Release Notes

Duplicate EDNS COOKIE options in a response could trigger an assertion failure. This flaw is disclosed in CVE-2016-2088. [RT #41809]

The resolver could abort with an assertion failure due to improper DNAME handling when parsing fetch reply messages. This flaw is disclosed in CVE-2016-1286. [RT #41753]

Malformed control messages can trigger assertions in named and rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]

Certain errors that could be encountered when printing out or logging an OPT record containing a CLIENT-SUBNET option could be mishandled, resulting in an assertion failure. This flaw is disclosed in CVE-2015-8705. [RT #41397]

Specific APL data could trigger an INSIST. This flaw is disclosed in CVE-2015-8704. [RT #41396]

Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]

Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT #40987]

The following resource record types have been implemented: AVC, CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.

Added a warning for a common misconfiguration involving forwarded RFC 1918 and ULA zones.

Contributed software from Nominum is included in the source at contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring the performance of authoritative DNS servers, resperf for testing the resolution performance of a caching DNS server, resperf-report for generating a resperf report in HTML with gnuplot graphs, and queryparse to extract DNS queries from pcap capture files. This software is not installed by default with BIND.

Updated the compiled-in addresses for H.ROOT-SERVERS.NET.

The default preferred glue is now the address type of the transport the query was received over.

On machines with 2 or more processors (CPU), the default value for the number of UDP listeners has been changed to the number of detected processors minus one.

Zone transfers now use smaller message sizes to improve message compression. This results in reduced network usage.

named -V output now also includes operating system details.

When deleting records from a zone database, interior nodes could be left empty but not deleted, damaging search performance afterward. [RT #40997]

The server could crash due to a use-after-free if a zone transfer timed out. [RT #41297]

Authoritative servers that were marked as bogus (e.g. blackholed in configuration or with invalid addresses) were being queried anyway. [RT #41321]

Some of the options for GeoIP ACLs, including "areacode", "metrocode", and "timezone", were incorrectly documented as "area", "metro" and "tz". Both the long and abbreviated versions are now accepted.

Zones configured to use map format master files can't be used as policy zones because RPZ summary data isn't compiled when such zones are mapped into memory. This limitation may be fixed in a future release, but in the meantime it has been documented, and attempting to use such zones in response-policy statements is now a configuration error. [RT #38321]