New Features
~~~~~~~~~~~~
-- BIND now depends on ``liburcu``, Userspace RCU, for lock-free data
+- BIND now depends on `liburcu`_, Userspace RCU, for lock-free data
structures. :gl:`#3934`
-- The new ``delv +ns`` option activates name server mode, in which ``delv``
- sets up an internal recursive resolver and uses that, rather than an
- external server, to look up the requested query name and type. All messages
- sent and received during the resolution and validation process are logged.
- This can be used in place of ``dig +trace``: it more accurately
- reproduces the behavior of ``named`` when resolving a query.
+- The new command-line :option:`delv +ns` option activates name server
+ mode, to more accurately reproduce the behavior of :iscman:`named`
+ when resolving a query. In this mode, :iscman:`delv` uses an internal
+ recursive resolver rather than an external server. All messages sent
+ and received during the resolution and validation process are logged.
+ This can be used in place of :option:`dig +trace`. :gl:`#3842`
- The log message ``resolver priming query complete`` was moved from the
- INFO log level to the DEBUG(1) log level, to prevent ``delv`` from
- emitting that message when setting up its internal resolver. :gl:`#3842`
+- The log message ``resolver priming query complete`` has been moved
+ from the INFO log level to the DEBUG(1) log level, to prevent
+ :iscman:`delv` from emitting that message when setting up its internal
+ resolver. :gl:`#3842`
-- A new configuration option :any:`checkds` is introduced that when set to
- ``yes`` will detect :any:`parental-agents` automatically by resolving the
- parent NS records. These name servers will be used to check the DS RRset
- during a KSK rollover initiated by :any:`dnssec-policy`. :gl:`#3901`
+- A new configuration option, :any:`checkds`, has been introduced. When
+ set to ``yes``, it detects :any:`parental-agents` automatically by
+ resolving the parent NS records. These name servers are queried to
+ check the DS RRset during a KSK rollover initiated by
+ :any:`dnssec-policy`. :gl:`#3901`
+
+.. _`liburcu`: https://liburcu.org/
Removed Features
~~~~~~~~~~~~~~~~
-- The TKEY Mode 2 (Diffie-Hellman Exchanged Keying Mode) has been removed and
- using TKEY Mode 2 is now a fatal error. Users are advised to switch to TKEY
- Mode 3 (GSS-API). :gl:`#3905`
+- The TKEY Mode 2 (Diffie-Hellman Exchanged Keying Mode) has been
+ removed and using TKEY Mode 2 is now a fatal error. Users are advised
+ to switch to TKEY Mode 3 (GSS-API). :gl:`#3905`
- Zone type ``delegation-only``, and the ``delegation-only`` and
- ``root-delegation-only`` options, have been removed. Using them
- is a configuration error.
+ ``root-delegation-only`` statements, have been removed. Using them is
+ a configuration error.
- These options were created to address the SiteFinder controversy, in
- which certain top-level domains redirected misspelled queries to other
- sites instead of returning NXDOMAIN responses. Since top-level domains are
- now DNSSEC signed, and DNSSEC validation is active by default, the
- options are no longer needed. :gl:`#3953`
+ These statements were created to address the SiteFinder controversy,
+ in which certain top-level domains redirected misspelled queries to
+ other sites instead of returning NXDOMAIN responses. Since top-level
+ domains are now DNSSEC-signed, and DNSSEC validation is active by
+ default, the statements are no longer needed. :gl:`#3953`
Feature Changes
~~~~~~~~~~~~~~~
Bug Fixes
~~~~~~~~~
-- Performance of DNSSEC validation in zones with many DNSKEY records
- has been improved. :gl:`#3981`
+- Performance of DNSSEC validation in zones with many DNSKEY records has
+ been improved. :gl:`#3981`
Known Issues
~~~~~~~~~~~~