
+<a name="id2615643"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dig</strong></span>
(domain information groper) is a flexible tool
for interrogating DNS name servers. It performs DNS lookups and
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2616791"></a><h2>SIMPLE USAGE</h2>
+<a name="id2615746"></a><h2>SIMPLE USAGE</h2>
<p>
A typical invocation of <span><strong class="command">dig</strong></span> looks like:
</p>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2616917"></a><h2>OPTIONS</h2>
+<a name="id2615872"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-4</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2668291"></a><h2>QUERY OPTIONS</h2>
+<a name="id2668269"></a><h2>QUERY OPTIONS</h2>
<p><span><strong class="command">dig</strong></span>
provides a number of query options which affect
the way in which lookups are made and the results displayed. Some of
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2669716"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2669694"></a><h2>MULTIPLE QUERIES</h2>
<p>
The BIND 9 implementation of <span><strong class="command">dig </strong></span>
supports
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2669869"></a><h2>IDN SUPPORT</h2>
+<a name="id2672101"></a><h2>IDN SUPPORT</h2>
<p>
If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
domain name) support, it can accept and display non-ASCII domain names.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2669898"></a><h2>FILES</h2>
+<a name="id2672130"></a><h2>FILES</h2>
<p><code class="filename">/etc/resolv.conf</code>
</p>
<p><code class="filename">${HOME}/.digrc</code>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2673674"></a><h2>SEE ALSO</h2>
+<a name="id2672151"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2673712"></a><h2>BUGS</h2>
+<a name="id2672188"></a><h2>BUGS</h2>
<p>
There are probably too many query options.
</p>
<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>] [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>] {zone}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2619980"></a><h2>DESCRIPTION</h2>
+<a name="id2619140"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-checkds</strong></span>
verifies the correctness of Delegation Signer (DS) or DNSSEC
Lookaside Validation (DLV) resource records for keys in a specified
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2619994"></a><h2>OPTIONS</h2>
+<a name="id2619154"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2620097"></a><h2>SEE ALSO</h2>
+<a name="id2619256"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2620131"></a><h2>AUTHOR</h2>
+<a name="id2619290"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2620274"></a><h2>DESCRIPTION</h2>
+<a name="id2619433"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-coverage</strong></span>
verifies that the DNSSEC keys for a given zone or a set of zones
have timing metadata set properly to ensure no future lapses in DNSSEC
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2620300"></a><h2>OPTIONS</h2>
+<a name="id2619596"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2620678"></a><h2>SEE ALSO</h2>
+<a name="id2619837"></a><h2>SEE ALSO</h2>
<p>
<span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2621131"></a><h2>AUTHOR</h2>
+<a name="id2619881"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2621627"></a><h2>DESCRIPTION</h2>
+<a name="id2620377"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-dsfromkey</strong></span>
outputs the Delegation Signer (DS) resource record (RR), as defined in
RFC 3658 and RFC 4509, for the given key(s).
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2621641"></a><h2>OPTIONS</h2>
+<a name="id2620391"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-1</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2622189"></a><h2>EXAMPLE</h2>
+<a name="id2620666"></a><h2>EXAMPLE</h2>
<p>
To build the SHA-256 DS RR from the
<strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2622226"></a><h2>FILES</h2>
+<a name="id2621931"></a><h2>FILES</h2>
<p>
The keyfile can be designed by the key identification
<code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2623291"></a><h2>CAVEAT</h2>
+<a name="id2621973"></a><h2>CAVEAT</h2>
<p>
A keyfile error can give a "file not found" even if the file exists.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2623301"></a><h2>SEE ALSO</h2>
+<a name="id2621982"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2623340"></a><h2>AUTHOR</h2>
+<a name="id2622022"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code> {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2622524"></a><h2>DESCRIPTION</h2>
+<a name="id2620933"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-importkey</strong></span>
reads a public DNSKEY record and generates a pair of
.key/.private files. The DNSKEY record may be read from an
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2622552"></a><h2>OPTIONS</h2>
+<a name="id2620961"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
<dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2622826"></a><h2>TIMING OPTIONS</h2>
+<a name="id2621098"></a><h2>TIMING OPTIONS</h2>
<p>
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2622873"></a><h2>FILES</h2>
+<a name="id2621145"></a><h2>FILES</h2>
<p>
A keyfile can be designed by the key identification
<code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2622899"></a><h2>SEE ALSO</h2>
+<a name="id2621239"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2622932"></a><h2>AUTHOR</h2>
+<a name="id2621272"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2623537"></a><h2>DESCRIPTION</h2>
+<a name="id2621672"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
generates a key pair of files that referencing a key object stored
in a cryptographic hardware service module (HSM). The private key
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2623562"></a><h2>OPTIONS</h2>
+<a name="id2621698"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
<dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2675640"></a><h2>TIMING OPTIONS</h2>
+<a name="id2674049"></a><h2>TIMING OPTIONS</h2>
<p>
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2675762"></a><h2>GENERATED KEY FILES</h2>
+<a name="id2674238"></a><h2>GENERATED KEY FILES</h2>
<p>
When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
successfully,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2675992"></a><h2>SEE ALSO</h2>
+<a name="id2674332"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2676029"></a><h2>AUTHOR</h2>
+<a name="id2674370"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2624792"></a><h2>DESCRIPTION</h2>
+<a name="id2622996"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-keygen</strong></span>
generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
and RFC 4034. It can also generate keys for use with
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2624812"></a><h2>OPTIONS</h2>
+<a name="id2623153"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
<dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2676492"></a><h2>TIMING OPTIONS</h2>
+<a name="id2674969"></a><h2>TIMING OPTIONS</h2>
<p>
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2676682"></a><h2>GENERATED KEYS</h2>
+<a name="id2675091"></a><h2>GENERATED KEYS</h2>
<p>
When <span><strong class="command">dnssec-keygen</strong></span> completes
successfully,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2676790"></a><h2>EXAMPLE</h2>
+<a name="id2675198"></a><h2>EXAMPLE</h2>
<p>
To generate a 768-bit DSA key for the domain
<strong class="userinput"><code>example.com</code></strong>, the following command would be
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2676846"></a><h2>SEE ALSO</h2>
+<a name="id2675392"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 2539</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2676877"></a><h2>AUTHOR</h2>
+<a name="id2675422"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code> [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2625382"></a><h2>DESCRIPTION</h2>
+<a name="id2623722"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-revoke</strong></span>
reads a DNSSEC key file, sets the REVOKED bit on the key as defined
in RFC 5011, and creates a new pair of key files containing the
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2625396"></a><h2>OPTIONS</h2>
+<a name="id2623736"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-h</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2625533"></a><h2>SEE ALSO</h2>
+<a name="id2623874"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 5011</em>.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2626992"></a><h2>AUTHOR</h2>
+<a name="id2623898"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2627588"></a><h2>DESCRIPTION</h2>
+<a name="id2631867"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-settime</strong></span>
reads a DNSSEC private key file and sets the key timing metadata
as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2627646"></a><h2>OPTIONS</h2>
+<a name="id2631926"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-f</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2638094"></a><h2>TIMING OPTIONS</h2>
+<a name="id2634387"></a><h2>TIMING OPTIONS</h2>
<p>
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2643421"></a><h2>PRINTING OPTIONS</h2>
+<a name="id2634525"></a><h2>PRINTING OPTIONS</h2>
<p>
<span><strong class="command">dnssec-settime</strong></span> can also be used to print the
timing metadata associated with a key.
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2645754"></a><h2>SEE ALSO</h2>
+<a name="id2643412"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2645787"></a><h2>AUTHOR</h2>
+<a name="id2643445"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-Q</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2646126"></a><h2>DESCRIPTION</h2>
+<a name="id2643921"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-signzone</strong></span>
signs a zone. It generates
NSEC and RRSIG records and produces a signed version of the
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2646146"></a><h2>OPTIONS</h2>
+<a name="id2643940"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-a</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2678342"></a><h2>EXAMPLE</h2>
+<a name="id2683577"></a><h2>EXAMPLE</h2>
<p>
The following command signs the <strong class="userinput"><code>example.com</code></strong>
zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
%</pre>
</div>
<div class="refsect1" lang="en">
-<a name="id2678421"></a><h2>SEE ALSO</h2>
+<a name="id2683656"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 4033</em>, <em class="citetitle">RFC 4641</em>.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2678449"></a><h2>AUTHOR</h2>
+<a name="id2683684"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code> [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2646628"></a><h2>DESCRIPTION</h2>
+<a name="id2644149"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">dnssec-verify</strong></span>
verifies that a zone is fully signed for each algorithm found
in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2646642"></a><h2>OPTIONS</h2>
+<a name="id2644163"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2646825"></a><h2>SEE ALSO</h2>
+<a name="id2644414"></a><h2>SEE ALSO</h2>
<p>
<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2646987"></a><h2>AUTHOR</h2>
+<a name="id2644440"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">genrandom</code> [<code class="option">-n <em class="replaceable"><code>number</code></em></code>] {<em class="replaceable"><code>size</code></em>} {<em class="replaceable"><code>filename</code></em>}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2626120"></a><h2>DESCRIPTION</h2>
+<a name="id2666035"></a><h2>DESCRIPTION</h2>
<p>
<span><strong class="command">genrandom</strong></span>
generates a file or a set of files containing a specified quantity
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2626135"></a><h2>ARGUMENTS</h2>
+<a name="id2666050"></a><h2>ARGUMENTS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-n <em class="replaceable"><code>number</code></em></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2670501"></a><h2>SEE ALSO</h2>
+<a name="id2666110"></a><h2>SEE ALSO</h2>
<p>
<span class="citerefentry"><span class="refentrytitle">rand</span>(3)</span>,
<span class="citerefentry"><span class="refentrytitle">arc4random</span>(3)</span>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2670528"></a><h2>AUTHOR</h2>
+<a name="id2666137"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">host</code> [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-v</code>] [<code class="option">-V</code>] {name} [server]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2617572"></a><h2>DESCRIPTION</h2>
+<a name="id2616185"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">host</strong></span>
is a simple utility for performing DNS lookups.
It is normally used to convert names to IP addresses and vice versa.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2618203"></a><h2>IDN SUPPORT</h2>
+<a name="id2616680"></a><h2>IDN SUPPORT</h2>
<p>
If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
domain name) support, it can accept and display non-ASCII domain names.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2619802"></a><h2>FILES</h2>
+<a name="id2616709"></a><h2>FILES</h2>
<p><code class="filename">/etc/resolv.conf</code>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2619816"></a><h2>SEE ALSO</h2>
+<a name="id2616723"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
</p>
<div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code> {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2626347"></a><h2>DESCRIPTION</h2>
+<a name="id2623527"></a><h2>DESCRIPTION</h2>
<p>
Versions of BIND 9 up to and including BIND 9.6 had a bug causing
HMAC-SHA* TSIG keys which were longer than the digest length of the
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2670680"></a><h2>SECURITY CONSIDERATIONS</h2>
+<a name="id2623555"></a><h2>SECURITY CONSIDERATIONS</h2>
<p>
Secrets that have been converted by <span><strong class="command">isc-hmac-fixup</strong></span>
are shortened, but as this is how the HMAC protocol works in
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2670696"></a><h2>SEE ALSO</h2>
+<a name="id2666374"></a><h2>SEE ALSO</h2>
<p>
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 2104</em>.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2670713"></a><h2>AUTHOR</h2>
+<a name="id2666391"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">named-checkconf</code> [<code class="option">-h</code>] [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-p</code>] [<code class="option">-x</code>] [<code class="option">-z</code>]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2647098"></a><h2>DESCRIPTION</h2>
+<a name="id2644756"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">named-checkconf</strong></span>
checks the syntax, but not the semantics, of a
<span><strong class="command">named</strong></span> configuration file. The file is parsed
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2647169"></a><h2>OPTIONS</h2>
+<a name="id2644826"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-h</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2647739"></a><h2>RETURN VALUES</h2>
+<a name="id2645056"></a><h2>RETURN VALUES</h2>
<p><span><strong class="command">named-checkconf</strong></span>
returns an exit status of 1 if
errors were detected and 0 otherwise.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2647753"></a><h2>SEE ALSO</h2>
+<a name="id2645069"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2647783"></a><h2>AUTHOR</h2>
+<a name="id2645099"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-J <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-l <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2687774"></a><h2>DESCRIPTION</h2>
+<a name="id2686320"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">named-checkzone</strong></span>
checks the syntax and integrity of a zone file. It performs the
same checks as <span><strong class="command">named</strong></span> does when loading a
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2687825"></a><h2>OPTIONS</h2>
+<a name="id2686370"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-d</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2688800"></a><h2>RETURN VALUES</h2>
+<a name="id2687413"></a><h2>RETURN VALUES</h2>
<p><span><strong class="command">named-checkzone</strong></span>
returns an exit status of 1 if
errors were detected and 0 otherwise.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2688813"></a><h2>SEE ALSO</h2>
+<a name="id2687427"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
<em class="citetitle">RFC 1035</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2688846"></a><h2>AUTHOR</h2>
+<a name="id2687460"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">named-journalprint</code> {<em class="replaceable"><code>journal</code></em>}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2621930"></a><h2>DESCRIPTION</h2>
+<a name="id2618086"></a><h2>DESCRIPTION</h2>
<p>
<span><strong class="command">named-journalprint</strong></span>
prints the contents of a zone journal file in a human-readable
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2621976"></a><h2>SEE ALSO</h2>
+<a name="id2653426"></a><h2>SEE ALSO</h2>
<p>
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">nsupdate</span>(8)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2657233"></a><h2>AUTHOR</h2>
+<a name="id2653457"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">named-rrchecker</code> [<code class="option">-h</code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-p</code>] [<code class="option">-u</code>] [<code class="option">-C</code>] [<code class="option">-T</code>] [<code class="option">-P</code>]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2657296"></a><h2>DESCRIPTION</h2>
+<a name="id2618430"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">named-rrchecker</strong></span>
read a individual DNS resource record from standard input and checks if it
is syntactically correct.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2657352"></a><h2>SEE ALSO</h2>
+<a name="id2653576"></a><h2>SEE ALSO</h2>
<p>
<em class="citetitle">RFC 1034</em>,
<em class="citetitle">RFC 1035</em>,
<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-D <em class="replaceable"><code>string</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-L <em class="replaceable"><code>logfile</code></em></code>] [<code class="option">-M <em class="replaceable"><code>option</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>lock-file</code></em></code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2656645"></a><h2>DESCRIPTION</h2>
+<a name="id2646930"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">named</strong></span>
is a Domain Name System (DNS) server,
part of the BIND 9 distribution from ISC. For more
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2656676"></a><h2>OPTIONS</h2>
+<a name="id2646961"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-4</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2689392"></a><h2>SIGNALS</h2>
+<a name="id2687868"></a><h2>SIGNALS</h2>
<p>
In routine operation, signals should not be used to control
the nameserver; <span><strong class="command">rndc</strong></span> should be used
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2689442"></a><h2>CONFIGURATION</h2>
+<a name="id2687918"></a><h2>CONFIGURATION</h2>
<p>
The <span><strong class="command">named</strong></span> configuration file is too complex
to describe in detail here. A complete description is provided
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2689491"></a><h2>FILES</h2>
+<a name="id2687968"></a><h2>FILES</h2>
<div class="variablelist"><dl>
<dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2689534"></a><h2>SEE ALSO</h2>
+<a name="id2688011"></a><h2>SEE ALSO</h2>
<p><em class="citetitle">RFC 1033</em>,
<em class="citetitle">RFC 1034</em>,
<em class="citetitle">RFC 1035</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2689605"></a><h2>AUTHOR</h2>
+<a name="id2688150"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">nsec3hash</code> {<em class="replaceable"><code>salt</code></em>} {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>iterations</code></em>} {<em class="replaceable"><code>domain</code></em>}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2671031"></a><h2>DESCRIPTION</h2>
+<a name="id2666436"></a><h2>DESCRIPTION</h2>
<p>
<span><strong class="command">nsec3hash</strong></span> generates an NSEC3 hash based on
a set of NSEC3 parameters. This can be used to check the validity
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2671046"></a><h2>ARGUMENTS</h2>
+<a name="id2666451"></a><h2>ARGUMENTS</h2>
<div class="variablelist"><dl>
<dt><span class="term">salt</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2671108"></a><h2>SEE ALSO</h2>
+<a name="id2666513"></a><h2>SEE ALSO</h2>
<p>
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 5155</em>.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2671125"></a><h2>AUTHOR</h2>
+<a name="id2666530"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [<code class="option">-L <em class="replaceable"><code>level</code></em></code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-l</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2657872"></a><h2>DESCRIPTION</h2>
+<a name="id2654437"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">nsupdate</strong></span>
is used to submit Dynamic DNS Update requests as defined in RFC 2136
to a name server.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2657960"></a><h2>OPTIONS</h2>
+<a name="id2654662"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-d</span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2689805"></a><h2>INPUT FORMAT</h2>
+<a name="id2691081"></a><h2>INPUT FORMAT</h2>
<p><span><strong class="command">nsupdate</strong></span>
reads input from
<em class="parameter"><code>filename</code></em>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2690947"></a><h2>EXAMPLES</h2>
+<a name="id2692222"></a><h2>EXAMPLES</h2>
<p>
The examples below show how
<span><strong class="command">nsupdate</strong></span>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2690997"></a><h2>FILES</h2>
+<a name="id2692341"></a><h2>FILES</h2>
<div class="variablelist"><dl>
<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2691083"></a><h2>SEE ALSO</h2>
+<a name="id2692427"></a><h2>SEE ALSO</h2>
<p>
<em class="citetitle">RFC 2136</em>,
<em class="citetitle">RFC 3007</em>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2691209"></a><h2>BUGS</h2>
+<a name="id2692485"></a><h2>BUGS</h2>
<p>
The TSIG key is redundantly stored in two separate files.
This is a consequence of nsupdate using the DST library
<div class="cmdsynopsis"><p><code class="command">rndc-confgen</code> [<code class="option">-a</code>] [<code class="option">-A <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2664611"></a><h2>DESCRIPTION</h2>
+<a name="id2662883"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">rndc-confgen</strong></span>
generates configuration files
for <span><strong class="command">rndc</strong></span>. It can be used as a
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2664677"></a><h2>OPTIONS</h2>
+<a name="id2662949"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-a</span></dt>
<dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2670337"></a><h2>EXAMPLES</h2>
+<a name="id2663762"></a><h2>EXAMPLES</h2>
<p>
To allow <span><strong class="command">rndc</strong></span> to be used with
no manual configuration, run
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2670393"></a><h2>SEE ALSO</h2>
+<a name="id2665934"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2670432"></a><h2>AUTHOR</h2>
+<a name="id2665973"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2624957"></a><h2>DESCRIPTION</h2>
+<a name="id2659889"></a><h2>DESCRIPTION</h2>
<p><code class="filename">rndc.conf</code> is the configuration file
for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
utility. This file has a similar structure and syntax to
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2663836"></a><h2>EXAMPLE</h2>
+<a name="id2661562"></a><h2>EXAMPLE</h2>
<pre class="programlisting">
options {
default-server localhost;
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2664026"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2661684"></a><h2>NAME SERVER CONFIGURATION</h2>
<p>
The name server must be configured to accept rndc connections and
to recognize the key specified in the <code class="filename">rndc.conf</code>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2664052"></a><h2>SEE ALSO</h2>
+<a name="id2661709"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2664090"></a><h2>AUTHOR</h2>
+<a name="id2662704"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2662830"></a><h2>DESCRIPTION</h2>
+<a name="id2658645"></a><h2>DESCRIPTION</h2>
<p><span><strong class="command">rndc</strong></span>
controls the operation of a name
server. It supersedes the <span><strong class="command">ndc</strong></span> utility
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2662949"></a><h2>OPTIONS</h2>
+<a name="id2658695"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl>
<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
<dd><p>
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2663202"></a><h2>COMMANDS</h2>
+<a name="id2660518"></a><h2>COMMANDS</h2>
<p>
A list of commands supported by <span><strong class="command">rndc</strong></span> can
be seen by running <span><strong class="command">rndc</strong></span> without arguments.
</dl></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2693122"></a><h2>LIMITATIONS</h2>
+<a name="id2694466"></a><h2>LIMITATIONS</h2>
<p>
There is currently no way to provide the shared secret for a
<code class="option">key_id</code> without using the configuration file.
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2693140"></a><h2>SEE ALSO</h2>
+<a name="id2694484"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
<span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2693195"></a><h2>AUTHOR</h2>
+<a name="id2694539"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
<title></title>
<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><div class="sect1" lang="en">
-<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2542126"></a>Release Notes for BIND Version 9.11.0pre-alpha</h2></div></div></div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
-<p>
- This document summarizes changes since the last production release
- of BIND on the corresponding major release branch.
- </p>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_download"></a>Download</h3></div></div></div>
-<p>
- The latest versions of BIND 9 software can always be found at
- <a href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
- There you will find additional information about each release,
- source code, and pre-compiled versions for Microsoft Windows
- operating systems.
- </p>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li>
-<p>
- A specially crafted query could trigger an assertion failure
- in message.c
- </p>
-<p>
- This flaw was discovered by Jonathan Foote, and is disclosed
- in CVE-2015-5477. [RT #39795]
- </p>
-</li>
-<li>
-<p>
- On servers configured to perform DNSSEC validation, an
- assertion failure could be triggered on answers from
- a specially configured server.
- </p>
-<p>
- This flaw was discovered by Breno Silveira Soares, and is
- disclosed in CVE-2015-4620. [RT #39795]
- </p>
-</li>
-<li>
-<p>
- On servers configured to perform DNSSEC validation using
- managed trust anchors (i.e., keys configured explicitly
- via <span><strong class="command">managed-keys</strong></span>, or implicitly
- via <span><strong class="command">dnssec-validation auto;</strong></span> or
- <span><strong class="command">dnssec-lookaside auto;</strong></span>), revoking
- a trust anchor and sending a new untrusted replacement
- could cause <span><strong class="command">named</strong></span> to crash with an
- assertion failure. This could occur in the event of a
- botched key rollover, or potentially as a result of a
- deliberate attack if the attacker was in position to
- monitor the victim's DNS traffic.
- </p>
-<p>
- This flaw was discovered by Jan-Piet Mens, and is
- disclosed in CVE-2015-1349. [RT #38344]
- </p>
-</li>
-<li>
-<p>
- A flaw in delegation handling could be exploited to put
- <span><strong class="command">named</strong></span> into an infinite loop, in which
- each lookup of a name server triggered additional lookups
- of more name servers. This has been addressed by placing
- limits on the number of levels of recursion
- <span><strong class="command">named</strong></span> will allow (default 7), and
- on the number of queries that it will send before
- terminating a recursive query (default 50).
- </p>
-<p>
- The recursion depth limit is configured via the
- <code class="option">max-recursion-depth</code> option, and the query limit
- via the <code class="option">max-recursion-queries</code> option.
- </p>
-<p>
- The flaw was discovered by Florian Maury of ANSSI, and is
- disclosed in CVE-2014-8500. [RT #37580]
- </p>
-</li>
-<li>
-<p>
- Two separate problems were identified in BIND's GeoIP code that
- could lead to an assertion failure. One was triggered by use of
- both IPv4 and IPv6 address families, the other by referencing
- a GeoIP database in <code class="filename">named.conf</code> which was
- not installed. Both are covered by CVE-2014-8680. [RT #37672]
- [RT #37679]
- </p>
-<p>
- A less serious security flaw was also found in GeoIP: changes
- to the <span><strong class="command">geoip-directory</strong></span> option in
- <code class="filename">named.conf</code> were ignored when running
- <span><strong class="command">rndc reconfig</strong></span>. In theory, this could allow
- <span><strong class="command">named</strong></span> to allow access to unintended clients.
- </p>
-</li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_features"></a>New Features</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li>
-<p>
- New quotas have been added to limit the queries that are
- sent by recursive resolvers to authoritative servers
- experiencing denial-of-service attacks. When configured,
- these options can both reduce the harm done to authoritative
- servers and also avoid the resource exhaustion that can be
- experienced by recursives when they are being used as a
- vehicle for such an attack.
- </p>
-<div class="itemizedlist"><ul type="circle">
-<li><p>
- <code class="option">fetches-per-server</code> limits the number of
- simultaneous queries that can be sent to any single
- authoritative server. The configured value is a starting
- point; it is automatically adjusted downward if the server is
- partially or completely non-responsive. The algorithm used to
- adjust the quota can be configured via the
- <code class="option">fetch-quota-params</code> option.
- </p></li>
-<li><p>
- <code class="option">fetches-per-zone</code> limits the number of
- simultaneous queries that can be sent for names within a
- single domain. (Note: Unlike "fetches-per-server", this
- value is not self-tuning.)
- </p></li>
-</ul></div>
-<p>
- Statistics counters have also been added to track the number
- of queries affected by these quotas.
- </p>
-</li>
-<li><p>
- New statistics counters have been added to track traffic
- sizes, as specified in RSSAC002. Query and response
- message sizes are broken up into ranges of histogram buckets:
- TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
- and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
- and 4096+. These values can be accessed via the XML and JSON
- statistics channels at, for example,
- <a href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
- or
- <a href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
- </p></li>
-<li><p>
- The serial number of a dynamically updatable zone can
- now be set using
- <span><strong class="command">rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
- This is particularly useful with <code class="option">inline-signing</code>
- zones that have been reset. Setting the serial number to a value
- larger than that on the slaves will trigger an AXFR-style
- transfer.
- </p></li>
-<li><p>
- When answering recursive queries, SERVFAIL responses can now be
- cached by the server for a limited time; subsequent queries for
- the same query name and type will return another SERVFAIL until
- the cache times out. This reduces the frequency of retries
- when a query is persistently failing, which can be a burden
- on recursive serviers. The SERVFAIL cache timeout is controlled
- by <code class="option">servfail-ttl</code>, which defaults to 10 seconds
- and has an upper limit of 30.
- </p></li>
-<li><p>
- The new <span><strong class="command">rndc nta</strong></span> command can now be used to
- set a "negative trust anchor" (NTA), disabling DNSSEC validation for
- a specific domain; this can be used when responses from a domain
- are known to be failing validation due to administrative error
- rather than because of a spoofing attack. NTAs are strictly
- temporary; by default they expire after one hour, but can be
- configured to last up to one week. The default NTA lifetime
- can be changed by setting the <code class="option">nta-lifetime</code> in
- <code class="filename">named.conf</code>. When added, NTAs are stored in a
- file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
- in order to persist across restarts of the <span><strong class="command">named</strong></span> server.
- </p></li>
-<li><p>
- The EDNS Client Subnet (ECS) option is now supported for
- authoritative servers; if a query contains an ECS option then
- ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
- elements can match against the the address encoded in the option.
- This can be used to select a view for a query, so that different
- answers can be provided depending on the client network.
- </p></li>
-<li><p>
- The EDNS EXPIRE option has been implemented on the client
- side, allowing a slave server to set the expiration timer
- correctly when transferring zone data from another slave
- server.
- </p></li>
-<li><p>
- A new <code class="option">masterfile-style</code> zone option controls
- the formatting of text zone files: When set to
- <code class="literal">full</code>, the zone file will dumped in
- single-line-per-record format.
- </p></li>
-<li><p>
- <span><strong class="command">dig +ednsopt</strong></span> can now be used to set
- arbitrary EDNS options in DNS requests.
- </p></li>
-<li><p>
- <span><strong class="command">dig +ednsflags</strong></span> can now be used to set
- yet-to-be-defined EDNS flags in DNS requests.
- </p></li>
-<li><p>
- <span><strong class="command">dig +[no]ednsnegotiation</strong></span> can now be used enable /
- disable EDNS version negotiation.
- </p></li>
-<li><p>
- <span><strong class="command">dig +header-only</strong></span> can now be used to send
- queries without a question section.
- </p></li>
-<li><p>
- <span><strong class="command">dig +ttlunits</strong></span> causes <span><strong class="command">dig</strong></span>
- to print TTL values with time-unit suffixes: w, d, h, m, s for
- weeks, days, hours, minutes, and seconds.
- </p></li>
-<li><p>
- <span><strong class="command">dig +zflag</strong></span> can be used to set the last
- unassigned DNS header flag bit. This bit in normally zero.
- </p></li>
-<li><p>
- <span><strong class="command">dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
- can now be used to set the DSCP code point in outgoing query
- packets.
- </p></li>
-<li><p>
- <code class="option">serial-update-method</code> can now be set to
- <code class="literal">date</code>. On update, the serial number will
- be set to the current date in YYYYMMDDNN format.
- </p></li>
-<li><p>
- <span><strong class="command">dnssec-signzone -N date</strong></span> also sets the serial
- number to YYYYMMDDNN.
- </p></li>
-<li><p>
- <span><strong class="command">named -L <em class="replaceable"><code>filename</code></em></strong></span>
- causes <span><strong class="command">named</strong></span> to send log messages to the specified file by
- default instead of to the system log.
- </p></li>
-<li><p>
- The rate limiter configured by the
- <code class="option">serial-query-rate</code> option no longer covers
- NOTIFY messages; those are now separately controlled by
- <code class="option">notify-rate</code> and
- <code class="option">startup-notify-rate</code> (the latter of which
- controls the rate of NOTIFY messages sent when the server
- is first started up or reconfigured).
- </p></li>
-<li><p>
- The default number of tasks and client objects available
- for serving lightweight resolver queries have been increased,
- and are now configurable via the new <code class="option">lwres-tasks</code>
- and <code class="option">lwres-clients</code> options in
- <code class="filename">named.conf</code>. [RT #35857]
- </p></li>
-<li><p>
- Log output to files can now be buffered by specifying
- <span><strong class="command">buffered yes;</strong></span> when creating a channel.
- </p></li>
-<li><p>
- <span><strong class="command">delv +tcp</strong></span> will exclusively use TCP when
- sending queries.
- </p></li>
-<li><p>
- <span><strong class="command">named</strong></span> will now check to see whether
- other name server processes are running before starting up.
- This is implemented in two ways: 1) by refusing to start
- if the configured network interfaces all return "address
- in use", and 2) by attempting to acquire a lock on a file
- specified by the <code class="option">lock-file</code> option or
- the <span><strong class="command">-X</strong></span> command line option. The
- default lock file is
- <code class="filename">/var/run/named/named.lock</code>.
- Specifying <code class="literal">none</code> will disable the lock
- file check.
- </p></li>
-<li><p>
- <span><strong class="command">rndc delzone</strong></span> can now be applied to zones
- which were configured in <code class="filename">named.conf</code>;
- it is no longer restricted to zones which were added by
- <span><strong class="command">rndc addzone</strong></span>. (Note, however, that
- this does not edit <code class="filename">named.conf</code>; the zone
- must be removed from the configuration or it will return
- when <span><strong class="command">named</strong></span> is restarted or reloaded.)
- </p></li>
-<li><p>
- <span><strong class="command">rndc modzone</strong></span> can be used to reconfigure
- a zone, using similar syntax to <span><strong class="command">rndc addzone</strong></span>.
- </p></li>
-<li><p>
- <span><strong class="command">rndc showzone</strong></span> displays the current
- configuration for a specified zone.
- </p></li>
-<li>
-<p>
- Added server-side support for pipelined TCP queries. Clients
- may continue sending queries via TCP while previous queries are
- processed in parallel. Responses are sent when they are
- ready, not necessarily in the order in which the queries were
- received.
- </p>
-<p>
- To revert to the former behavior for a particular
- client address or range of addresses, specify the address prefix
- in the "keep-response-order" option. To revert to the former
- behavior for all clients, use "keep-response-order { any; };".
- </p>
-</li>
-<li><p>
- The new <span><strong class="command">mdig</strong></span> command is a version of
- <span><strong class="command">dig</strong></span> that sends multiple pipelined
- queries and then waits for responses, instead of sending one
- query and waiting the response before sending the next. [RT #38261]
- </p></li>
-<li><p>
- To enable better monitoring and troubleshooting of RFC 5011
- trust anchor management, the new <span><strong class="command">rndc managed-keys</strong></span>
- can be used to check status of trust anchors or to force keys
- to be refreshed. Also, the managed-keys data file now has
- easier-to-read comments. [RT #38458]
- </p></li>
-<li><p>
- An <span><strong class="command">--enable-querytrace</strong></span> configure switch is
- now available to enable very verbose query tracelogging. This
- option can only be set at compile time. This option has a
- negative performance impact and should be used only for
- debugging. [RT #37520]
- </p></li>
-<li><p>
- A new <span><strong class="command">tcp-only</strong></span> option can be specified
- in <span><strong class="command">server</strong></span> statements to force
- <span><strong class="command">named</strong></span> to connect to the specified
- server via TCP. [RT #37800]
- </p></li>
-<li><p>
- The <span><strong class="command">nxdomain-redirect</strong></span> option specifies
- a DNS namespace to use for NXDOMAIN redirection. When a
- recursive lookup returns NXDOMAIN, a second lookup is
- initiated with the specified name appended to the query
- name. This allows NXDOMAIN redirection data to be supplied
- by multiple zones configured on the server or by recursive
- queries to other servers. (The older method, using
- a single <span><strong class="command">type redirect</strong></span> zone, has
- better average performance but is less flexible.) [RT #37989]
- </p></li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
- ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
- not correctly matched unless the full organization name was
- specified in the ACL (as in
- <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
- They can now match against the AS number alone (as in
- <span><strong class="command">geoip asnum "AS1234";</strong></span>).
- </p></li>
-<li><p>
- When using native PKCS#11 cryptography (i.e.,
- <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
- of up to 256 characters can now be used.
- </p></li>
-<li><p>
- NXDOMAIN responses to queries of type DS are now cached separately
- from those for other types. This helps when using "grafted" zones
- of type forward, for which the parent zone does not contain a
- delegation, such as local top-level domains. Previously a query
- of type DS for such a zone could cause the zone apex to be cached
- as NXDOMAIN, blocking all subsequent queries. (Note: This
- change is only helpful when DNSSEC validation is not enabled.
- "Grafted" zones without a delegation in the parent are not a
- recommended configuration.)
- </p></li>
-<li><p>
- Update forwarding performance has been improved by allowing
- a single TCP connection to be shared between multiple updates.
- </p></li>
-<li><p>
- By default, <span><strong class="command">nsupdate</strong></span> will now check
- the correctness of hostnames when adding records of type
- A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be
- disabled with <span><strong class="command">check-names no</strong></span>.
- </p></li>
-<li><p>
- Added support for OPENPGPKEY type.
- </p></li>
-<li><p>
- The names of the files used to store managed keys and added
- zones for each view are no longer based on the SHA256 hash
- of the view name, except when this is necessary because the
- view name contains characters that would be incompatible with use
- as a file name. For views whose names do not contain forward
- slashes ('/'), backslashes ('\'), or capital letters - which
- could potentially cause namespace collision problems on
- case-insensitive filesystems - files will now be named
- after the view (for example, <code class="filename">internal.mkeys</code>
- or <code class="filename">external.nzf</code>). However, to ensure
- consistent behavior when upgrading, if a file using the old
- name format is found to exist, it will continue to be used.
- </p></li>
-<li><p>
- "rndc" can now return text output of arbitrary size to
- the caller. (Prior to this, certain commands such as
- "rndc tsig-list" and "rndc zonestatus" could return
- truncated output.)
- </p></li>
-<li><p>
- Errors reported when running <span><strong class="command">rndc addzone</strong></span>
- (e.g., when a zone file cannot be loaded) have been clarified
- to make it easier to diagnose problems.
- </p></li>
-<li><p>
- When encountering an authoritative name server whose name is
- an alias pointing to another name, the resolver treats
- this as an error and skips to the next server. Previously
- this happened silently; now the error will be logged to
- the newly-created "cname" log category.
- </p></li>
-<li><p>
- If <span><strong class="command">named</strong></span> is not configured to validate the answer then
- allow fallback to plain DNS on timeout even when we know
- the server supports EDNS. This will allow the server to
- potentially resolve signed queries when TCP is being
- blocked.
- </p></li>
-<li><p>
- Large inline-signing changes should be less disruptive.
- Signature generation is now done incrementally; the number
- of signatures to be generated in each quantum is controlled
- by "sig-signing-signatures <em class="replaceable"><code>number</code></em>;".
- [RT #37927]
- </p></li>
-<li>
-<p>
- The experimental SIT option (code point 65001) of BIND
- 9.10.0 through BIND 9.10.2 has be replace the COOKIE
- option (code point 10) and is no longer experimental and
- is sent by default.
- </p>
-<p>
- The SIT related named.conf options have been marked as
- obsolete and are otherwise ignored.
- </p>
-</li>
-<li><p>
- When retrying a query via TCP due to the first answer
- being truncated, <span><strong class="command">dig</strong></span> will now correctly
- send the Server COOKIE returned by the server in the prior
- response. [RT #39047]
- </p></li>
-<li><p>
- A alternative NXDOMAIN redirect method (nxdomain-redirect)
- which allows the redirect information to be looked up from
- a namespace on the Internet rather than requiring a zone
- to be configured on the server is now available.
- </p></li>
-<li><p>
- Retrieving the local port range from net.ipv4.ip_local_port_range
- on Linux is now supported.
- </p></li>
-<li><p>
- Within the <code class="option">response-policy</code> option, it is now
- possible to configure RPZ rewrite logging on a per-zone basis
- using the <code class="option">log</code> clause.
- </p></li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
- <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
- <span><strong class="command">nslookup</strong></span> aborted when encountering
- a name which, after appending search list elements,
- exceeded 255 bytes. Such names are now skipped, but
- processing of other names will continue. [RT #36892]
- </p></li>
-<li><p>
- The error message generated when
- <span><strong class="command">named-checkzone</strong></span> or
- <span><strong class="command">named-checkconf -z</strong></span> encounters a
- <code class="option">$TTL</code> directive without a value has
- been clarified. [RT #37138]
- </p></li>
-<li><p>
- Semicolon characters (;) included in TXT records were
- incorrectly escaped with a backslash when the record was
- displayed as text. This is actually only necessary when there
- are no quotation marks. [RT #37159]
- </p></li>
-<li><p>
- When files opened for writing by <span><strong class="command">named</strong></span>,
- such as zone journal files, were referenced more than once
- in <code class="filename">named.conf</code>, it could lead to file
- corruption as multiple threads wrote to the same file. This
- is now detected when loading <code class="filename">named.conf</code>
- and reported as an error. [RT #37172]
- </p></li>
-<li><p>
- When checking for updates to trust anchors listed in
- <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
- now revalidates keys based on the current set of
- active trust anchors, without relying on any cached
- record of previous validation. [RT #37506]
- </p></li>
-<li><p>
- Large-system tuning
- (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
- problems on some platforms by setting a socket receive
- buffer size that was too large. This is now detected and
- corrected at run time. [RT #37187]
- </p></li>
-<li><p>
- When NXDOMAIN redirection is in use, queries for a name
- that is present in the redirection zone but a type that
- is not present will now return NOERROR instead of NXDOMAIN.
- </p></li>
-<li><p>
- Due to an inadvertent removal of code in the previous
- release, when <span><strong class="command">named</strong></span> encountered an
- authoritative name server which dropped all EDNS queries,
- it did not always try plain DNS. This has been corrected.
- [RT #37965]
- </p></li>
-<li><p>
- A regression caused nsupdate to use the default recursive servers
- rather than the SOA MNAME server when sending the UPDATE.
- </p></li>
-<li><p>
- Adjusted max-recursion-queries to accommodate the smaller
- initial packet sizes used in BIND 9.10 and higher when
- contacting authoritative servers for the first time.
- </p></li>
-<li><p>
- Built-in "empty" zones did not correctly inherit the
- "allow-transfer" ACL from the options or view. [RT #38310]
- </p></li>
-<li><p>
- Two leaks were fixed that could cause <span><strong class="command">named</strong></span>
- processes to grow to very large sizes. [RT #38454]
- </p></li>
-<li><p>
- Fixed some bugs in RFC 5011 trust anchor management,
- including a memory leak and a possible loss of state
- information. [RT #38458]
- </p></li>
-<li><p>
- Asynchronous zone loads were not handled correctly when the
- zone load was already in progress; this could trigger a crash
- in zt.c. [RT #37573]
- </p></li>
-<li><p>
- A race during shutdown or reconfiguration could
- cause an assertion failure in mem.c. [RT #38979]
- </p></li>
-<li><p>
- Some answer formatting options didn't work correctly with
- <span><strong class="command">dig +short</strong></span>. [RT #39291]
- </p></li>
-<li>
-<p>
- Several bugs have been fixed in the RPZ implementation:
- </p>
-<div class="itemizedlist"><ul type="circle">
-<li><p>
- Policy zones that did not specifically require recursion
- could be treated as if they did; consequently, setting
- <span><strong class="command">qname-wait-recurse no;</strong></span> was
- sometimes ineffective. This has been corrected.
- In most configurations, behavioral changes due to this
- fix will not be noticeable. [RT #39229]
- </p></li>
-<li><p>
- The server could crash if policy zones were updated (e.g.
- via <span><strong class="command">rndc reload</strong></span> or an incoming zone
- transfer) while RPZ processing was still ongoing for an
- active query. [RT #39415]
- </p></li>
-<li><p>
- On servers with one or more policy zones configured as
- slaves, if a policy zone updated during regular operation
- (rather than at startup) using a full zone reload, such as
- via AXFR, a bug could allow the RPZ summary data to fall out
- of sync, potentially leading to an assertion failure in
- rpz.c when further incremental updates were made to the
- zone, such as via IXFR. [RT #39567]
- </p></li>
-<li><p>
- The server could match a shorter prefix than what was
- available in CLIENT-IP policy triggers, and so, an
- unexpected action could be taken. This has been
- corrected. [RT #39481]
- </p></li>
-<li><p>
- The server could crash if a reload of an RPZ zone was
- initiated while another reload of the same zone was
- already in progress. [RT #39649]
- </p></li>
-</ul></div>
-</li>
-</ul></div>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="end_of_life"></a>End of Life</h3></div></div></div>
-<p>
- The end of life for BIND 9.11 is yet to be determined but
- will not be before BIND 9.13.0 has been released for 6 months.
- <a href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
- </p>
-</div>
-<div class="sect2" lang="en">
-<div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
-<p>
- Thank you to everyone who assisted us in making this release possible.
- If you would like to contribute to ISC to assist us in continuing to
- make quality open source software, please visit our donations page at
- <a href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
- </p>
-</div>
-</div></div></body>
+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><font color="red"><xi:include></xi:include></font></div></body>
</html>
projects / thirdparty / bind9.git / commitdiff
