Security Fixes:
- Fix crash when reconfiguring zone update policy during active updates.
New Features:
- Add switch to disable cookie checking in delv.
Removed Features:
- Remove -C option from dnssec-keygen and dnssec-keyfromlabel.
- Remove NZF file support in favor of NZD.
Feature Changes:
- Parent-centric resolver.
- Switch to LRU-only cache eviction, enforce minimum cache size.
Bug Fixes:
- Fix intermittent named crashes during asynchronous zone operations.
- Count temporal problems with DNSSEC validation as attempts.
- Fix a possible deadlock in RPZ processing.
- Fix update-policy per-type max quota bypass via crafted UPDATE messages.
- Fix a crash triggered by rndc modzone on a zone from a configuration file.
- Fix the processing of empty catalog zone ACLs.
- Fix potential resource leak during resolver error handling.
Source: https://downloads.isc.org/isc/bind9/9.21.21/doc/arm/html/notes.html#notes-for-bind-9-21-21
Security Fixes:
- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)
New Features:
- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.
Bug Fixes:
- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.
Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20
Allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds
timeout limit on platforms (riscv64,s390x) where it is slow
TODO: find out why it is slow
Security Fixes:
- Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)
New Features:
- Add support for Extended DNS Error 9 (Missing DNSKEY).
- Add support for Extended DNS Error 13 (Cached Error).
- Add support for Generalized DNS Notifications.
Features Changes:
- Add more information to the rndc recursing output about fetches.
- Enforce bounds of multiple configuration options.
Bug Fixes:
- Fix inbound IXFR performance regression.
- Make DNSSEC key rollovers more robust.
- Fix a catalog zone issue, where member zones could fail to load.
- Fix slow speed when signing a large delegation zone with NSEC3 opt-out.
- Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.
- Fix a possible catalog zone issue during reconfiguration.
- Fix the charts in the statistics channel.
https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17
New Features:
- Add +[no]showtruncated and +[no]showallmessages to dig.
Feature Changes:
- Reduce the number of outgoing queries.
- Improve output of rndc dnssec -status
- Change the QNAME minimization algorithm to follow the standard.
- Enforce bounds of prefetch configuration option.
- Enforce the fact that catalog zones cannot be used in non-IN views.
- Provide more information when memory allocation fails.
Bug Fixes:
- Adding NSEC3 opt-out records could leave invalid records in chain.
- Fix spurious timeouts while resolving names.
- Fix bug where zone switches from NSEC3 to NSEC after retransfer.
- Fix caching RRSIG covering cached NODATA record.
- AMTRELAY type 0 presentation format handling was wrong.
- Fix parsing bug in remote-servers with key or TLS.
- Fix allow-recursion/allow-query-cache inheritance.
- Fix DoT reconfigure/reload bug in the resolver.
https://downloads.isc.org/isc/bind9/9.21.16/doc/arm/html/notes.html#notes-for-bind-9-21-16
New features:
- New rndc showconf command.
- named-checkconf -b dumps the built-in configuration.
- named-checkconf -e prints the effective configuration.
- Add support for Extended DNS Error 24 (Invalid Data).
Removed features:
- Remove the tkey-domain statement.
- Remove the tkey-gssapi-credential statement.
Feature changes:
- Minimal Meson version required is 1.3.0.
Bug fixes:
- Skip unsupported algorithms when looking for a signing key.
- Report when a zone reload is already in progress.
- Fix dnssec-keygen key collision checking for KEY RRtype keys.
- dnssec-verify now uses exit code 1 when failing due to illegal options.
- Prevent assertion failures of dig when a server is specified before the -b option.
- Skip buffer allocations if not logging.
https://downloads.isc.org/isc/bind9/9.21.15/doc/arm/html/notes.html#notes-for-bind-9-21-15
Security Fixes:
- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780)
New Features:
- Add dnssec-policy keys configuration check to named-checkconf.
- Add support for synthetic records.
- Support for zone-specific plugins.
- Support for additional tokens in the zone file name template.
Removed Features:
- Remove randomized RRset ordering.
and bug fixes
https://downloads.isc.org/isc/bind9/9.21.14/doc/arm/html/notes.html#notes-for-bind-9-21-14
New Features:
- Add a new option manual-mode to dnssec-policy.
- Add a new option servfail-until-ready to response-policy zones.
- Support for parsing HHIT and BRID records has been added.
Removed Features:
- Deprecate the tkey-gssapi-credential statement.
- Obsolete the “tkey-domain” statement.
Bug Fixes:
- Prevent spurious SERVFAILs for certain 0-TTL resource records.
- Fix unexpected termination if catalog-zones had undefined default-primaries.
https://downloads.isc.org/isc/bind9/9.21.12/doc/arm/html/notes.html#notes-for-bind-9-21-12
Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
New Features:
- Support for parsing DSYNC records has been added.
Feature changes:
- Reword the shut down hung fetch while resolving message.
- Plugin extension in plugin path is now optional.
- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.
And multiple bug fixes.
https://downloads.isc.org/isc/bind9/9.21.11/doc/arm/html/notes.html#notes-for-bind-9-21-11
