Knot DNS

Version 3.5.4

Thu, 02 Apr 2026 00:00:00 +0200

Features:

knotd: configurable ZERO-COPY XDP mode (see 'xdp.zero-copy')

mod-dnserr: module for DNS error reporting

Improvements:

knotd: 'zone-update-error' statistic counter covers more situations

knotd: 'zone.catalog-zone' configuration option is ignored …

Version 3.4.10

Wed, 01 Apr 2026 00:00:00 +0200

Improvements:

knotd: DNSSEC signing not required for key restore

doc: various improvements

Bugfixes:

mod-onlinesign: incorrect next NSEC owner name leading to a DoS (Thanks to Shang Kunjie)

knotd: server crash …

Version 3.5.3

Fri, 16 Jan 2026 00:00:00 +0100

Features:

knotd: added statistics counter for failed zone update (see 'zone-update-error')

knotd: new D-Bus signal for zones not updated (see 'server.dbus-event')

knotc: optional parameter for delayed old KSK removal …

Version 3.5.2

Fri, 28 Nov 2025 00:00:00 +0100

Features:

knotd: configurable zone timer storage mode (see 'database.timer-db-sync')

libknot: added support for the DSYNC record type

redis: new module command for printing zone information (see 'KNOT.ZONE.INFO' …

Version 3.4.9

Thu, 27 Nov 2025 00:00:00 +0100

Improvements:

doc: various improvements

Bugfixes:

knotd: if multiple primaries send NOTIFY concurrently, only the last remote is queried

knotd: server crashes if "" value overrides template master value

knotd: refresh with …

Version 3.5.1

Thu, 16 Oct 2025 00:00:00 +0200

Features:

knotc: new command for setting zone SOA serial (see 'zone-serial-set')

Improvements:

knotd: zone database listen configuration now accepts a hostname value

knotd: support for specifying multiple zone databases (see …

Version 3.5.0

Thu, 18 Sep 2025 00:00:00 +0200

Features:

knotd: database zone backend using Redis/Valkey (see 'Database zone backend')

knotd: support for multiple control sockets (see 'control.listen')

knotd: external zone validation (see 'External validation')

knotd: authorization …

Version 3.4.8

Tue, 29 Jul 2025 00:00:00 +0200

Features:

keymgr: implemented key pregeneration for later use (see 'for-later')

Improvements:

knotd: decreased remote session ticket lifetime to 1200 seconds

knotd: TCP connection is not shared between SOA and XFR …

Version 3.4.7

Wed, 04 Jun 2025 00:00:00 +0200

Features:

knotd: implemented optional NOTIFY delay upon zone loading (see 'zone.notify-delay')

knotd: failed ZONEMD validation emits 'dnssec-invalid' D-Bus event

kdig: added option for delayed reading of next transfer message …

Version 3.4.6

Thu, 10 Apr 2025 00:00:00 +0200

Improvements:

knotd: default TSIG algorithm is now 'hmac-sha256'

knotd: added zone expiration info to the failed zone refresh log

knotd: reverse record generation now accepts multiple forward zones to be …

Version 3.4.5

Tue, 18 Mar 2025 00:00:00 +0100

Features:

knotd: support for SOA serial shift (see 'serial-modulo')

knotd: new server statistics (see 'tcp-io-timeout"' and 'tcp-idle-timeout')

Improvements:

knotd: better signing performance of many zones in parallel by moving 'last_signed_serial' …

Version 3.4.4

Wed, 22 Jan 2025 00:00:00 +0100

Features:

knotd: added support for EDNS ZONEVERSION

kdig: added support for EDNS ZONEVERSION (see '+zoneversion')

Improvements:

knotd: improved control error detection and reporting

kdig: proper section names for exported DDNS …

Version 3.4.3

Fri, 06 Dec 2024 00:00:00 +0100

Improvements:

knotd: improved processing of QNAMEs containing zero bytes

knotd: zone expiration now aborts possible zone control transaction #929

knotd: generated catalog member metadata is stored when the zone is …

Version 3.3.10

Thu, 05 Dec 2024 00:00:00 +0100

Improvements:

libknot: added NXNAME meta type (Thanks to Jan Včelák)

Improvements:

knotd: improved processing of QNAMEs containing zero bytes

knotd: generated catalog member metadata is stored when the zone is …

Version 3.4.2

Thu, 31 Oct 2024 00:00:00 +0100

Improvements:

knotd: new warning log upon every incremental update if previous zone signing failed

mod-cookies: support for two secret values specification

keymgr: key pregenerate works even when a KSK exists …

Version 3.4.1

Mon, 14 Oct 2024 00:00:00 +0200

Features:

knotd: ACL configuration allows protocol specification (see 'acl.protocol')

knotc: support for benevolent zone updates (see zone-begin with '+benevolent')

knotd: implemented TLS session resumption

kjournalprint: added print merged changesets …

Version 3.4.0

Mon, 02 Sep 2024 00:00:00 +0200

Features:

knotd: full DNS over TLS (DoT, RFC 7858) implementation (see 'DNS over TLS')

knotd: bidirectional XFR over TLS (XoT) support with opportunistic, strict, and mutual authentication profiles

knotd: support …

Version 3.3.9

Mon, 26 Aug 2024 00:00:00 +0200

Improvements:

libknot: added EDE code 30

libknot: improved performance of knot_rrset_to_wire_extra()

libs: upgraded embedded libngtcp2 to 1.7.0

doc: various fixes and updates

Bugfixes:

keymgr: pregenerate clears future timestamps …

Version 3.3.8

Mon, 22 Jul 2024 00:00:00 +0200

Features:

libzscanner,libknot: added support for 'dohpath' and 'ohttp' SVCB parameters

libzscanner,libknot: added support for WALLET rrtype

keymgr: new commands for keystore testing (see 'keystore-test' and 'keystore-bench')

knotd: new …

Version 3.3.7

Tue, 25 Jun 2024 00:00:00 +0200

Improvements:

libs: upgraded embedded libngtcp2 to 1.6.0

Bugfixes:

knotd: insufficient metadata check can cause journal corruption

knotd: missing zone timers initialization upon purge

knotd: missing RCU lock in …

Version 3.2.13

Mon, 24 Jun 2024 00:00:00 +0200

Bugfixes:

knotd: insufficient metadata check can cause journal corruption

knotd: failed to build on macOS #909

knotd: early NSEC3 salt replanning if 'nsec3-salt-lifetime: -1'

knotc: zone check complains about missing …

Version 3.3.6

Wed, 12 Jun 2024 00:00:00 +0200

Features:

knotd: configurable control socket backlog size (see 'control.backlog')

knotd: optional configuration of congruency of generated keytags (see 'policy.keytag-modulo')

knotc: support for exporting configuration schema in JSON (see …

Version 3.3.5

Wed, 06 Mar 2024 00:00:00 +0100

Features:

knotd: new module mod-authsignal for automatic authenticated DNSSEC bootstrapping records synthesis (Thanks to Peter Thomassen)

kzonecheck: new optional ZONEMD verification (see option '-z')

Improvements:

knotd: new DNSSEC key rollover …

Version 3.3.4

Wed, 24 Jan 2024 00:00:00 +0100

Features:

knotd: new configuration item for clearing configuration sections (see 'clear')

knotc: configuration import can preserve database contents (see '+nopurge' flag)

kxdpgun: new parameter for setting UDP payload size in …

Version 3.3.3

Wed, 13 Dec 2023 00:00:00 +0100

Features:

knotd: new 'pattern' mode of ACL update owner matching (see 'acl.update-owner-match')

knotc: new '+keysonly' filter for zone backup/restore

Improvements:

knotd: zone purging waits for finished zone expiration …

Version 3.2.12

Tue, 12 Dec 2023 00:00:00 +0100

Improvements:

knotd: zone purging waits for finished zone expiration for better reliability

doc: various fixes and extensions

Bugfixes:

knotd: zone backup fails due to improper backup context deinitialization #891

knotd …

Version 3.3.2

Fri, 20 Oct 2023 00:00:00 +0200

Features:

knotd: support for IXFR from AXFR computation (see 'zone.ixfr-from-axfr')

knotd: support benevolent IXFR (see 'zone.ixfr-benevolent')

knot-exporter: new configuration option '--no-zone-serial' #880

Improvements:

libs: upgraded embedded libngtcp2 to …

Version 3.2.11

Thu, 19 Oct 2023 00:00:00 +0200

Improvements:

keymgr: improved error message if a key file is not accessible

keymgr: added offline RRSIGs validation at the end of their validity intervals

doc: fixed some typos

Bugfixes:

knotd …

Version 3.3.1

Mon, 11 Sep 2023 00:00:00 +0200

Improvements:

knotd: multiple catalog groups per member are tolerated, but only one is used

modules: added const qualifier to various function parameters #877 (Thanks to Robert Edmonds)

libs: upgraded embedded …

Version 3.2.10

Sun, 10 Sep 2023 00:00:00 +0200

Improvements:

knotd: multiple catalog groups per member are tolerated, but only one is used

knotd: server cleans up stale LMDB readers when opening a RW transaction

Bugfixes:

knotd: server can …

Version 3.3.0

Mon, 28 Aug 2023 00:00:00 +0200

Features:

knotd: full DNS over QUIC (DoQ, RFC 9250) implementation, also without XDP

knotd: bidirectional XFR over QUIC (XoQ) support with opportunistic, strict, and mutual authentication profiles

knotd: automatic reverse …

Version 3.2.9

Thu, 27 Jul 2023 00:00:00 +0200

Improvements:

keymgr: 'import-pkcs11' not allowed if no PKCS #11 keystore backend is configured

keymgr: more verbose key import errors

doc: extended migration notes

doc: various improvements

Bugfixes:

knotd: server may …

Version 3.2.8

Mon, 26 Jun 2023 00:00:00 +0200

Improvements:

kdig: malformed messages are parsed and printed using a best-effort approach

python: new dname from wire initialization

Bugfixes:

knotd: missing outgoing NOTIFY upon refresh if one of more primaries …

Version 3.2.7

Tue, 06 Jun 2023 00:00:00 +0200

Features:

knotd: new configuration option for preserving incoming IXFR changeset history (see 'zone.ixfr-by-one')

Improvements:

knotd: journal ensures the stored changeset's SOA serials are strictly increasing

knotd: more effective handling …

Version 3.2.6

Tue, 04 Apr 2023 00:00:00 +0200

Improvements:

libs: upgraded embedded libngtcp2 to 0.13.1

libs: added support for building on Cygwin and MSYS (Thanks to Christopher Ng)

mod-dnstap: improved precision of stored time values

kdig …

Version 3.2.5

Thu, 02 Feb 2023 00:00:00 +0100

Features:

knotd: new configuration option for enforcing IXFR fallback (see 'zone.provide-ixfr')

Improvements:

knotd: changed UNIX socket file mode to 0222 for answering and 0220 for control

mod-probe: new support …

Version 3.2.4

Mon, 12 Dec 2022 00:00:00 +0100

Improvements:

knotd: significant speed-up of catalog zone update processing

knotd: new runtime check if RRSIG lifetime is lower than RRSIG refresh

knotd: reworked zone re-bootstrap scheduling to be less progressive …

Version 3.2.3

Sun, 20 Nov 2022 00:00:00 +0100

Improvements:

knotd: new per-zone DS push configuration option (see 'zone.ds-push')

libs: upgraded embedded libngtcp2 to 0.11.0

Bugfixes:

knsupdate: program crashes when sending an update

knotd: server drops …

Version 3.2.2

Tue, 01 Nov 2022 00:00:00 +0100

Features:

knotd,kxdpgun: support for VLAN (802.1Q) traffic in the XDP mode

knotd: added configurable delay upon D-Bus initialization (see 'server.dbus-init-delay')

kdig: support for JSON (RFC 8427) output …

Version 3.2.1

Fri, 09 Sep 2022 00:00:00 +0200

Improvements:

libknot: added compatibility with libbpf 1.0 and libxdp

libknot: removed some trailing white space characters from textual RR format

libs: upgraded embedded libngtcp2 to 0.8.1

Bugfixes …

Version 3.2.0

Mon, 22 Aug 2022 00:00:00 +0200

Features:

knotd: finalized TCP over XDP implementation

knotd: initial implementation of DNS over QUIC in the XDP mode (see 'xdp.quic')

knotd: new incremental DNSKEY management for multi-signer deployment (see …

Version 3.1.9

Wed, 10 Aug 2022 00:00:00 +0200

Improvements:

knotd: new configuration checks on unsupported catalog settings

knotd: semantic check issues have notice log level in the soft mode

keymgr: command generate-ksr automatically sets 'from' parameter to last …

Version 3.1.8

Thu, 28 Apr 2022 00:00:00 +0200

Features:

knotd: optional automatic ACL for XFR and NOTIFY (see 'remote.automatic-acl')

knotd: new soft zone semantic check mode for allowing defective zone loading

knotc: added zone transfer freeze state …

Version 3.0.11

Wed, 27 Apr 2022 00:00:00 +0200

Improvements:

doc: various fixes and improvements

Bugfixes:

knotd/libknot: the server can crash when validating a malformed TSIG record

knotd: public-only key makes DNSSEC signing fail

knotd: frozen zone gets …

Version 3.1.7

Wed, 30 Mar 2022 00:00:00 +0200

Features:

knotd: new configuration items for restricting minimum and maximum zone expire and retry intervals (see 'zone.expire-min-interval', 'zone.expire-max-interval', 'zone.retry-min-interval', 'zone.retry-max-interval') #785

knotc: added catalog information to …

Version 3.1.6

Tue, 08 Feb 2022 00:00:00 +0100

Features:

knotd: optional D-Bus notifications for significant server and zone events (see 'server.dbus-event')

knotd: new submission configuration option for delayed KSK post-activation (see 'submission.parent-delay')

knotc: new commands for …

Version 3.1.5

Mon, 20 Dec 2021 00:00:00 +0100

Features:

knotd: optional outgoing TCP connection pool for faster communication with remotes (see 'server.remote-pool-limit' and 'server.remote-pool-timeout')

knotd: optional unreachable remote tracking to avoid zone events clogging (see 'server …

Version 3.1.4

Thu, 04 Nov 2021 00:00:00 +0100

Features:

mod-dnstap: added 'responses-with-queries' configuration option (Thanks to Robert Edmonds)

Improvements:

knotd: DNSSEC keys are logged in sorted order by timestamp

mod-cookies: added statistics counter for dropped queries due to …

Version 3.0.10

Wed, 03 Nov 2021 00:00:00 +0100

Improvements:

doc: various fixes and improvements

Bugfixes:

knotd: server can crash when receiving queries with NSID EDNS flag #774 (Thanks to Romain Labolle)

knotd: ds-push fails to update the parent …

Version 3.1.3

Mon, 18 Oct 2021 00:00:00 +0200

Improvements:

knotd: added simple error logging to orphaned zone purge

knotd: allow manual public-only keys for unused algorithm

kdig: send ALPN when using DoT or XoT #769

doc: various fixes …

Version 3.1.2

Wed, 08 Sep 2021 00:00:00 +0200

Features:

knotd: new policy configuration for postponing complete deletion of previous keys

keymgr: new optional pretty mode (-b) of listing keys

kdig: added support for TCP keepopen #503

Improvements:

knotd …

Version 3.0.9

Tue, 07 Sep 2021 00:00:00 +0200

Improvements:

keymgr: import-bind sets publish and active timers to now if missing timers #747

Bugfixes:

knotd: incomplete NSEC3 proof in response to opt-outed empty non-terminal

knotd: journal discontinuity and zone-in-journal …

Version 3.1.1

Tue, 10 Aug 2021 00:00:00 +0200

Improvements:

keymgr: import-bind sets publish and active timers to now if missing timers #747

mod-rrl: added QNAME, which triggered an action, to log messages #757

systemd: added environment variable for …

Version 3.1.0

Mon, 02 Aug 2021 00:00:00 +0200

Features:

knotd: automatic zone catalog generation based on actual configuration

knotd: zone catalog supports configuration groups

knotd: support for ZONEMD validation and generation

knotd: basic support for TCP over XDP …

Version 3.0.8

Fri, 16 Jul 2021 00:00:00 +0200

Features:

knotc: new command for loading DNSSEC keys without dropping all RRSIGs when re-signing

knotd: new policy configuration option for disabling some DNSSEC safety features #741

mod-geoip: new dnssec and …

Version 3.0.7

Wed, 16 Jun 2021 00:00:00 +0200

Features:

knotd: new configuration policy option for CDS digest algorithm setting #738

keymgr: new command for primary SOA serial manipulation in on-secondary signing mode

Improvements:

knotd: improved algorithm rollover to …

Version 3.0.6

Wed, 12 May 2021 00:00:00 +0200

Features:

mod-probe: new module for simple traffic logging (Python API not yet included)

Improvements:

keymgr: new mode for listing zones with at least one key stored

keymgr: the pregenerate command …

Version 2.9.9

Thu, 01 Apr 2021 00:00:00 +0200

Improvements:

keymgr: the SEP flag can be changed on already generated keys

Some documentation improvements

Bugfixes:

knotd: journal contents can be considered malformed after changeset merge

knotd: old key is …

Version 3.0.5

Thu, 25 Mar 2021 00:00:00 +0100

Improvements:

kdig: added support for TCP Fast Open on FreeBSD

keymgr: the SEP flag can be changed on already generated keys

Some documentation improvements

Bugfixes:

knotd: journal contents can be …

Version 3.0.4

Wed, 20 Jan 2021 00:00:00 +0100

Improvements:

Sockets to CPUs binding is no longer enabled by default but can be enabled via new configuration option 'server.socket-affinity'

Some documentation improvements

Bugfixes:

DNS queries without EDNS to …

Version 3.0.3

Tue, 15 Dec 2020 00:00:00 +0100

Features:

Kjournalprint can display changesets starting from specific SOA serial

Improvements:

New configuration check on ambiguous 'storage' specification #706

New configuration check on problematic 'zonefile-load' with 'journal-contents' combination

Server logs …

Version 2.9.8

Mon, 14 Dec 2020 00:00:00 +0100

Bugfixes:

On-slave signing produces broken NSEC(3) chain if glue node becomes (un-)orphaned #705

If more masters configured, zone retransfer triggers AXFR from all masters

KSK imported from BIND …

Version 3.0.2

Wed, 11 Nov 2020 00:00:00 +0100

Features:

kdig prints Extended DNS Error (Gift for Marek Vavruša)

kxdpgun allows source IP address/subnet specification

Improvements:

Server doesn't start if any of listen addresses fails to bind

knotc …

Version 3.0.1

Sat, 10 Oct 2020 00:00:00 +0200

Features:

New command in keymgr for validation of RRSIGs in SKR

Keymgr validates RRSIGs in SKR during import

New option in kzonecheck to skip DNSSEC-related checks

Improvements:

Module noudp has …

Version 2.9.7

Fri, 09 Oct 2020 00:00:00 +0200

Bugfixes:

NSEC3 re-salt can cause server crash due to possible zone inconsistencies

Zone reload logs 'invalid parameter' if zone file not changed

Outgoing multi-message transfer can contain invalid compression pointers …

Version 3.0.0

Wed, 09 Sep 2020 00:00:00 +0200

Features:

High-performance networking mode using XDP sockets (requires Linux 4.18+)

Support for Catalog zones including kcatalogprint utility

New DNSSEC validation mode

New kzonesign utility — an interface for manual DNSSEC …

Version 2.9.6

Mon, 31 Aug 2020 00:00:00 +0200

Features:

New kdig option '+[no]opttext' to print unknown EDNS options as text if possible (Thanks to Robert Edmonds)

Improvements:

Better error message if no key is ready for submission …

Version 2.9.5

Mon, 25 May 2020 00:00:00 +0200

Bugfixes:

Old ZSK can be withdrawn too early during a ZSK rollover if maximum zone TTL is computed automatically

Server responds SERVFAIL to ANY queries on empty non-terminal nodes

Improvements …

Version 2.9.4

Tue, 05 May 2020 00:00:00 +0200

Improvements:

ANY query over UDP is always answered with one RRSet + possible RRSIG instead of truncated reply

Server tries to resolve CNAME record generated by geoip module (Thanks to Conrad …

Version 2.9.3

Tue, 03 Mar 2020 00:00:00 +0100

Features:

New configuration option 'remote.block-notify-after-transfer' to suppress sending NOTIFY messages

Enabled testing support for Ed448 DNSSEC algorithm (requires GnuTLS 3.6.12+ and not-yet-released Nettle 3.6+)

New keymgr …

Version 2.8.5

Wed, 01 Jan 2020 00:00:00 +0100

Improvements:

Tiny ds-check log message rewording

Various code and documentation improvements

Bugfixes:

RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update

Server can crash when flushing zone to …

Version 2.9.2

Thu, 12 Dec 2019 00:00:00 +0100

Improvements:

Tiny ds-check log message rewording

Some unnecessary code cleanup

Bugfixes:

ds-push doesn't replace the DS RRset on the parent #661

Server gets stuck in a never-ending logging loop when …

Version 2.9.1

Mon, 11 Nov 2019 00:00:00 +0100

Features:

New option for OCSP stapling '+[no]tls-ocsp-stapling[=H]' in kdig (Thanks to Alexander Schultz)

Improvements:

Kdig always randomizes source TCP port on recent Linux #575

Server no longer warns …

Version 2.9.0

Thu, 10 Oct 2019 00:00:00 +0200

Features:

Full support for different master/slave serial arithmetics when on-slave signing

Module geoip newly supports wildcard records #650

New DNSSEC policy configuration option 'rrsig-pre-refresh' for reducing frequency of the …

Version 2.8.4

Tue, 24 Sep 2019 00:00:00 +0200

Features:

Automatic uploading of DS records to parent zone using DDNS, see 'policy.ds-push' configuration option

Improvements:

Incoming IXFR no longer falls back to AXFR if connection error #642

More …

Version 2.8.3

Tue, 16 Jul 2019 00:00:00 +0200

Features:

Added cert/key file configuration for TLS in kdig (Thanks to Alexander Schultz)

Improvements:

More verbose log message for offline-KSK signing

Module RRL logs affected source address subnet instead …

Version 2.7.8

Mon, 15 Jul 2019 00:00:00 +0200

Improvements:

Various improvements in the documentation

Bugfixes:

Excessive server load when maximum TCP clients limit is reached

Incorrect reply after zone update with a node changed from non-authoritative to delegation …

Version 2.8.2

Wed, 05 Jun 2019 00:00:00 +0200

Features:

New blocking mode for zone event triggers in knotc

New weighted records mode in the module geoip (Thanks to Conrad Hoffmann)

Module noudp allows UDP allow rate configuration

Improvements …

Version 2.8.1

Tue, 09 Apr 2019 00:00:00 +0200

Improvements:

Possible zone transaction is aborted by zone events to avoid inconsistency

Added log message if no persistent config DB is available during 'conf-begin'

New environment setting 'KNOT_VERSION_FORMAT=release' for …

Version 2.7.7

Mon, 08 Apr 2019 00:00:00 +0200

Improvements:

Possible zone transaction is aborted by zone events to avoid inconsistency

Added log message if no persistent config DB is available during 'conf-begin'

Tiny building improvements

Bugfixes:

Glue records …

Version 2.8.0

Tue, 05 Mar 2019 00:00:00 +0100

Features:

New offline-KSK mode of operation

Configurable multithreaded DNSSEC signing for large zones

Extended ACL configuration for dynamic updates

New knotc trigger 'zone-key-rollover' for immediate DNSKEY rollover

Added support for …

Version 2.7.6

Wed, 23 Jan 2019 00:00:00 +0100

Improvements:

Zone status also shows when the zone load is scheduled

Server workers status also shows background workers utilization

Default control timeout for knotc was increased to 10 seconds

Pkg-config …

Version 2.7.5

Mon, 07 Jan 2019 00:00:00 +0100

Features:

Keymgr supports NSEC3 salt handling

Improvements:

Zone history in journal is dropped apon AXFR-like zone update

Libdnssec is no longer linked against libm #628

Libdnssec is explicitly linked against …

Version 2.7.4

Tue, 13 Nov 2018 00:00:00 +0100

Features:

Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)

Improvements:

Added warning log when DNSSEC events not successfully scheduled

New semantic check on timer values in keymgr …

Version 2.7.3

Thu, 11 Oct 2018 00:00:00 +0200

Features:

New queryacl module for query access control

Configurable answer rrset rotation #612

Configurable NSEC bitmap in online signing

Improvements:

Better error logging for KASP DB operations #601

Some documentation …

Version 2.7.2

Wed, 29 Aug 2018 00:00:00 +0200

Improvements:

Keymgr list command displays also key size

Kjournalprint displays total occupied size in the debug mode

Server doesn't stop if failed to load a shared module from the module …

Version 2.7.1

Tue, 14 Aug 2018 00:00:00 +0200

Improvements:

Added zone wire size information to zone loading log message

Added debug log message for each unsuccessful remote address operation

Various improvements for packaging

Bugfixes:

Incompatible handling of RRSIG …

Version 2.6.9

Mon, 13 Aug 2018 00:00:00 +0200

Improvements:

Added zone wire size to zone loading log message

Added debug log message for each unsuccessful remote address operation

Bugfixes:

Zone not flushed after re-signing during zone load #594 …

Version 2.7.0

Fri, 03 Aug 2018 00:00:00 +0200

Features:

New DNS Cookies module and related '+cookie' kdig option

New module for response tailoring according to client's subnet or geographic location

General EDNS Client Subnet support in the server …

Version 2.6.8

Tue, 10 Jul 2018 00:00:00 +0200

Features:

New 'import-pkcs11' command in keymgr

Improvements:

Unixtime serial policy mimics Bind – increment if lower #593

Bugfixes:

Creeping memory consuption upon server reload #584

Kdig incorrectly detects QNAME if 'notify' …

Version 2.6.7

Thu, 17 May 2018 00:00:00 +0200

Features:

Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)

Improvements:

Trailing data indication from the packet parser (libknot)

Better configuration check for a problematical option combination

Bugfixes:

Incomplete …

Version 2.6.6

Wed, 11 Apr 2018 00:00:00 +0200

Features:

New EDNS option counters in the statistics module

New '+orphan' filter for the 'zone-purge' operation

Improvements:

Reduced memory consuption of disabled statistics metrics

Some spelling fixes (Thanks to Daniel …

Version 2.6.5

Mon, 12 Feb 2018 00:00:00 +0100

Features:

New 'zone-notify' command in knotc

Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set

Improvements:

Better heap memory trimming for zone operations

Added proper polling …

Version 2.6.4

Tue, 02 Jan 2018 00:00:00 +0100

Features:

Module synthrecord allows multiple 'network' specification

New CSK handling support in keymgr

Improvements:

Allowed configuration for infinite zsk lifetime

Increased performance and security of the module synthrecord

Signing changeset …

Version 2.5.7

Mon, 01 Jan 2018 00:00:00 +0100

Bugfixes:

Unintentional zone re-sign during reload if empty NSEC3 salt

Inconsistent zone names in journald structured logs

Malformed outgoing transfer for big zone with TSIG

Unexpected reply for DS query …

Version 2.6.3

Fri, 24 Nov 2017 00:00:00 +0100

Bugfixes:

Wrong detection of signing scheme rollover

Version 2.6.2

Thu, 23 Nov 2017 00:00:00 +0100

Features:

CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support

Improvements:

Allowed explicit configuration for infinite ksk lifetime

Proper error messages instead of unclear error codes in server log

Better …

Version 2.6.1

Thu, 02 Nov 2017 00:00:00 +0100

Features:

NSEC3 Opt-Out support in the DNSSEC signing

New CDS/CDNSKEY publish configuration option

Improvements:

Simplified DNSSEC log message with DNSKEY details

+tls-hostname in kdig implies +tls-ca if neither +tls-ca …

Version 2.5.6

Wed, 01 Nov 2017 00:00:00 +0100

Improvements:

Keymgr no longer prints useless algorithm number for generated key

Bugfixes:

Faulty DNAME semantic check if present in the zone apex and NSEC3 is used

Immediate zone flush not …

Version 2.6.0

Fri, 29 Sep 2017 00:00:00 +0200

Features:

On-slave (inline) signing support

Automatic DNSSEC key algorithm rollover

Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)

New 'journal-content' and 'zonefile-load' configuration options

keymgr tries to run …