A coding error in the nxdomain-redirect feature could lead to an assertion failure if the redirection namespace was served from a local authoritative data source such as a local zone or a DLZ instead of via recursive lookup. This flaw is disclosed in CVE-2016-9778. [RT #43837]

named could mishandle authority sections with missing RRSIGs, triggering an assertion failure. This flaw is disclosed in CVE-2016-9444. [RT #43632]

named mishandled some responses where covering RRSIG records were returned without the requested data, resulting in an assertion failure. This flaw is disclosed in CVE-2016-9147. [RT #43548]

named incorrectly tried to cache TKEY records which could trigger an assertion failure when there was a class mismatch. This flaw is disclosed in CVE-2016-9131. [RT #43522]

It was possible to trigger assertions when processing responses containing answers of type DNAME. This flaw is disclosed in CVE-2016-8864. [RT #43465]

Added the ability to specify the maximum number of records permitted in a zone (max-records #;). This provides a mechanism to block overly large zone transfers, which is a potential risk with slave zones from other parties, as described in CVE-2016-6170. [RT #42143]

Added support for the EDNS TCP Keepalive option (RFC 7828); this allows negotiation of longer-lived TCP sessions to reduce the overhead of setting up TCP for individual queries. [RT #42126]

Added support for the EDNS Padding option (RFC 7830), which obfuscates packet size analysis when DNS queries are sent over an encrypted channel. [RT #42094]

The print-time option in the logging configuration can now take arguments local, iso8601 or iso8601-utc to indicate the format in which the date and time should be logged. For backward compatibility, yes is a synonym for local. [RT #42585]

rndc commands which refer to zone names can now reference a zone of type redirect by using the special zone name "-redirect". (Previously this was not possible because redirect zones always have the name ".", which can be ambiguous.)

In the event you need to manipulate a a zone actually called "-redirect", use a trailing dot: "-redirect."

Note: This change does not appply to the rndc addzone or rndc modzone commands.

named-checkconf -l lists the zones found in named.conf. [RT #43154]

Expanded and improved the YAML output from dnstap-read -y: it now includes packet size and a detailed breakdown of message contents. [RT #43622] [RT #43642]

If an ACL is specified with an address prefix in which the prefix length is longer than the address portion (for example, 192.0.2.1/8), it will now be treated as a fatal error during configuration. [RT #43367]

Named could deadlock there were multiple changes to NSEC/NSEC3 parameters for a zone being processed at the same time. [RT #42770]

Named could trigger a assertion when sending notify messages. [RT #44019]

Referencing a nonexistent zone in a response-policy statement could cause an assertion failure during configuration. [RT #43787]

rndc addzone could cause a crash when attempting to add a zone with a type other than master or slave. Such zones are now rejected. [RT #43665]

named could hang when encountering log file names with large apparent gaps in version number (for example, when files exist called "logfile.0", "logfile.1", and "logfile.1482954169"). This is now handled correctly. [RT #38688]

If a zone was updated while named was processing a query for nonexistent data, it could return out-of-sync NSEC3 records causing potential DNSSEC validation failure. [RT #43247]