NSD: Name Server Daemon

NSD is an authoritative only, high performance, simple and open source name server. The latest current stable release is NSD 4.1.20. Download the latest version.

NSD is thoroughly tested, there is a regression tests report available: differences.pdf

For NSD 4.0, the memory estimation tool can be compiled in the source tarball with 'make nsd-mem' and running it on a config file with the zone files in question.

NLnet Labs has a long term commitment for supporting NSD. There will be an advanced notice when our commitment ends. The latest NSD release will supported for at least two years after this notice. More details on the support program are found here.

NSD 3.x is end of life. We now provide support for NSD 4. Please upgrade to NSD 4. The support for NSD 3 ends on May 20th, 2016.

Man pages

Manual pages are installed, they can also be viewed here:

Mailing lists

If you are using NSD, you might want to consider subscribing to nsd-users by going to this page.

Browse the archives of nsd-users.

SVN repository

The repository of NSD is available at /svn/nsd/.

The NSD 4.x.x development tree is located in trunk/.


NSD 4.1.20

Feb 20, 2018
    • Fix memory leak in zone file read of unknown rr formatted RRs.
    • Fix memory leak when rehashing nsec3 after axfr or zonefile read, in the selectively allocated precompiled nsec3 hashes.
        Download: nsd-4.1.20.tar.gz
        Checksum sha256: 8a97f61d7bbb98a2ce04dc4425596f9023677a5f1c5ea743ff408d487f82f713
        PGP signature: nsd-4.1.20.tar.gz.asc

        NSD 4.1.19

        Dec 11, 2017
          • ignore fallthrough compiler warning in flex EOF rule.
          • Fix warnings emitted by clang for --enable-packed. Alignment is not a problem for x86_64, don't enable packed when the platform requires aligned access.
          • Fix spelling error in xfr-inspect.
          • Fix 3392: Fix regression in 4.1.18 for notify lists with ip4 and ip6 targets.
          • Add test for support of -Wno-address-of-packed-member for --enable-packed.
              Download: nsd-4.1.19.tar.gz
              Checksum sha256: b0782cb9b57416888d488b6460b071cd85ecb5f99381865b3a7f93dddf9e02c5
              PGP signature: nsd-4.1.19.tar.gz.asc

              NSD 4.1.18

              Nov 30, 2017
              • xfr-inspect, it is not installed, it prints xfr files from /tmp made with 'make xfr-inspect' in the source dir.
              • retry timeout between sending notifies dropped from 15 to 3 sec.
              • NSD sends 16 notifies simultaneously.
              • configure --enable-packed reduces memory usage, at expense of unaligned reads. Saves about 17%.
              • Save memory by selectively allocate precompiled nsec3 hashes, saves about 16% memory.
              • make ip-transparent option work on OpenBSD.
              • Save about 2% memory by changing usage count size in name tree.
              • Fix #2871: Increase number of sockets for xfrd transfers.
              • Fix gcc 7.1.1 warnings.
              • Fix writev compile warning on FreeBSD.
              • Fix #1446: A corrupted zone file "propagates" to good ones.
              • nsd-control zonestatus prints wait time between attempts, for zones that are in that waiting time.
              • Fix collision printout of nsec3 to print name, hash and reverse.
              • Fix #1567: Change crit to err log level for gettimeofday failure. Add defines for compile without syslog.
              • Fix crash for DS query when parent and child zones both configured in nsd.conf and parent zone has not loaded properly.
                  Download: nsd-4.1.18.tar.gz
                  Checksum sha256: 8c1db23c5ad44c6410874161e78f785475d3f08ed0daae57fe56c44e33a89c0f
                  PGP signature: nsd-4.1.18.tar.gz.asc

                  NSD 4.1.17

                  Jul 21, 2017
                  • zone parser parses type AVC (it has TXT format).
                  • Fix #1272: use writev to put tcp length field with data for outgoing zone transfer requests.
                  • Fix potential null pointer in nsec3 adjustment tree.
                  • Fix text format of deletes for CDS and CDNSKEY, single 0 to represent empty base64 or hex string.
                      Download: nsd-4.1.17.tar.gz
                      Checksum sha256: 107fa506d18ed6fd0a922d1b96774afd9270ec38ec6b17cd7c46fb9433a03a6c
                      PGP signature: nsd-4.1.17.tar.gz.asc

                      NSD 4.1.16

                      Apr 25, 2017
                      • zone parser can parse acronyms for algorithms ED25519 and ED448.
                      • Fix 1243: Option to make NSD emit really minimal responses, minimal-responses: yes in nsd.conf.
                      • Calculate new udb index after growing the array, fix from Chaofeng Liu.
                      • Fix missing _t to _type conversion for disable-radix-tree option.
                      • Printout serial error with hint it may be too big.
                      • Fix 1228: OpenSSL include is not guarded with HAVE_SSL
                      • Patch for expire state in multi-master when masters includes broken master, from Manabu Sonoda.
                      • minor manpage fix.
                          Download: nsd-4.1.16.tar.gz
                          Checksum sha256: 7f8367ad23cc5cddffa885e7e2f549123c8b4123db9726df41d99f255d6baab2
                          PGP signature: nsd-4.1.16.tar.gz.asc

                          NSD 4.1.15

                          Feb 16, 2017
                            • Fix nsd-control and ipv6 only.
                            • Squelch zone transfer error address family not supported by protocol at low verbosity levels.
                            • Fix #1195: Fix so that NSD fails on non-compliant values for Serial.
                            • Fix to rename _t typedefs because POSIX reserves them.
                            • Fix that nsec3 hash collisions only reported on verbosity level 3.
                                Download: nsd-4.1.15.tar.gz
                                Checksum sha256: 494a862cfcd26a525a4bf06306eb7ab0387b34678ac6d37767507438e3a23a4b
                                PGP signature: nsd-4.1.15.tar.gz.asc

                                NSD 4.1.14

                                Dec 8, 2016
                                • Fix #1132 for SERVFAIL zones perform backoff, and remembers the timeout on next startup.
                                • Fix null memcpy for radixtree with single link element.
                                • Robust fix against missing master in tcp_open for xfrd.
                                • Fix wildcards in include: config statements with chroot enabled.
                                • suppress compile warning in lex files.
                                • Fix to try every master once, then wait for timeout or notify.
                                • Save backoff timeout into xfrd.state file, this file has a higher version number now. Old files are skipped silently (causes refresh) and created as new files upon exit.
                                • Fix restart of zone transfers when new config becomes available.
                                    Download: nsd-4.1.14.tar.gz
                                    Checksum sha256: bdfc61c5f3bf11febd8f4776eef1d4f2d95ed70f12f11d4eeee943c186ffd802
                                    PGP signature: nsd-4.1.14.tar.gz.asc

                                    NSD 4.1.13

                                    Sep 27, 2016
                                    • multi-master-check: yes can be used to check all masters for the last version, using the higher version from the configured masters, from Manabu Sonoda.
                                    • Support RR type OPENPGPKEY from RFC 7929.
                                    • Can config key algorithms with the digest name, eg. 'sha256'.
                                    • configure --disable-radix-tree for about 15% lower memory usage.
                                    • for type SRV add A/AAAA to the additional section (if possible), just like we already do for type MX.
                                    • more extensible edns option handling.
                                    • Fix compile warnings about unused result from write and strtol. and signcompare in minmax retrytime.
                                    • Fix #812: fix that make depend fails after distribution.
                                    • Fix #817: xfrd update failed loop.
                                    • Add robustness against unallocated data in nsec3 trees.
                                    • Fix README spelling error of BSD license (reported by Joerg Jung).
                                    • Fix multimaster for not tried full zone transfer for a expired zone.
                                    • Fix #827: fix compile with openssl 1.1.0 with api=1.1.0.
                                        Download: nsd-4.1.13.tar.gz
                                        Checksum sha256: c45cd4ba2101a027e133b2be44db9378e27602e05f09a5ef25019e1ae45291af
                                        PGP signature: nsd-4.1.13.tar.gz.asc

                                        NSD 4.1.12

                                        Sep 02, 2016
                                          • Fix malformed edns query assertion failure, reported by Michal Kepien (NASK).
                                              Download: nsd-4.1.12.tar.gz
                                              Checksum sha256: fd1979dff1fba55310fd4f439dc9f3f4701d435c0ec4fb9af533e12c7f27d5de
                                              PGP signature: nsd-4.1.12.tar.gz.asc

                                              NSD 4.1.11

                                              Aug 09, 2016
                                              • When tcp is more than half full, use short timeout for tcp session.
                                              • Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
                                              • Fix #790: size-limit-xfr can stop NSD from downloading infinite zone transfer data size, from Toshifumi Sakaguchi. Fixes CVE-2016-6173 JVN#63359718 JPCERT#91251865.
                                              • Fix build without IPv6, patch from Zdenek Kaspar.
                                              • Fix #783: Trying to run a root server without having configured it silently gives wrong answers.
                                              • Fix #782: Serve DS record but parent zone has no NS record.
                                              • Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.
                                                  Download: nsd-4.1.11.tar.gz
                                                  Checksum sha256: c7712fd05eb0ab97040738e01d9369d02b89c0a7fa0943fd5bfc43b2111a92df
                                                  PGP signature: nsd-4.1.11.tar.gz.asc

                                                  NSD 4.1.10

                                                  Jun 14, 2016
                                                  • ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option for Linux, binds to interfaces and addresses that are down.
                                                  • NSD includes AAAA before A for queries over IPV6 (in delegations). And TC is set if no glue can be provided with a delegation because of packet size.
                                                  • print notice that nsd is starting before taking off.
                                                  • Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl.
                                                  • Fix #751: NSD fails to occlude names below a DNAME.
                                                  • If set without nsd.db print "" as the default in the man pages.
                                                  • Fix #755: NSD spins after a zone update and a lot of TCP queries.
                                                  • Fix for NSEC3 with zone signed without exact match for empty nonterminals, the answer for that domain gets closest encloser.
                                                  • #772 Document that recvmmsg has IPv6 problems on some linux kernels.
                                                      Download: nsd-4.1.10.tar.gz
                                                      Checksum sha256: 3a757014046752a0b0b11c1a2e22a36bb796f89f6939147ed3226556b4298727
                                                      PGP signature: nsd-4.1.10.tar.gz.asc

                                                      NSD 4.1.9

                                                      Mar 15, 2016
                                                        • Change the nsd.db file version because of nanosecond precision fix.
                                                            Download: nsd-4.1.9.tar.gz
                                                            Checksum sha256: b811224d635331de741f1723aefc41adda0a0a3a499ec310aa01dd3b4b95c8f2
                                                            PGP signature: nsd-4.1.9.tar.gz.asc

                                                            NSD 4.1.8

                                                            Mar 10, 2016
                                                            • Fix #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch from Daisuke Higashi.
                                                            • Fix #739: zonefile changes when mtime is small are detected on reload, if filesystem supports precision mtime values.
                                                            • RR type CSYNC (RFC7477) syntax is supported.
                                                            • take advantage of arc4random_uniform if available, patch from Loganaden Velvindron.
                                                            • Fix flto check for OSX clang.
                                                            • Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux.
                                                            • Fix #736: segfault during zone transfer.
                                                            • Fix #744: Fix that NSD replies for configured but unloaded zone with SERVFAIL, not REFUSED.
                                                                Download: nsd-4.1.8.tar.gz
                                                                Checksum sha256: 34bc9babfeca18cf3ea1d8d61f7a9b7fcc5253b4d5f78ddc9691244590554c82
                                                                PGP signature: nsd-4.1.8.tar.gz.asc

                                                                NSD 4.1.7

                                                                Dec 10, 2015
                                                                • support configure --with-dbfile="" for nodb mode by default, where there is no binary database, but nsd reads and writes zonefiles.
                                                                • reuseport: no is the default, because the feature is not troublefree.
                                                                • configure --enable-ratelimit-default-is-off with --enable-ratelimit to set the default ratelimit to disabled but available in nsd.conf.
                                                                • version: "string" option to set chaos version query reply string.
                                                                • Fix zones updates from nsd parent event loop when there are a lot of interfaces.
                                                                • portability fixes.
                                                                • patch from Doug Hogan for SSL_OP_NO_SSLvx options, for the new defaults in the ssl libraries.
                                                                • updated contrib/nsd.spec, from B├ílint Szigeti, with new configure options.
                                                                • Allocate less memory for TSIG digest.
                                                                • Fix #721: Fix wrong error code (FORMERR) returned for unknown opcode. NOTIMP expected.
                                                                • Fix zonec ttl mismatch printout to include more information.
                                                                • Fix TCP responses when REUSEPORT is in use by turning it off.
                                                                • Document default in manpage for rrl-slip, ip4 and 6 prefixlength.
                                                                • Explain rrl-slip better in documentation.
                                                                • Document that ratelimit qps and slip are updated in reconfig.
                                                                • Fix up defaults in manpage.
                                                                    Download: nsd-4.1.7.tar.gz
                                                                    Checksum sha256: 7ba8beb29b495ab795e927d9aa82a5bb1b66296a78f61ed47d6ccfe59e9b1a8a
                                                                    PGP signature: nsd-4.1.7.tar.gz.asc

                                                                    NSD 4.1.6

                                                                    Oct 22, 2015
                                                                      • Fix #701: Fix that AD=1 set in a BADVERS response.
                                                                      • Fix typo in zonec.c inside error message.
                                                                      • Fix #711: Document that debug-mode yes is used for staying attached to the supervisor console.
                                                                      • Document verbosity 3 prints more information.
                                                                      • nsd-checkconf warns for master zones with no zonefile statement.
                                                                      • Fix start failure when many file descriptors are in use.
                                                                      • The servfail rcode is not printed with a space in the middle.
                                                                          Download: nsd-4.1.6.tar.gz
                                                                          Checksum sha256: 88f622055c95d38b9ef3723a240d1d0da35a28d09fe23b601015181a61d7775f
                                                                          PGP signature: nsd-4.1.6.tar.gz.asc

                                                                          NSD 4.1.5

                                                                          Sep 21, 2015
                                                                            • Fix #706: default port 53 not opened on ip4 because of getaddrinfo hints initialisation failure.
                                                                                Download: nsd-4.1.5.tar.gz
                                                                                Checksum sha256: 105dda21fab68b150f1f4d045211869b13becadc52be830b9c0093f8e9f01baa
                                                                                PGP signature: nsd-4.1.5.tar.gz.asc

                                                                                NSD 4.1.4

                                                                                Sep 09, 2015
                                                                                • RFC7553 RR Type URI support.
                                                                                • removed hardcoded interface limit, --with-max-ips removed.
                                                                                • SO_REUSEPORT support, by default on Linux, or with reuseport: yes.
                                                                                • Admitted axfrs are logged at verbosity 1. Refused at verbosity 2.
                                                                                • --enable-pie and --enable-relro-now options for a safer executable.
                                                                                • Fix NSID response for short edns sizes.
                                                                                • Fix that for expired zones NSD performs an AXFR and accepts newer and older serial numbers.
                                                                                • Document that minimal responses only minimizes responses to fit in one datagram. It does not minimize smaller responses.
                                                                                • Fix #618: documented need to list ip-addresses seperately in nsd.conf if there are multiple, because the source address of replies can otherwise go wrong.
                                                                                • Fix that notify from nsd-control contains soa serial.
                                                                                • Fix #698 formatting errors and typos in nsd.8.in.
                                                                                    Download: nsd-4.1.4.tar.gz
                                                                                    Checksum sha256: d6e0e9cd1f637a3b4bfa48dba47b1564408eb531c57f6a3dda1a2d529df800f0
                                                                                    PGP signature: nsd-4.1.4.tar.gz.asc

                                                                                    NSD 4.1.3

                                                                                    Jun 23, 2015
                                                                                    • nsd-control addzones and delzones read list of zones from stdin.
                                                                                    • hmac sha224, sha384 and sha512 support, patch from David Gwynne.
                                                                                    • max-interfaces raised to 32.
                                                                                    • Fix #665: when removing subdomain, nsd does not reparse parent zone.
                                                                                    • Fix task and zonestat files to be stored in a subdirectory in tmp to stop privilege elevation.
                                                                                    • Fix crash in zone parser for relative dname after error in origin.
                                                                                    • Fix that formerrors are ratelimited.
                                                                                        Download: nsd-4.1.3.tar.gz
                                                                                        Checksum sha256: 097cb295cdd3e8a73a8afac343caf0fca11b72b2214b022689ddc423312d17e5
                                                                                        PGP signature: nsd-4.1.3.tar.gz.asc

                                                                                        NSD 4.1.2

                                                                                        Apr 14, 2015
                                                                                        • Incoming notifies have serial number logged (at verbosity 1).
                                                                                        • Remove some duplicate header includes (from Brad Smith).
                                                                                        • Fix tcp waiting list for zone transfers where the bind and connect calls fail.
                                                                                        • Fix segfault in zone reader on invalid input. (thanks John Van de Meulebrouck Brendgard)
                                                                                        • Fix segfault on double origin in zone reader (thanks John Van de Meulebrouck Brendgard).
                                                                                        • Fix b64pton out of bounds error on invalid zonefile input. (thanks John Van de Meulebrouck Brendgard)
                                                                                        • Fix origin directive from unused old value and subdomain parser failure, reported by John Van de Meulebrouck Brendgard.
                                                                                        • Fix use after free after zonefile syntax error followed by ttl or origin directive, reported by John Van de Meulebrouck Brendgard.
                                                                                        • Fix syntax error followed by too many TXT elements parse crash reported by John Van de Meulebrouck Brendgard.
                                                                                        • Fix buffer overflow in config parse of domain name, reported by John Van de Meulebrouck Brendgard.
                                                                                        • Use reallocarray for integer overflow protection, patch submitted by Loganaden Velvindron.
                                                                                        • Fix allocation integer overflow checks.
                                                                                        • Fix #654: Fix contradiction in notify logging verbosity level.
                                                                                        • Fix #655: Fix contradiction in verbosity for zone transfers.
                                                                                        • Made log message more consistent, changed 'axfr refused' log message to be more consistent with other messages. Also notify refused.
                                                                                        • verbosity 2 logs axfr refused and notify refused. verbosity 1 contains less log messages.
                                                                                            Download: nsd-4.1.2.tar.gz
                                                                                            Checksum sha256: 8514b75bb8884526a637e1666911f429e0f52c5a3b0186104bb111371993644d
                                                                                            PGP signature: nsd-4.1.2.tar.gz.asc

                                                                                            NSD 4.1.1

                                                                                            Feb 3, 2015
                                                                                            • RFC 7344: CDS and CDNSKEY (read record types).
                                                                                            • per zone statistics with --enable-zone-stats, config zone with zonestats: "name", zones configured with the same string are added.
                                                                                            • Disabled use of SSLv3 in nsd-control.
                                                                                            • nsd-checkconf -f prints out full name of pidfile (with dir).
                                                                                            • Synthesize CNAMEs with same TTL as DNAME.
                                                                                            • Fix that expired zones stay expired after a server restart.
                                                                                            • Fix "xfrd_handle_ipc: bad mode" log errors when compiled with --disable-bind8-stats.
                                                                                            • Fix #616: retry xfer for zones with no content after command.
                                                                                            • Fix char used as array index warnings on NetBSD.
                                                                                            • Fix that queries for noname CH TXT are REFUSED instead of nodata.
                                                                                            • Fixes for wildcard addition and deletion, speedup for some cases.
                                                                                            • Fix that failure to add tcp to tcp base does not leak the socket.
                                                                                            • Patch nsd_munin_ from Philip Paeps to use type ABSOLUTE.
                                                                                            • Fix spinning NSD with lots of failing transfers, due to pointer comparison using void pointer subtraction (from Otto Moerbeek).
                                                                                            • Fix bug#637: fix that nsd.db grows limitlessly, an off by one on one megabyte free chunks, created during AXFRs of large zones, that caused the one megabyte chunk to be leaked.
                                                                                            • Fix casts for ctype functions (from Todd Miller).
                                                                                            • correct some hyphen-used-as-minus-sign (from Andreas Schulze) in man pages.
                                                                                            • Fix zonesdir chroot error message.
                                                                                                Download: nsd-4.1.1.tar.gz
                                                                                                Checksum sha256: b0c3fab40ac7a8b5ffca642bc9e1b424aa72aebd03adf13a1f24ab4874734640
                                                                                                PGP signature: nsd-4.1.1.tar.gz.asc

                                                                                                NSD 4.1.0

                                                                                                Sep 4, 2014
                                                                                                • database: "" starts without mmap of database. Less memory is used, zones are read from text zonefile.
                                                                                                • optimised zonefile parse code and zonefile write code.
                                                                                                • zonefiles-write option in nsd.conf, enabled when database is "". The server writes changed zonefiles to disk every hour.
                                                                                                • xfrdfile: "" disables xfrd.state. If enabled, zones that are same as before are not checked for a serial update at server start.
                                                                                                • include: "foo/nsd.d/*.conf" works, wildcard glob on includes.
                                                                                                • nsd shuts down during init process if given signal.
                                                                                                • log-time-ascii option, default yes, with readable timestamp in log.
                                                                                                • nsd-control addzone reports if zone already exists.
                                                                                                • Fix #564: add nsd-checkzone tool to check zonefile correctness.
                                                                                                • Increased default --with-max-ips from 8 to 16, this increases the number of interfaces you can specify in nsd.conf to listen to.
                                                                                                • Fixed shutdown message sporadically not printed on exit (Thanks Anand Buddhdev).
                                                                                                • Documented zonefile %s syntax in nsd.conf man page.
                                                                                                • Fix manpage to put colon after zonefiles check and write.
                                                                                                • Change from "Zone" to "zone" with ".. serial .. is updated" log message.
                                                                                                • Changed maxbackoff for no-content secondary zones from 4h to 24h.
                                                                                                • Fix print filename of encompassing config file on read failure.
                                                                                                • Fix delete or rename of a lot of zones and make it take a non-enormous time.
                                                                                                • Speed up deletion of zone contents a lot, (56s to 1s), speeds up delete, rename and AXFR for zones.
                                                                                                • Fix #571: unused variable and incompatible pointer warnings when compiled on a system without INET6.
                                                                                                • Fix write_socket return value check in server.c (Thanks Brad Smith, Mark Kettenis).
                                                                                                • Fix that xfrd reaps children also if the signal is lost.
                                                                                                • Fix #577: makefile incorrectly installed manpages from srcdir.
                                                                                                • Fix #587: Default value for statistics is 0.
                                                                                                • Fix #553: Improve TXT parsing.
                                                                                                • Fix #590: rrl log does not print wildcard as a star but escaped.
                                                                                                • Fix #591: rrl log messages at verbosity level 1.
                                                                                                • fix strptime implicit declaration error on OpenBSD.
                                                                                                • Fix -O3 compile flag to -O2 to avoid miscompilations.
                                                                                                • Allow user to override the -g -O2 CFLAGS in ./configure.
                                                                                                • Fix endian.h include for OpenBSD.
                                                                                                • Remove .LP after .SH in man pages.
                                                                                                • Fix #600: document that provide-xfr provides AXFR and not IXFR.
                                                                                                • Fix rising-load-average or memory-leaks in OSes (Linux since 2.6), that keep track of all past process parents, or leak memory for them. Fix makes it so there is no very deep string of process parents.
                                                                                                    Download: nsd-4.1.0.tar.gz
                                                                                                    Checksum sha256: ec3f6902f6f26a6b9248dcd7e9f42472fa52755740b4ba6b9d3bd08910b39b62
                                                                                                    PGP signature: nsd-4.1.0.tar.gz.asc

                                                                                                    NSD 4.0.3

                                                                                                    Mar 14, 2014
                                                                                                      • Fix nsd.db unclean close check. Previous databases are considered unclean by the code and are created anew.
                                                                                                      • Adds nsd.db larger than 400Tb check for sanity. Also test if filesize as documented in the file is correct.
                                                                                                      • nsd waits for tasks to complete on stop, prevents nsd.db corruption.
                                                                                                      • fix to not delete tmpdir too early in shutdown process.
                                                                                                      • disabled udb checking functionality that made it very slow, this was enabled when enable-checking was turned on.
                                                                                                          Download: nsd-4.0.3.tar.gz
                                                                                                          Checksum sha256: 4bf05f2234e1b41899198aa1070f409201fc3c4980feef6567cd92c7074c4a8b
                                                                                                          PGP signature: nsd-4.0.3.tar.gz.asc

                                                                                                          NSD 4.0.2

                                                                                                          Mar 12, 2014
                                                                                                          • Return REFUSED for queries to non-hosted zones.
                                                                                                          • Fix expired zones to give SERVFAIL, also when parent zone loaded.
                                                                                                          • documented nsd-control zonestatus output in nsd-control manpage.
                                                                                                          • remove mention of nsdc from nsd-checkconf manpage.
                                                                                                          • Disabled recvmmsg and sendmmsg usage by default because kernel versions have implementation issues: ipv6 ignored, security issues.
                                                                                                          • Detect libevent2 install automatically by configure, and use event2 header files if necessary.
                                                                                                          • Fix #551: change Regent to Copyright holder in the LICENSE, to match the definition on opensource.org for the BSD License.
                                                                                                          • Fix #552: zonefile loads on nsd-control reconfig when the name of the file has changed.
                                                                                                          • Fix leak of zone name after zonefile read and fix malloc too large that would be leaked in the radix tree.
                                                                                                          • Fix from 3.2: make SOA RDATA comparisons in XFR more lenient (only check serial).
                                                                                                          • Fix that NSD will delete and recreate not-clean-closed databases.
                                                                                                              Download: nsd-4.0.2.tar.gz
                                                                                                              Checksum sha256: f90e1ac7d05ac0dbcef9d0abd629586eac0f166b96bcb36d5948bc3bb8ded51f
                                                                                                              PGP signature: nsd-4.0.2.tar.gz.asc

                                                                                                              NSD 4.0.1

                                                                                                              Jan 27, 2014
                                                                                                              • recognizes ip-address and interface as synonyms for convenience.
                                                                                                              • EUI48 and EUI64 RR types (RFC7043) enabled by default.
                                                                                                              • Support for CAA RR type (RFC6844).
                                                                                                              • NSID can be set with "ascii_somestring" in ascii.
                                                                                                              • Fix xfrd when zone transfer TCP contains zero length packets.
                                                                                                              • Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3, because AXFRs overwrote nsec3 administration in the child zone.
                                                                                                              • Fix that bad IXFR updates do not result in double SOA records, and that an AXFR is started (attempted) when the zone state seems to be inconsistent with the master's zone state.
                                                                                                              • Log ip address for sendto and sendmmsg failures.
                                                                                                              • Fix segfaults after read of zones with rr type WKS from zonefile.
                                                                                                              • Seed PRNG for openssl at start of daemon, fixes SSL connection issue.
                                                                                                              • Bugfix #534: IXFR query loop over UDP for zones that are unchanged.
                                                                                                              • (same as in 3.2.16): fix wildcard cname to nxdomain repeated rrset.
                                                                                                              • (same as in 3.2.16): Bugfix #542: Match RRSIG TTL with SOA TTL in negative response.
                                                                                                              • Check if configure in srcdir collides with outofdir build.
                                                                                                              • Fix #546: output format errors in nsd_munin_ (Thanks Tom Hendrikx).
                                                                                                              • Fix printout of high-chars in TXT on NetBSD.
                                                                                                                  Download: nsd-4.0.1.tar.gz
                                                                                                                  Checksum sha256: 45bf2adb5ceddc140eab36b8de9fa527175b77559662df1383ef22ccf097d1bd
                                                                                                                  PGP signature: nsd-4.0.1.tar.gz.asc

                                                                                                                  NSD 4.0.0

                                                                                                                  Oct 29, 2013
                                                                                                                  • documented in doc/NSD-4-features. Change configuration without restart, direct nameserver control with nsd-control, support a higher number of zones. Higher performance (compared to NSD3).
                                                                                                                  • nsdc is gone. Use kill -HUP for reload (also checks if zonefiles have changed and rereads them), and kill -TERM for quit. Or use nsd-control for detailed control.
                                                                                                                  • cron job for nsdcpatch is gone. nsd-control write creates zonefiles.
                                                                                                                  • nsd.db has a new format that compacts itself when it is changed, thus nsdc patch is no longer necessary.
                                                                                                                  • nsd.db is memory mapped, NSD needs (part of) that mmap in ram.
                                                                                                                  • tcp-count can go above 1000; epoll/kqueue support with libevent.
                                                                                                                  • nsd-control reconfig for updates with no restart (zones, keys, ..)
                                                                                                                  • nsd-control-setup to create keys for nsd-control (enable nsd-control with remote-control: yes in nsd.conf).
                                                                                                                        Download: nsd-4.0.0.tar.gz
                                                                                                                        Checksum sha256: 62608a409d0f68c9d8d4595031b9de9130ac02efe39733be5dee40d5a90e991c
                                                                                                                        PGP signature: nsd-4.0.0.tar.gz.asc

                                                                                                                        NSD 3.2.22

                                                                                                                        Jun 14, 2016
                                                                                                                          • Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl. (Same as 4.1.10).
                                                                                                                          • Fix for NSEC3 with zone signed without exact match for empty nonterminals, the answer for that domain gets closest encloser. (Same as 4.1.10).
                                                                                                                              Download: nsd-3.2.22.tar.gz
                                                                                                                              Checksum sha1: 16400f6a6da5ded44a391a6357cbe03f71a43642

                                                                                                                              NSD 3.2.21

                                                                                                                              Mar 10, 2016
                                                                                                                                • Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux. (Same as NSD 4.1.8).
                                                                                                                                • Fix #736: segfault during zone transfer. (Same as NSD 4.1.8).
                                                                                                                                    Download: nsd-3.2.21.tar.gz
                                                                                                                                    Checksum sha1: dea969f8a03a98723489dda68041496ced464cb8

                                                                                                                                    NSD 3.2.20

                                                                                                                                    Dec 10, 2015
                                                                                                                                    • RFC7553 RR Type URI support.
                                                                                                                                    • Fix that formerrors are ratelimited (like in NSD 4.1.3).
                                                                                                                                    • Fix NSID response for short edns sizes (same as NSD 4.1.4).
                                                                                                                                    • Fix that for expired zones NSD performs an AXFR and accepts newer and older serial numbers (like in NSD 4.1.4).
                                                                                                                                    • Fix assertion failure and fail to start when loading a zone with a spurious DS record at the apex.
                                                                                                                                    • Fix #701: Fix that AD=1 set in a BADVERS response (like NSD 4.1.6).
                                                                                                                                    • Fix #721: Fix wrong error code (FORMERR) returned for unknown opcode. NOTIMP expected. (like NSD 4.1.7)
                                                                                                                                    • Spelling fix in nsd.conf man page.
                                                                                                                                        Download: nsd-3.2.20.tar.gz
                                                                                                                                        Checksum sha1: 560c9341c25b2a5d440c44c612249abe86aaf69e

                                                                                                                                        NSD 3.2.19

                                                                                                                                        May 28, 2015
                                                                                                                                        • Synthesize CNAMEs with same TTL as DNAME.
                                                                                                                                        • RFC 7344: CDS and CDNSKEY (read in).
                                                                                                                                        • hmac sha224, sha384 and sha512 support, patch from David Gwynne.
                                                                                                                                        • max-interfaces raised to 32.
                                                                                                                                        • Fix endian.h include for OpenBSD.
                                                                                                                                        • Fix per-zone query class statistics.
                                                                                                                                        • Fixes for wildcard addition and deletion.
                                                                                                                                        • Fixes to zonec origin and b64 read (like in NSD 4.1.2).
                                                                                                                                        • Fix tcp waiting list for zone transfers where the bind and connect calls fail. (like in NSD 4.1.2)
                                                                                                                                        • Removed compiler warnings from lex about unput and input functions.
                                                                                                                                            Download: nsd-3.2.19.tar.gz
                                                                                                                                            Checksum sha1: cb3edd13485e836ce5816604b564cf7f6526d531

                                                                                                                                            NSD 3.2.18

                                                                                                                                            Jul 28, 2014
                                                                                                                                            • NSID can be set with "ascii_somestring" in ascii.
                                                                                                                                            • Return REFUSED for queries to non-hosted zones.
                                                                                                                                            • Optimised zone file parse code and zonefile write code.
                                                                                                                                            • Fix #551: Change Regent to Copyright holder in the LICENSE, to match the definition on opensource.org for the BSD License.
                                                                                                                                            • Fix #553: Improve TXT parsing.
                                                                                                                                            • Fix #580: nsd-patch will attempt to create directories if the base directory of the zonefile does not exist.
                                                                                                                                            • Fix #587: Default value for statistics is 0.
                                                                                                                                            • Fix #590: rrl log does not print wildcard as a star but escaped.
                                                                                                                                            • Fix #591: rrl log messages at verbosity level 1.
                                                                                                                                            • Fix RCODE when secondary NSD got transfer that includes deleted wildcard record. After deletion, NSD would serve NODATA, should be NXDOMAIN (thanks Michal Kepien).
                                                                                                                                                Download: nsd-3.2.18.tar.gz
                                                                                                                                                Checksum sha1: a079f61eead43a61537970956fbd22ca4b83bfbf

                                                                                                                                                NSD 3.2.17

                                                                                                                                                Jan 27, 2014
                                                                                                                                                • Support for CAA RR type (RFC6844).
                                                                                                                                                • EUI48 and EUI64 RR types (RFC7043) enabled by default.
                                                                                                                                                • Bugfix #509: USE_ZONE_STATS used initialised memory for statistics data.
                                                                                                                                                • Bugfix #510: USE_ZONE_STATS use a different zone stats file per process.
                                                                                                                                                • Bugfix #542: Match RRSIG TTL with SOA TTL in negative response.
                                                                                                                                                • Removed use of random when arc4random is available. Thus, random and srandom are then not linked with the executable.
                                                                                                                                                • Check if configure in srcdir collides with outofdir build.
                                                                                                                                                    Download: nsd-3.2.17.tar.gz
                                                                                                                                                    Checksum sha1: 099a051129f58dc9446d4683ccd07b40196a51f4

                                                                                                                                                    NSD 3.2.16

                                                                                                                                                    Jul 22, 2013
                                                                                                                                                    • New config option "ip-transparent:" to allow NSD to bind to non local addresses. Default no.
                                                                                                                                                    • Use IPV6 minimum MTU settings with TCP to reduce failures that are caused by delays in learning working PMTU when communicating through a tunnel.
                                                                                                                                                    • Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental, turned off by default. Enable with --enable-draft-rrtypes.
                                                                                                                                                    • New config option "rrl-slip:" to set the average number of packets discarded before we send back a truncated response.
                                                                                                                                                    • New config option "rrl-ipv4-prefix-length:" and "rrl-ipv6-prefix-length:" to set the prefix lengths.
                                                                                                                                                    • Improved RRL logging, also print triggering query src address and QTYPE.
                                                                                                                                                    • Provide RRL documentation in nsd.conf.sample.
                                                                                                                                                    • Bugfix #357: Parent process waits until children closed down sockets, to prevent NSD failing to bind to sockets when restarting.
                                                                                                                                                    • Bugfix #487: lookup3.c determine endianness for BSD systems.
                                                                                                                                                    • Bugfix #491: pick program name (0th argument) as syslog identity.
                                                                                                                                                    • Bugfix #494: Exit with return code 1 if socket code fails.
                                                                                                                                                    • Bugfix #495: Wrong bufsize in dname_to_string for root.
                                                                                                                                                    • Fix outgoing-interface: Don't fail if family is IPv6 but only IPv4 outgoing-interface is set, or vice versa.
                                                                                                                                                    • RRtypes ASFDB, RP, RT should not compress dnames.
                                                                                                                                                    • Check that zone directory is within chroot directory.
                                                                                                                                                    • Better XFR checking, fallback to AXFR (if allowed) if three malformed XFR packets have been seen.
                                                                                                                                                        Download: nsd-3.2.16.tar.gz
                                                                                                                                                        Checksum sha1: cb95efa819902799365691a0a7ddb3690a97df88

                                                                                                                                                        NSD 3.2.15

                                                                                                                                                        Feb 4, 2013
                                                                                                                                                        • Support for ILNP RR types: NID, L32, L64, LP (RFC6742).
                                                                                                                                                        • RRL, --enable-ratelimit at configure time and config options.
                                                                                                                                                        • TSIG initialization only fails when there is no digest found at all.
                                                                                                                                                        • Bugfix #478: Declaration after statement (for gcc 2.95).
                                                                                                                                                        • Bugfix #483: Better error message in case of TSIG error.
                                                                                                                                                        • Bugfix #485: TTL should not be greater than 2^31 - 1.
                                                                                                                                                        • Fix RCODE when CNAME loop final answer does not exist, should return NXDOMAIN as stated by RFC 6604.
                                                                                                                                                        • Fix --disable-full-prehash bug, where after multiple incoming IXFRs, NSEC3 can be removed unjustified.
                                                                                                                                                            Download: nsd-3.2.15.tar.gz
                                                                                                                                                            Checksum sha1: e31a81ab7877422b34e1f163f9509cd93f395664

                                                                                                                                                            NSD 3.2.14

                                                                                                                                                            Nov 1, 2012
                                                                                                                                                            • TCP writev support.
                                                                                                                                                            • Fix build on OpenBSD (thanks Oliver Peter).
                                                                                                                                                            • Prioritize notify sender for requesting XFR (thanks Ilya Bakulin).
                                                                                                                                                            • Fix crash in zonec if TXT string too long (thanks Ilya Bakulin).
                                                                                                                                                            • tzset before chroot for correct timezone (thanks Camiel Dobbelaar).
                                                                                                                                                            • Fix --disable-full-prehash bug when nsdc patch happens while ixfr too, it did not rehash the new database.
                                                                                                                                                            • Bugfix #464: Conditionally define MAXHOSTNAMELEN.
                                                                                                                                                                Download: nsd-3.2.14.tar.gz
                                                                                                                                                                Checksum sha1: 78390145ec392b520d88c19fc99c544dd1426959

                                                                                                                                                                NSD 3.2.13

                                                                                                                                                                Jul 27, 2012
                                                                                                                                                                  • Bugfix #461 (VU#517036 CVE-2012-2979): NSD denial of service vulnerability from DNS packet when using --enable-zone-stats.
                                                                                                                                                                  • Bugfix #460: man page correction - identity.
                                                                                                                                                                  • Fix for nsd-patch segfault if zone has been removed from nsd.conf (thanks Ilya Bakulin).
                                                                                                                                                                      Download: nsd-3.2.13.tar.gz
                                                                                                                                                                      Checksum sha1: 2cb44f75e9686fd73c7ee9765857a36a8fe5bca9

                                                                                                                                                                      NSD 3.2.12

                                                                                                                                                                      Jul 19, 2012
                                                                                                                                                                        • Fix for VU#624931 CVE-2012-2978: NSD denial of service vulnerability from non-standard DNS packet from any host on the internet.
                                                                                                                                                                            Download: nsd-3.2.12.tar.gz
                                                                                                                                                                            Checksum sha1: dd8606a05525f6a493dfacb7ddfa7e1fa3c6a85b

                                                                                                                                                                            NSD 3.2.11

                                                                                                                                                                            Jul 9, 2012
                                                                                                                                                                            • Fallback to AXFR if IXFR is unknown at the primary. NSD considers IXFR unknown at the primary if there is a negative response for the IXFR RRtype. This does not override the value for 'allow-axfr-fallback'.
                                                                                                                                                                            • Allow for reading in new DNSKEY algorithm mnemonics (RFC5155, RFC5702, RFC5933, and RFC6605 (ECDSA)).
                                                                                                                                                                            • Zone statistics, enable with --enable-zone-stats. This stores the BIND8 stats per zone in a configurable statistics file. This option does not scale and should therefore not be enabled when serving many zones.
                                                                                                                                                                            • Support for TLSA RRtype (DANE).
                                                                                                                                                                            • Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't add the wildcard domain NSEC into the answer section. Instead, put the wildcard expanded NSEC into the answer section and keep the wildcard domain NSEC in the authority section.
                                                                                                                                                                            • Fix for accept spinning reported by OpenBSD.
                                                                                                                                                                            • Fix restart failed due to bad ixfr packet because of zone removed from nsd.conf.
                                                                                                                                                                            • Bugfix #453: typo in nsdc man page.
                                                                                                                                                                              Operational notes
                                                                                                                                                                              • NSD uses the query name for dname compression again (Fix #235 had as side effect that this didn't happen anymore and is hereby undone).
                                                                                                                                                                              Download: nsd-3.2.11.tar.gz
                                                                                                                                                                              Checksum sha1: 4b8b9293fd13b0fba2a2bff9fd11940e0d8d7448

                                                                                                                                                                              NSD 3.2.10

                                                                                                                                                                              Feb 15, 2012
                                                                                                                                                                                • Bugfix #421: Truncate pidfile on shutdown, before unlink.
                                                                                                                                                                                • Bugfix #423: Fix slow zone transfer processing due to 'Fix is_existing flag for ENT' bugfix.
                                                                                                                                                                                • Bugfix #430: Fix segfault when MAX_INTERFACES set to more than 65K.
                                                                                                                                                                                • Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs.m4 update
                                                                                                                                                                                    Download: nsd-3.2.10.tar.gz
                                                                                                                                                                                    Checksum sha1: 04657cffe5087d97213b245f8281296cac86b868

                                                                                                                                                                                    NSD 3.2.9

                                                                                                                                                                                    Nov 23, 2011
                                                                                                                                                                                    • Minimize responses to reduce truncation: NSD will only add optional records to the authority and additional sections when the response size does not exceed the minimal response size.

                                                                                                                                                                                      The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4), 1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is smaller than the EDNS default.

                                                                                                                                                                                      The feature is enabled by default. You can disable it by configuring NSD with --disable-minimal-responses.

                                                                                                                                                                                    • Less NSEC3 prehashing. This will make NSD handle zone transfers faster, but will decrease the performance of NXDOMAIN and wildcard NODATA responses. Full prehashing is enabled by default. If you want less NSEC3 prehashing, configure NSD with --disable-full-prehash. Thanks Secure64 for the patch.
                                                                                                                                                                                    • Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone.
                                                                                                                                                                                    • Bugfix #365: set patch style and zonec verbose for nsdc.
                                                                                                                                                                                    • First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC.
                                                                                                                                                                                    • Bugfix #375: typos in nsd.conf.5.
                                                                                                                                                                                    • Bugfix #381: Binary escaped and transfers.
                                                                                                                                                                                    • Bugfix #397: Don't allow relative domain names as origin in $INCLUDE directives.
                                                                                                                                                                                    • Fix printout of IPSECKEY by nsd-patch.
                                                                                                                                                                                    • Fix is_existing flag for ENT when domain that has a shared ENT is deleted by IXFR. (ENT == Empty Non-Terminal)
                                                                                                                                                                                    • Fix bug if the zonefile is changed for a secondary but stored transfers are applied, and stop it from applying ixfr to empty zone. The zone is flagged with error and AXFR-ed.
                                                                                                                                                                                    • Fix to have no authority NS set processing for CNAMEs.
                                                                                                                                                                                    • Fix nsd-checkconf to check tsig algorithms properly.
                                                                                                                                                                                    • Set the AA bit on responses that have an authoritative CNAME.
                                                                                                                                                                                    • Fix denial of existence response for empty non-terminal that looks like a NSEC3-only domain (but has data below it).
                                                                                                                                                                                      Operational notes
                                                                                                                                                                                      • nsd.db version number increased because NSD 3.2.7 and earlier zonec is not compatible due to the TXT strings change. Please run nsdc rebuild before running NSD 3.2.9 and later versions.
                                                                                                                                                                                      Download: nsd-3.2.9.tar.gz
                                                                                                                                                                                      Checksum sha1: 66e17e5801e94da1a21f0f2a4dd7a4ab4ffe0dd9

                                                                                                                                                                                      NSD 3.2.8

                                                                                                                                                                                      Mar 22, 2011
                                                                                                                                                                                        • Do setusercontext before chroot, otherwise login.conf etc. are required inside chroot.
                                                                                                                                                                                        • Bugfix #216: Fix leak of compressiontable when the domain table increases in size.
                                                                                                                                                                                        • Bugfix #348: Don't include header/library path if OpenSSL is in /usr.
                                                                                                                                                                                        • Bugfix #350: Refused notifies should log client ip.
                                                                                                                                                                                        • Bugfix #352: Fix hard coded paths in man pages.
                                                                                                                                                                                        • Bugfix #354: The realclean target deletes a bit too much.
                                                                                                                                                                                        • Bugfix #357, make xfrd quit with many zones.
                                                                                                                                                                                        • Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious warning messages.
                                                                                                                                                                                        • Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok.
                                                                                                                                                                                        • Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY.
                                                                                                                                                                                        • Undo Bugfix #235: Don't skip dname compression, messes up packets that do need compression.
                                                                                                                                                                                          Operational notes
                                                                                                                                                                                          • Use 'make clean' to clean up files that make created.
                                                                                                                                                                                          • Use 'make realclean' to also clean up files that were generated by running ./configure.
                                                                                                                                                                                          • Use 'make devclean' to also clean up autoconf, autoheader files.
                                                                                                                                                                                          Download: nsd-3.2.8.tar.gz
                                                                                                                                                                                          Checksum sha1: e8db690a09f53152f0dca6e4fbfabcc89003fced

                                                                                                                                                                                          NSD 3.2.7

                                                                                                                                                                                          Jan 24, 2011
                                                                                                                                                                                            • Bugfix #253: Don't put NS RRs in a response with QTYPE=DS.
                                                                                                                                                                                            • Bugfix #320: use arcrandom(4) for QID generation if available.
                                                                                                                                                                                            • Bugfix #328: nsd-checkconf overrun.
                                                                                                                                                                                            • Bugfix #343: nsdc update fix.
                                                                                                                                                                                            • Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation.
                                                                                                                                                                                            • Bugfix: Allow for huge amount of strings in TXT (and other) records.
                                                                                                                                                                                            • Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5.
                                                                                                                                                                                            • Fixed several parts in the documentation, including #306, #345.
                                                                                                                                                                                                Download: nsd-3.2.7.tar.gz
                                                                                                                                                                                                Checksum sha1: 1fc4af1831f64b76e1dc5c82b353770f9186de15

                                                                                                                                                                                                NSD 3.2.6

                                                                                                                                                                                                Aug 2, 2010
                                                                                                                                                                                                • Expand command line option '-a' and config option 'ip-address:' with port number.
                                                                                                                                                                                                • Bugfix #314: correctly print NSEC next field, escape spaces and fix label overflows.
                                                                                                                                                                                                  Operational notes
                                                                                                                                                                                                  • Configure options --disable-dnssec, --disable-nsid, --disable-tsig are removed.
                                                                                                                                                                                                  • Configure option --max-interfaces is renamed to --max-ips.
                                                                                                                                                                                                  Download: nsd-3.2.6.tar.gz
                                                                                                                                                                                                  Checksum sha1: 7857df4c34a10f63c8100ae806f12f6035397773

                                                                                                                                                                                                  NSD 3.2.5

                                                                                                                                                                                                  Apr 14, 2010
                                                                                                                                                                                                  • New option 'nsid:', to specify the NSID (Bugfix #298).
                                                                                                                                                                                                  • The default chroot can be set with --with-chroot=dir. If not set, by default chroot will not be used (thanks Jakob Schlyter).
                                                                                                                                                                                                  • Optimized zonec and b64_pton compatibility code (thanks Martin Svec).
                                                                                                                                                                                                  • Optimized memory allocations. Use mmap/munmap instead of malloc/free. Experimental, by default off. Enable it at build time with --enable-mmap (thanks Martin Svec).
                                                                                                                                                                                                  • NSD will not start if chroot is configured, but changing root is not possible (it used to ignore the badly configured chroot).
                                                                                                                                                                                                  • Make use of the more secure strl* functions.
                                                                                                                                                                                                  • Bugfix #303: spelling error.
                                                                                                                                                                                                    Operational notes
                                                                                                                                                                                                    • NSID support is now enabled by default.
                                                                                                                                                                                                    Download: nsd-3.2.5.tar.gz
                                                                                                                                                                                                    Checksum sha1: 90678506145a7a4cf62fbb266013abb8ad464484

                                                                                                                                                                                                    NSD 3.2.4

                                                                                                                                                                                                    Jan 6, 2010
                                                                                                                                                                                                    • Support DLV records.
                                                                                                                                                                                                    • New option 'tcp-query-count:', to limit the maximum number of DNS queries on a single tcp connection.
                                                                                                                                                                                                    • New option 'tcp-timeout:', to override the default tcp timeout. The option can also be set at build time, --with-tcp-timeout.
                                                                                                                                                                                                    • New option 'notify-retry:', to configure how many times NSD should retry a NOTIFY message.
                                                                                                                                                                                                    • New options 'ipv4-edns-size:' and 'ipv6-edns-size:', to set your preferred EDNS buffer size.
                                                                                                                                                                                                    • Bugfix #269: Additional c99 syntax.
                                                                                                                                                                                                    • Bugfix #276: Zonec prints debug data to stderr.
                                                                                                                                                                                                    • Bugfix #286: Document verbosity levels in nsd.conf manual page.
                                                                                                                                                                                                    • Bugfix #288: Ignore SIGHUP to child processes.
                                                                                                                                                                                                    • Fix typo in include file for setusercontext.
                                                                                                                                                                                                      Operational notes
                                                                                                                                                                                                      • UDP/IPv4 sockets have new options set that will disable the DF flag in IP packets.
                                                                                                                                                                                                      Download: nsd-3.2.4.tar.gz
                                                                                                                                                                                                      Checksum sha1: ca94d6c1e53c3ff9d46d3fc7ca56d43590a91a8f

                                                                                                                                                                                                      NSD 3.2.3

                                                                                                                                                                                                      Aug 17, 2009
                                                                                                                                                                                                        • Bug #236: Allow RRs before the SOA in a zonefile.
                                                                                                                                                                                                        • Bug #229: Remove the C99 code.
                                                                                                                                                                                                        • Bug #253: Don't put NS RRs in a response with QTYPE=DNSKEY.
                                                                                                                                                                                                        • Bug #263: Make TSIG algorithm comparison case insensitive.
                                                                                                                                                                                                        • Bug #266: Build failed on systems without strptime.
                                                                                                                                                                                                        • Fix install hickup.
                                                                                                                                                                                                        • Fix to use 4096 EDNS limit for IPv6 on Linux.
                                                                                                                                                                                                            Download: nsd-3.2.3.tar.gz
                                                                                                                                                                                                            Checksum sha1: 2afcc6e1086eef7f5e538c7d837f628f83a19a86

                                                                                                                                                                                                            NSD 3.2.2

                                                                                                                                                                                                            May 18, 2009
                                                                                                                                                                                                              • Off-by-one buffer overflow fix while processing the QUESTION section.
                                                                                                                                                                                                              • Return BADVERS when NSD does not implement the VERSION level of the request, instead of 0x1FORMERR.
                                                                                                                                                                                                              • Bugfix #234.
                                                                                                                                                                                                              • Bugfix #235.
                                                                                                                                                                                                              • Reset 'error occurred' after notifying an error occurred at the $TTL or $ORIGIN directive (Otherwise, the whole zone is skipped because the error is reset after reading the SOA).
                                                                                                                                                                                                              • Minor bugfixes.
                                                                                                                                                                                                                  Download: nsd-3.2.2.tar.gz
                                                                                                                                                                                                                  Checksum sha1: 23fc0be5d447ea852acd49f64743c96403a091fa

                                                                                                                                                                                                                  NSD 3.2.1

                                                                                                                                                                                                                  Jan 19, 2009
                                                                                                                                                                                                                  • New configuration option 'allow-afxr-fallback', "yes" by default. If set to "no", NSD will never do AXFR fallback, even if the master does not support IXFR.
                                                                                                                                                                                                                  • Allow file rotation on nsd.log.
                                                                                                                                                                                                                  • The new nsd-patch options -s and -o allows you to skip writing zonefiles and store the output directly to a database file, respectively.
                                                                                                                                                                                                                  • When configuring, don't do strptime test when cross-compiling.
                                                                                                                                                                                                                  • Bug #230: Output non-error messages to stdout.
                                                                                                                                                                                                                  • Better error message when ixfr.db old file format is read.
                                                                                                                                                                                                                  • Bug #218: shared UDP query for all interfaces.
                                                                                                                                                                                                                  • Bug #222: Remove bashism from nsdc script.
                                                                                                                                                                                                                  • Nicer check for SHA-256 functionality.
                                                                                                                                                                                                                  • Fixed some minor memory leaks that occured on reload.
                                                                                                                                                                                                                  • nsdc: check if a lockfile has not gone stale, when lock failed.
                                                                                                                                                                                                                  • Bugfix strptime compatibility function.
                                                                                                                                                                                                                    Operational notes
                                                                                                                                                                                                                    • NSD will now fallback to AXFR, only if the master does not support IXFR.
                                                                                                                                                                                                                    • You can adjust nsdc patch to skip textfile patching. This will increase the patching process, but will not output to zonefiles anymore. By default, this is turned off.
                                                                                                                                                                                                                    Download: nsd-3.2.1.tar.gz
                                                                                                                                                                                                                    Checksum sha1: 2829d8f00dc9a6f13178efb80c21566f95db132a

                                                                                                                                                                                                                    NSD 3.2.0

                                                                                                                                                                                                                    Nov 10, 2008
                                                                                                                                                                                                                    • AXFR/TCP fallback in case of failing IXFR zone transfers.
                                                                                                                                                                                                                    • RFC 4635: support for hmac-sha1 and hmac-sha256 TSIG algorithm identifiers, "Bugfix #130".
                                                                                                                                                                                                                    • Configure the source ip-address for notifies (master) and zone requests (slave) in nsd.conf, "Bugfix #148".
                                                                                                                                                                                                                    • nsd-notify and nsd-xfer allow you to configure the outgoing hostname and source port, in addition to the source address.
                                                                                                                                                                                                                    • Additional debug and verbose log messages.
                                                                                                                                                                                                                    • Only normalize dnames in rdatas when rrtype is listed in RFC 4034, section 6.2: Canonical RR Form, following draft-ietf-dnsext-dnssec-bis-updates (affects RRSIG and NSEC records).
                                                                                                                                                                                                                    • Typo in zonec manpage.
                                                                                                                                                                                                                    • Bugfix in log_finalize.
                                                                                                                                                                                                                    • Fix race condition between nsdc patch and server reload.
                                                                                                                                                                                                                      Operational notes
                                                                                                                                                                                                                      • IMPORTANT: Format of ixfr.db has changed. When you are planning an upgrade to the new NSD release, make sure to process the old ixfr.db before starting the new release (by running nsdc patch).
                                                                                                                                                                                                                      • IXFR is transmitted over TCP by default instead of UDP. If you want to continue the use of IXFR/UDP, please modify your zone configuration file to: request-xfr: UDP tsigkey
                                                                                                                                                                                                                      • We strongly recommend to enable TSIG if you send IXFR over UDP. When all masters fail to transmit IXFR/UDP, slave will fallback to IXFR/TCP and eventually AXFR/TCP.
                                                                                                                                                                                                                      • nsd-patch prints errors to stderr instead of stdout.
                                                                                                                                                                                                                      Download: nsd-3.2.0.tar.gz
                                                                                                                                                                                                                      Checksum sha1: 7cc37fdd10f4ad78ed58d4e1a304a4496ebaefe7

                                                                                                                                                                                                                      NSD 3.1.1

                                                                                                                                                                                                                      Jul 21, 2008
                                                                                                                                                                                                                      • The number of maximum interfaces allowed is configurable with --with-max_interfaces (thanks John Lightsey).
                                                                                                                                                                                                                      • Try to avoid race conditions when NSD reloads and nsdc signals NSD: Update the pidfile before exiting the old server.
                                                                                                                                                                                                                      • Fixed memory leak when NSEC3 enabled but not needed.
                                                                                                                                                                                                                      • Added region destroys when erroring during zone transfers.
                                                                                                                                                                                                                      • Bugfix #191: nsd-checkconf allowed (max_interfaces-1) interfaces.
                                                                                                                                                                                                                          Download: nsd-3.1.1.tar.gz
                                                                                                                                                                                                                          Checksum sha1: 5d175e2514294dba1336ab0e5421f68076af278f

                                                                                                                                                                                                                          NSD 3.1.0

                                                                                                                                                                                                                          June 23, 2008
                                                                                                                                                                                                                          • NSD is now NSEC3 enabled by default. You can disable it by configuring NSD with --disable-nsec3.
                                                                                                                                                                                                                          • Added "hide-version" configuration setting, to stop NSD from answering CHAOS class version requests.
                                                                                                                                                                                                                          • Added bind2nsd 0.5.0 in contrib/.
                                                                                                                                                                                                                          • Report source and zone for denied AXFR attempts.
                                                                                                                                                                                                                          • Bug #172: Zone compiler gives more sane error messages.
                                                                                                                                                                                                                          • Manual pages are in mansun format now, which is more portable.
                                                                                                                                                                                                                          • Log tcp read error only when connection not reset by peer or when verbosity level >= 2.
                                                                                                                                                                                                                          • RRs are compared without checking TTL value.
                                                                                                                                                                                                                            Operational notes
                                                                                                                                                                                                                            • Default locations of nsd.db, ixfr.db, xfrd.state are changed to /var/db/nsd.
                                                                                                                                                                                                                            Download: nsd-3.1.0.tar.gz
                                                                                                                                                                                                                            Checksum sha1: 4cf8dea9fcdd2e0f7a5ab8b8a7399e3ebd533cf4

                                                                                                                                                                                                                            NSD 3.0.8

                                                                                                                                                                                                                            April 18, 2008
                                                                                                                                                                                                                            • Better logging for nsd-notify (show 'broken' zone)
                                                                                                                                                                                                                            • Bug #164: Add configuration for chkconfig to control nsd service
                                                                                                                                                                                                                            • Better logging when creating database failed.
                                                                                                                                                                                                                            • Fixed nsdc start when nsd already running: do not initialize server, since it is already running.
                                                                                                                                                                                                                            • Bug #163: Fixup bug where data related files are looked up in the wrong directory when chrooted with chrootdir ending with a slash.
                                                                                                                                                                                                                            • Bug #157: Fixup bug where nsd would return FORMERR if received an edns query with version set to zero and rdlen larger than zero.
                                                                                                                                                                                                                            • Fixed strptime, so that zonec will also work on systems with broken strptime (like leopard :-)).
                                                                                                                                                                                                                            • Do not answer nsec3 wildcard information when DO bit is not set.
                                                                                                                                                                                                                            • Various spelling errors.
                                                                                                                                                                                                                                Download: nsd-3.0.8.tar.gz
                                                                                                                                                                                                                                Checksum sha1: a5af4f406219636934dfd16810ba9c112412680e

                                                                                                                                                                                                                                NSD 3.0.7

                                                                                                                                                                                                                                November 13th, 2007
                                                                                                                                                                                                                                  • Error handling for malformed IXFRs improved.
                                                                                                                                                                                                                                  • Bug #162 and #156: Fixed man pages, consistent syntax.
                                                                                                                                                                                                                                      Download: nsd-3.0.7.tar.gz
                                                                                                                                                                                                                                      Checksum sha1: c4038c017e270a4b0012dcaf47c67593f34ddde8

                                                                                                                                                                                                                                      NSD 3.0.6

                                                                                                                                                                                                                                      August 7th, 2007
                                                                                                                                                                                                                                      • Report source and zone for denied AXFR attempts.
                                                                                                                                                                                                                                      • More elegant handling of malformed nsec3 records from a zone transfer.
                                                                                                                                                                                                                                      • Fixup ignored return value in region-allocator.
                                                                                                                                                                                                                                      • Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/.
                                                                                                                                                                                                                                          Download: nsd-3.0.6.tar.gz
                                                                                                                                                                                                                                          Checksum sha1: d285cc1f81f61b9ee6272473f7a526593623e86e

                                                                                                                                                                                                                                          NSD 3.0.5

                                                                                                                                                                                                                                          March 20th, 2007
                                                                                                                                                                                                                                            • Fixed problem with reload waiting very long. If the OS has a raging herd problem, NSD could block in a UDP operation and that process would stop reload from finishing. Made UDP sockets nonblocking.
                                                                                                                                                                                                                                            • Made TCP listen sockets nonblocking. NSD could block in accept.
                                                                                                                                                                                                                                            • Handle the new CERT RDATA types defined in RFC 4398 (submitted by Mans Nilsson).
                                                                                                                                                                                                                                            • Fixed a bug where zonec would choke on unknown CERT RDATA types.
                                                                                                                                                                                                                                            • Change nsd-notify retry timer from linear into exponential backoff (submitted by Mans Nilsson).
                                                                                                                                                                                                                                            • Debug flag (-d) behavior changed. Nsd now also forks children when run in debug mode.
                                                                                                                                                                                                                                            • Added verbosity mode (-V <level>) for extra operational logging.
                                                                                                                                                                                                                                            • zonesdir default is /etc/nsd. This can be overridden in nsd.conf.
                                                                                                                                                                                                                                            • if clients drop the tcp connection this does not result in a logfile entry, unless verbosity is set 2 or more.
                                                                                                                                                                                                                                                Download: nsd-3.0.5.tar.gz
                                                                                                                                                                                                                                                Checksum sha1: e6b433e0017d51b8c3f31897053d6c7718957627

                                                                                                                                                                                                                                                NSD 3.0.4

                                                                                                                                                                                                                                                January 18th, 2007
                                                                                                                                                                                                                                                • Added contrib/nsd.zones2nsd.conf python script to convert NSD 2 to NSD 3 config files, contributed by Stephane Bortzmeyer.
                                                                                                                                                                                                                                                • The nsdc control script will print 'nsd startup failed' if the nsd executable does not start (due to bad permissions, bad config, ...).
                                                                                                                                                                                                                                                • zonec will print an error when other data is put next to a CNAME.
                                                                                                                                                                                                                                                • Fixup unaligned memory access that could occur when reading ixfr.db with a partial transfer inside.
                                                                                                                                                                                                                                                • Fixup for the WKS RR type printout by nsd-patch and nsd-xfer.
                                                                                                                                                                                                                                                • Error message 'could not read database CRC' now only given on error.
                                                                                                                                                                                                                                                • ./configure --zonesdir=<directory for zone files> now works to set a default value for the zonesdir: <dir> nsd.conf directive. Set zonesdir: "" to disable the change of directory.
                                                                                                                                                                                                                                                • Bug: reload crashes with log message 'continuing with old database', and after that no more zone updates. Manual fix is to kill -HUP, but now fixed in software to try to reload again (and again).
                                                                                                                                                                                                                                                • Small speedup where xfrd could briefly be busy-waiting.
                                                                                                                                                                                                                                                • If master sends IXFR with glue that is already present in the zone this is silently accepted. Printed in debug mode -L 2. To make the log file smaller.
                                                                                                                                                                                                                                                • Exponential backoff for zones that never worked to max of 4 hours. For expired zones the SOA retry values are used.
                                                                                                                                                                                                                                                • allow-notify acl entries 'NOKEY' match only queries without TSIG.
                                                                                                                                                                                                                                                • Answers to valid notifies contained wrong RR counts in the header. The notifies were processed correctly, but now the acknowledgement reply is in correct DNS format.
                                                                                                                                                                                                                                                    Download: nsd-3.0.4.tar.gz
                                                                                                                                                                                                                                                    Checksum sha1: e34333450a32d4683216c136218699e7f8c8367d

                                                                                                                                                                                                                                                    NSD 3.0.3

                                                                                                                                                                                                                                                    December 7th, 2006
                                                                                                                                                                                                                                                      • Bug #152: NSD would not use the identity from nsd.conf, fixed.
                                                                                                                                                                                                                                                      • Bug #153: When running with thousands of secondary zones, NSD would run out of UDP sockets. Caused crash on FreeBSD, errors on Linux ('out of file descriptors'), depending on ulimits. Fixed.
                                                                                                                                                                                                                                                      • Fixed getaddrinfo error message to be more descriptive.
                                                                                                                                                                                                                                                      • Fallback to ip4 if getaddrinfo fails for ip6.
                                                                                                                                                                                                                                                      • Will no longer lose a notify message during reloads (IPC).
                                                                                                                                                                                                                                                      • Will no longer lose transfer in progress when notified for that zone.
                                                                                                                                                                                                                                                      • Nicer error when operator forgets to rebuild after deleting a zone.
                                                                                                                                                                                                                                                          Download: nsd-3.0.3.tar.gz
                                                                                                                                                                                                                                                          Checksum sha1: 3321d3826256eff683799dd2706eb92dc1bbff78

                                                                                                                                                                                                                                                          NSD 3.0.2

                                                                                                                                                                                                                                                          November 3rd, 2006
                                                                                                                                                                                                                                                            • Nice error from zonec on a wrong configuration zone name.
                                                                                                                                                                                                                                                            • Nicer warning from zonec when starting secondary zone with no zone file for the first time.
                                                                                                                                                                                                                                                            • nsdc makes more portable use of 'which' (for SunOS5.9/bash2.05).
                                                                                                                                                                                                                                                            • Bug #143: Improved handling of zonesdir: directive and relative pidfile, database, diff file, xfrdfile paths in nsdc.sh and nsd-patch. They would not find the files.
                                                                                                                                                                                                                                                            • Bug #144: LOC RRtype default values for precision wrong. Fixed.
                                                                                                                                                                                                                                                            • Bug #145: NSD failed to reload cases of simultaneous zone transfer.
                                                                                                                                                                                                                                                            • Bug #146: NSD fails to write to xfrdfile when chrooted. Fixed. Also fix for difffile when chrooted.
                                                                                                                                                                                                                                                            • Bug #147: NSD runs out of memory. Fixed, memory is reused. Occurred when running NSD with very big zones and large updates.
                                                                                                                                                                                                                                                            • nsd -L 1 logging is smaller, -L 2 contains all debug information. (only available for debug compiles).
                                                                                                                                                                                                                                                            • Bug #149: Fixed text for NOTAUTH error code. When notify is not authorised REFUSED error code returned instead.
                                                                                                                                                                                                                                                                Download: nsd-3.0.2.tar.gz
                                                                                                                                                                                                                                                                Checksum sha1: 9a141e67e7d60c84aa1169061230c4761ee35608

                                                                                                                                                                                                                                                                NSD 3.0.1

                                                                                                                                                                                                                                                                September 6th, 2006
                                                                                                                                                                                                                                                                  • nsd-patch prints SOA record at start of zone files.
                                                                                                                                                                                                                                                                      Download: nsd-3.0.1.tar.gz
                                                                                                                                                                                                                                                                      Checksum sha1: 37259401e1040ea99540590a9dedc519b48543e1

                                                                                                                                                                                                                                                                      NSD 3.0.0

                                                                                                                                                                                                                                                                      September 5th, 2006
                                                                                                                                                                                                                                                                      • nsd-patch prints SOA record at start of zone files: NSD requests but does not provide IXFR transfers; NSD keeps track of SOA timeouts for secondary zones.
                                                                                                                                                                                                                                                                      • TSIG authentication supported: For queries, for notifies, for zone transfers.
                                                                                                                                                                                                                                                                      • NOTIFY messages of zone updates, incoming and outgoing.
                                                                                                                                                                                                                                                                      • DNAME type is supported, including CNAME synthesis.
                                                                                                                                                                                                                                                                      • config file, nsd.conf(5), place to put TSIG keys, server settings, and lists of ip-addresses/ranges for AXFR/IXFR and NOTIFY.
                                                                                                                                                                                                                                                                      • Prepared for NSEC3 (--enable-nsec3), experimental code for testing in workshops.
                                                                                                                                                                                                                                                                      • Prepared for NSID (--enable-nsid), experimental code for testing in workshops.
                                                                                                                                                                                                                                                                      • Contains all bug fixes from 2.3.5 and before.
                                                                                                                                                                                                                                                                      • The sighandler() bug is fixed more thoroughly, by using pipes for interprocess communication.
                                                                                                                                                                                                                                                                      • CNAMEs are followed by the server to different zones and information from that zone is returned. This saves a followup query.
                                                                                                                                                                                                                                                                      • Bug fixes (ported) 2.3.6: nsd-notify will retry max 15 times 5 second retries; Bug #105: nsdc lacks locking, fixed locking for root user; Bug #134: nsd: make -N <large number> work again; Bug #135: Typo in locking code for nsdc, fixed; uninitialised variable fixed; unaligned memory access (on Solaris SPARC), in zonec LOC parsing, fixed; Bug #138: nsd aborts trying to bind all interfaces if ip6 is not enabled, instead it will fallback to ip4; Bug #139: resync timer for stats to whole minute; Bug #140: NSD did not clear CD bit on authoritative answers; Bug #141: NSD did not clear flags on a formerror reply.
                                                                                                                                                                                                                                                                        Operational notes
                                                                                                                                                                                                                                                                        • config file needed, nsd.conf(5) supersedes nsd.zones and nsdc.conf.
                                                                                                                                                                                                                                                                        • AXFR transfers are denied by default. Allow in config file.
                                                                                                                                                                                                                                                                        • Zones only become secondary with "request-xfr:" items in config file.
                                                                                                                                                                                                                                                                        • NSD produces "ixfr.db" file with a journal of zone transfers. Use nsdc patch to merge changes back to zone files and remake db.
                                                                                                                                                                                                                                                                        • NSD produces "xfrd.state" file with zone timeout information. The file is text formatted.
                                                                                                                                                                                                                                                                        • NSD sends notifies automatically, nsd-notify is deprecated and will be removed from the package.
                                                                                                                                                                                                                                                                        • NSD requests AXFR/IXFR and reloads the updates automatically, nsd-xfer is deprecated and will be removed from the package.
                                                                                                                                                                                                                                                                        • Check your config file with nsd-checkconf.
                                                                                                                                                                                                                                                                        Download: nsd-3.0.0.tar.gz
                                                                                                                                                                                                                                                                        Checksum sha1: 353b388fdd1d5e03fb3a73738b83b617edc06392

                                                                                                                                                                                                                                                                        Tue Sep 27 2016

                                                                                                                                                                                                                                                                        © Stichting NLnet Labs

                                                                                                                                                                                                                                                                        Science Park 400, 1098 XH Amsterdam, The Netherlands

                                                                                                                                                                                                                                                                        labs@nlnetlabs.nl, subsidised by NLnet and SIDN.