Release Notes
Contents
Introduction
BIND 9.19 is an unstable development release of BIND. This document summarizes new features and functional changes that have been introduced on this branch. With each development release leading up to the stable BIND 9.20 release, this document will be updated with additional features added and bugs fixed. Please see the CHANGES file for a more detailed list of changes and bug fixes.
Supported Platforms
See the Supported Platforms section in the Resource Requirements chapter.
Download
The latest versions of BIND 9 software can always be found at https://www.isc.org/download/. There you will find additional information about each release, and source code.
Notes for BIND 9.19.1
Security Fixes
None.
Known Issues
None.
New Features
Add DNS Extended Errors (RFC 8914) when stale answers are returned from cache. [GL #2267]
The Object Identifier (OID) embedded at the start of a PRIVATEOID public key in a KEY, DNSKEY, CDNSKEY, or RKEY resource record is now checked to ensure that it is valid when reading from zone files or receiving data on the wire, and the OID is now printed when the
dig +rrcomments
option is used. Similarly, the name embedded at the start of a PRIVATEDNS public key is also checked for validity. [GL #3234]The Object Identifier (OID) embedded at the start of a PRIVATEOID signature in a SIG, or RRSIG resource record is now checked to ensure that it is valid when reading from zone files or receiving data on the wire. Similarly, the name embedded at the start of a PRIVATEDNS public key is also checked for validity. [GL #3296]
Removed Features
None.
Feature Changes
None.
Bug Fixes
CDS and CDNSKEY DELETE records are removed from the zone when configured with ‘auto-dnssec maintain;’. This has been fixed. [GL #2931].
Notes for BIND 9.19.0
Known Issues
According to RFC 8310, Section 8.1, the
Subject
field MUST NOT be inspected when verifying a remote certificate while establishing a DNS-over-TLS connection. OnlysubjectAltName
must be checked instead. Unfortunately, some quite old versions of cryptographic libraries might lack the ability to ignore theSubject
field. This should have minimal production-use consequences, as most of the production-ready certificates issued by certificate authorities will havesubjectAltName
set. In such cases, theSubject
field is ignored. Only old platforms are affected by this, e.g. those supplied with OpenSSL versions older than 1.1.1. [GL #3163]
New Features
Add support for remote TLS certificate verification, both to
named
anddig
, making it possible to implement Strict and Mutual TLS authentication, as described in RFC 9103, Section 9.3. [GL #3163]dnssec-verify
anddnssec-signzone
now accept a-J
option to specify a journal file to read when loading the zone to be verified or signed. [GL #2486]
Removed Features
The
keep-order-response
option has been declared obsolete and the functionality has been removed.named
expects DNS clients to be fully compliant with RFC 7766. [GL #3140]
Feature Changes
Run RPZ updates on the specialized “offload” threads to reduce the amount of time they block query processing on the main networking threads. This should increase the responsiveness of
named
when RPZ updates are being applied after an RPZ zone has been successfully transferred. [GL #3190]
License
BIND 9 is open source software licensed under the terms of the Mozilla Public
License, version 2.0 (see the COPYING
file for the full text).
Those wishing to discuss license compliance may contact ISC at https://www.isc.org/contact/.
End of Life
BIND 9.19 is an unstable development branch. When its development is complete, it will be renamed to BIND 9.20, which will be a stable branch. The end-of-life date for BIND 9.20 has not yet been determined. For those needing long-term stability, the current Extended Support Version (ESV) is BIND 9.16, which will be supported until at least December 2023. See https://kb.isc.org/docs/aa-00896 for details of ISC’s software support policy.
Thank You
Thank you to everyone who assisted us in making this release possible.