mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-05 17:15:31 +00:00
Code Issues Releases Wiki Activity
Files
3abcd7cd8a75b4c4998fe15f47a62b883d0417cf
bind/doc/arm/notes.html
Tinderbox User cac4114e9d regen master
2017-10-12 04:19:20 +00:00

699 lines
29 KiB
HTML
Raw Blame History

<!--
-
- This Source Code Form is subject to the terms of the Mozilla Public
- License, v. 2.0. If a copy of the MPL was not distributed with this
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
<!-- $Id$ -->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title></title>
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article">
<div class="section">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
<a name="id-1.2"></a>Release Notes for BIND Version 9.12.0b1</h2></div></div></div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
<p>
BIND 9.12.0 is a new feature release of BIND, still under development.
This document summarizes new features and functional changes that
have been introduced on this branch. With each development
release leading up to the final BIND 9.12.0 release, this document
will be updated with additional features added and bugs fixed.
</p>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_download"></a>Download</h3></div></div></div>
<p>
The latest versions of BIND 9 software can always be found at
<a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
There you will find additional information about each release,
source code, and pre-compiled versions for Microsoft Windows
operating systems.
</p>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_license"></a>License Change</h3></div></div></div>
<p>
With the release of BIND 9.11.0, ISC changed to the open
source license for BIND from the ISC license to the Mozilla
Public License (MPL 2.0).
</p>
<p>
The MPL-2.0 license requires that if you make changes to
licensed software (e.g. BIND) and distribute them outside
your organization, that you publish those changes under that
same license. It does not require that you publish or disclose
anything other than the changes you made to our software.
</p>
<p>
This requirement will not affect anyone who is using BIND
without redistributing it, nor anyone redistributing it without
changes, therefore this change will be without consequence
for most individuals and organizations who are using BIND.
</p>
<p>
Those unsure whether or not the license change affects their
use of BIND, or who wish to discuss how to comply with the
license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
https://www.isc.org/mission/contact/</a>.
</p>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="win_support"></a>Windows XP No Longer Supported</h3></div></div></div>
<p>
As of BIND 9.11.2, Windows XP is no longer a supported platform for
BIND, and Windows XP binaries are no longer available for download
from ISC.
</p>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<p>
None.
</p>
</li></ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_features"></a>New Features</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
<p>
Many aspects of <span class="command"><strong>named</strong></span> have been modified
to improve query performance, and in particular, performance
for delegation-heavy zones:
</p>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
<li class="listitem">
<p>
The additional cache ("acache") was found not to
significantly improve performance and has been removed;
the <span class="command"><strong>acache-enable</strong></span> and
<span class="command"><strong>acache-cleaning-interval</strong></span> options are now
deprecated.
</p>
</li>
<li class="listitem">
<p>
In place of the acache, <span class="command"><strong>named</strong></span> can now use
a glue cache to speed up retrieval of glue records when sending
delegation responses. Unlike acache, this feature is on by
default; use <span class="command"><strong>glue-cache no;</strong></span> to disable it.
</p>
</li>
<li class="listitem">
<p>
The <span class="command"><strong>additional-from-cache</strong></span>
and <span class="command"><strong>additional-from-auth</strong></span> options have been
deprecated.
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>minimal-responses</strong></span> is now set
to <code class="literal">yes</code> by default.
</p>
</li>
<li class="listitem">
<p>
Several functions have been refactored to improve
performance, including name compression, owner name
case restoration, hashing, and buffers.
</p>
</li>
<li class="listitem">
<p>
When built with default <span class="command"><strong>configure</strong></span> options,
<span class="command"><strong>named</strong></span> no longer fills memory with tag
values when allocating or freeing it. This improves performance,
but makes it more difficult to debug certain memory-related
errors. The default is reversed if building with developer
options. <span class="command"><strong>named -M fill</strong></span> or
<span class="command"><strong>named -M nofill</strong></span> will set the behavior
accordingly regardless of build options.
</p>
</li>
</ul></div>
</li>
<li class="listitem">
<p>
Several areas of code have been refactored for improved
readability, maintainability, and testability:
</p>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
<li class="listitem">
<p>
The <span class="command"><strong>named</strong></span> query logic implemented in
<span class="command"><strong>query_find()</strong></span> has been split into
smaller functions with a context structure to maintain state
between them, and extensive comments have been added.
[RT #43929]
</p>
</li>
<li class="listitem">
<p>
Similarly the iterative query logic implemented in
<span class="command"><strong>resquery_response()</strong></span> function has been
split into smaller functions and comments added. [RT #45362]
</p>
</li>
</ul></div>
</li>
<li class="listitem">
<p>
Code implementing name server query processing has been moved
from <span class="command"><strong>named</strong></span> to an external library,
<span class="command"><strong>libns</strong></span>. This will make it easier to
write unit tests for the code, or to link it into new tools.
[RT #45186]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>named</strong></span> can now synthesize negative responses
(NXDOMAIN, NODATA, or wildcard answers) from cached DNSSEC-verified
records that were returned in negative or wildcard responses from
authoritative servers.
</p>
<p>
This will reduce query loads on authoritative servers for signed
domains: when existing cached records can be used by the resolver
to determine that a name does not exist in the authorittive domain,
no query needs to be sent. Reducing the number of iterative queries
should also improve resolver performance.
</p>
<p>
This behavior is controlled by the new
<code class="filename">named.conf</code> option
<span class="command"><strong>synth-from-dnssec</strong></span>. It is enabled by
default.
</p>
<p>
Note: this currently only works for zones signed using NSEC.
Support for zones signed using NSEC3 (without opt-out) is
planned for the future.
</p>
<p>
Thanks to APNIC for sponsoring this work.
</p>
</li>
<li class="listitem">
<p>
When acting as a recursive resolver, <span class="command"><strong>named</strong></span>
can now continue returning answers whose TTLs have expired
when the authoritative server is under attack and unable to
respond. This is controlled by the
<span class="command"><strong>stale-answer-enable</strong></span>,
<span class="command"><strong>stale-answer-ttl</strong></span> and
<span class="command"><strong>max-stale-ttl</strong></span> options. [RT #44790]
</p>
</li>
<li class="listitem">
<p>
The DNS Response Policy Service (DNSRPS) API, a mechanism to
allow <span class="command"><strong>named</strong></span> to use an external response policy
provider, is now supported. (One example of such a provider is
"FastRPZ" from Farsight Security, Inc.) This allows the same
types of policy filtering as standard RPZ, but can reduce the
workload for <span class="command"><strong>named</strong></span>, particularly when using
large and frequently-updated policy zones. It also enables
<span class="command"><strong>named</strong></span> to share response policy providers
with other DNS implementations such as Unbound.
</p>
<p>
This feature is avaiable if BIND is built with
<span class="command"><strong>configure --enable-dnsrps</strong></span>, if a DNSRPS
provider is installed, and if <span class="command"><strong>dnsrps-enable</strong></span>
is set to "yes" in <code class="filename">named.conf</code>. Standard
built-in RPZ is used otherwise.
</p>
<p>
Thanks to Vernon Schryver and Farsight Security for the
contribution. [RT #43376]
</p>
</li>
<li class="listitem">
<p>
Setting <span class="command"><strong>max-journal-size</strong></span> to
<code class="literal">default</code> limits journal sizes to twice the
size of the zone contents. This can be overridden by setting
<span class="command"><strong>max-journal-size</strong></span> to <code class="literal">unlimited</code>
or to an explicit value up to 2G. Thanks to Tony Finch for
the contribution. [RT #38324]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>dnstap</strong></span> logfiles can now be configured to
automatically roll when they reach a specified size. If
<span class="command"><strong>dnstap-output</strong></span> is configured with mode
<code class="literal">file</code>, then it can take optional
<span class="command"><strong>size</strong></span> and <span class="command"><strong>versions</strong></span>
key-value arguments to set the logfile rolling parameters.
(These have the same semantics as the corresponding
options in a <span class="command"><strong>logging</strong></span> channel statement.)
[RT #44502]
</p>
</li>
<li class="listitem">
<p>
Logging channels and <span class="command"><strong>dnstap-output</strong></span> files can
now be configured with a <span class="command"><strong>suffix</strong></span> option,
set to either <code class="literal">increment</code> or
<code class="literal">timestamp</code>, indicating whether log files
should be given incrementing suffixes when they roll
over (e.g., <code class="filename">logfile.0</code>,
<code class="filename">.1</code>, <code class="filename">.2</code>, etc)
or suffixes indicating the time of the roll. The default
is <code class="literal">increment</code>. [RT #42838]
</p>
</li>
<li class="listitem">
<p>
The <span class="command"><strong>print-time</strong></span> option in the
<span class="command"><strong>logging</strong></span> configuration can now take arguments
<strong class="userinput"><code>local</code></strong>, <strong class="userinput"><code>iso8601</code></strong> or
<strong class="userinput"><code>iso8601-utc</code></strong> to indicate the format in
which the date and time should be logged. For backward
compatibility, <strong class="userinput"><code>yes</code></strong> is a synonym for
<strong class="userinput"><code>local</code></strong>. [RT #42585]
</p>
</li>
<li class="listitem">
<p>
The new <span class="command"><strong>dnssec-cds</strong></span> command generates a new DS
set to place in a parent zone, based on the contents of a child
zone's validated CDS or CDNSKEY records. It can produce a
<code class="filename">dsset</code> file suitable for input to
<span class="command"><strong>dnssec-signzone</strong></span>, or a series of
<span class="command"><strong>nsupdate</strong></span> to update the parent zone via dynamic
DNS. Thanks to Tony Finch for the contribution. [RT #46090]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accepts
command line options <span class="command"><strong>-4</strong></span> and <span class="command"><strong>-6</strong></span>
which force using only IPv4 or only IPv6, respectively. [RT #45632]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>nsec3hash -r</strong></span> ("rdata order") takes arguments
in the same order as they appear in NSEC3 or NSEC3PARAM records.
This makes it easier to generate an NSEC3 hash using values cut
and pasted from an existing record. Thanks to Tony Finch for
the contribution. [RT #45183]
</p>
</li>
<li class="listitem">
<p>
The <span class="command"><strong>new-zones-directory</strong></span> option allows
<span class="command"><strong>named</strong></span> to store configuration parameters
for zones added via <span class="command"><strong>rndc addzone</strong></span> in a
location other than the working directory. Thanks to Petr
Men&#353;<EFBFBD>k of Red Hat for the contribution.
[RT #44853]
</p>
</li>
<li class="listitem">
<p>
The <span class="command"><strong>dnstap-read -x</strong></span> option prints a hex
dump of the wire format DNS message encapsulated in each
<span class="command"><strong>dnstap</strong></span> log entry. [RT #44816]
</p>
</li>
<li class="listitem">
<p>
The <span class="command"><strong>host -A</strong></span> option returns most
records for a name, but omits types RRSIG, NSEC and NSEC3.
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
for EDNS options in addition to numeric values. For example,
an EDNS Client-Subnet option could be sent using
<span class="command"><strong>dig +ednsopt=ecs:...</strong></span>. Thanks to
John Worley of Secure64 for the contribution. [RT #44461]
</p>
</li>
<li class="listitem">
<p>
Added support for the EDNS TCP Keepalive option (RFC 7828);
this allows negotiation of longer-lived TCP sessions
to reduce the overhead of setting up TCP for individual
queries. [RT #42126]
</p>
</li>
<li class="listitem">
<p>
Added support for the EDNS Padding option (RFC 7830),
which obfuscates packet size analysis when DNS queries
are sent over an encrypted channel. [RT #42094]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>rndc</strong></span> commands which refer to zone names
can now reference a zone of type <span class="command"><strong>redirect</strong></span>
by using the special zone name "-redirect". (Previously this
was not possible because <span class="command"><strong>redirect</strong></span> zones
always have the name ".", which can be ambiguous.)
</p>
<p>
In the event you need to manipulate a zone actually
called "-redirect", use a trailing dot: "-redirect."
</p>
<p>
Note: This change does not appply to the
<span class="command"><strong>rndc addzone</strong></span> or
<span class="command"><strong>rndc modzone</strong></span> commands.
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>named-checkconf -l</strong></span> lists the zones found
in <code class="filename">named.conf</code>. [RT #43154]
</p>
</li>
<li class="listitem">
<p>
Query logging now includes the ECS option, if one was
present in the query, in the format
"[ECS <em class="replaceable"><code>address/source/scope</code></em>]".
</p>
</li>
<li class="listitem">
<p>
By default, BIND now uses the random number generation functions
in the cryptographic library (i.e., OpenSSL or a PKCS#11
provider) as a source of high-quality randomness rather than
<code class="filename">/dev/random</code>. This is suitable for virtual
machine environments, which may have limited entropy pools and
lack hardware random number generators.
</p>
<p>
This can be overridden by specifying another entropy source via
the <span class="command"><strong>random-device</strong></span> option in
<code class="filename">named.conf</code>, or via the <span class="command"><strong>-r</strong></span>
command line option. However, for functions requiring full
cryptographic strength, such as DNSSEC key generation, this
<span class="emphasis"><em>cannot</em></span> be overridden. In particular, the
<span class="command"><strong>-r</strong></span> command line option no longer has any
effect on <span class="command"><strong>dnssec-keygen</strong></span>.
</p>
<p>
This can be disabled by building with
<span class="command"><strong>configure --disable-crypto-rand</strong></span>, in which
case <code class="filename">/dev/random</code> will be the default
entropy source. [RT #31459] [RT #46047]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>rndc managed-keys destroy</strong></span> shuts down all
RFC 5011 DNSSEC trust anchor maintenance, and deletes any
existing managed keys database. If immediately followed by
<span class="command"><strong>rndc reconfig</strong></span>, this will reinitialize
key maintenance just as if the server was being started for
the first time.
</p>
<p>
This is intended for testing purposes, but can be used -- with
extreme caution -- as a brute-force repair for unrecoverable
problems with a managed keys database, to jumpstart the key
acquisition process if <code class="filename">bind.keys</code> is updated,
etc. [RT #32456]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>dnssec-signzone -S</strong></span> can now add or remove
synchronization records (CDS and CDNSKEY) based on key metadata
set by the <span class="command"><strong>-Psync</strong></span> and <span class="command"><strong>-Dsync</strong></span>
options to <span class="command"><strong>dnssec-keygen</strong></span>,
<span class="command"><strong>dnssec-settime</strong></span>, etc. [RT #46149]
</p>
</li>
</ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
<p>
BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC
signing algorithms described in RFC 8080. Note, however, that
these algorithms must be supported in OpenSSL;
currently they are only available in the development branch
of OpenSSL at
<a class="link" href="https://github.com/openssl/openssl" target="_top">https://github.com/openssl/openssl</a>.
[RT #44696]
</p>
</li>
<li class="listitem">
<p>
EDNS KEY TAG options are verified and printed.
</p>
</li>
</ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
<p>
The ISC DNSSEC Lookaside Validation (DLV) service has been shut
down; all DLV records in the dlv.isc.org zone have been removed.
References to the service have been removed from BIND documentation.
Lookaside validation is no longer used by default by
<span class="command"><strong>delv</strong></span>. The DLV key has been removed from
<code class="filename">bind.keys</code>. Setting
<span class="command"><strong>dnssec-lookaside</strong></span> set to
<span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
anchor is now a fatal configuration error. [RT #46155]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>named</strong></span> will no longer start or accept
reconfiguration if the working directory (specified by the
<span class="command"><strong>directory</strong></span> option) or the managed-keys
directory (specified by <span class="command"><strong>managed-keys-directory</strong></span>
are not writable by the effective user ID. [RT #46077]
</p>
</li>
<li class="listitem">
<p>
Initializing keys specified in a <span class="command"><strong>managed-keys</strong></span>
statement or by <span class="command"><strong>dnssec-validation auto;</strong></span> are
no longer treated as valid for any use other than validation of
RFC 5011 initialization queries. The effect of this is that
DNSSEC validation will fail if RFC 5011 key maintenance
cannot be initialized: initialization problems will not be
masked, but will be immediately visible. [RT #46077]
</p>
</li>
<li class="listitem">
<p>
Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
updates from any source so long as they were signed by the
locally-generated session key. This has been further restricted;
updates are now only accepted from locally configured addresses.
[RT #45492]
</p>
</li>
<li class="listitem">
<p>
The lightweight resolver daemon and library (<span class="command"><strong>lwresd</strong></span>
and <span class="command"><strong>liblwres</strong></span>) have been removed. [RT #45186]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>dnssec-keygen</strong></span> no longer has default
algorithm settings. It is necessary to explicitly specify the
algorithm on the command line with the <span class="command"><strong>-a</strong></span> option
when generating keys. This may cause errors with existing signing
scripts if they rely on current defaults. The intent is to
reduce the long-term cost of transitioning to newer algorithms in
the event of RSASHA1 being deprecated. [RT #44755]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>dig +sigchase</strong></span> and related options
<span class="command"><strong>+trusted-keys</strong></span> and <span class="command"><strong>+topdown</strong></span>
have been removed. <span class="command"><strong>delv</strong></span> is now the recommended
command for looking up records with DNSSEC validation.
[RT #42793]
</p>
</li>
<li class="listitem">
<p>
The Response Policy Zone (RPZ) implementation has been
substantially refactored: updates to the RPZ summary
database are no longer directly performed by the zone
database but by a separate function that is called when
a policy zone is updated. This improves both performance
and reliability when policy zones receive frequent updates.
Summary database updates can be rate-limited by using the
<span class="command"><strong>min-update-interval</strong></span> option in a
<span class="command"><strong>response-policy</strong></span> statement. [RT #43449]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>dnstap</strong></span> now stores both the local and remote
addresses for all messages, instead of only the remote address.
The default output format for <span class="command"><strong>dnstap-read</strong></span> has
been updated to include these addresses, with the initiating
address first and the responding address second, separated by
"-&gt;" or "&lt;-" to indicate in which direction the message
was sent. [RT #43595]
</p>
</li>
<li class="listitem">
<p>
Expanded and improved the YAML output from
<span class="command"><strong>dnstap-read -y</strong></span>: it now includes packet
size and a detailed breakdown of message contents.
[RT #43622] [RT #43642]
</p>
</li>
<li class="listitem">
<p>
Threads in <span class="command"><strong>named</strong></span> are now set to human-readable
names to assist debugging on operating systems that support that.
Threads will have names such as "isc-timer", "isc-sockmgr",
"isc-worker0001", and so on. This will affect the reporting of
subsidiary thread names in <span class="command"><strong>ps</strong></span> and
<span class="command"><strong>top</strong></span>, but not the main thread. [RT #43234]
</p>
</li>
<li class="listitem">
<p>
If an ACL is specified with an address prefix in which the
prefix length is longer than the address portion (for example,
192.0.2.1/8), it will now be treated as a fatal error during
configuration. [RT #43367]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>dig</strong></span> now warns about .local queries which are
reserved for Multicast DNS. [RT #44783]
</p>
</li>
<li class="listitem">
<p>
The view associated with the query is now logged unless it
it is "_default/IN" or "_dnsclient/IN" when logging DNSSEC
validator messages.
</p>
</li>
<li class="listitem">
<p>
When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
zones to load correctly could leave the system in an inconsistent
state; while generally harmless, this could lead to a crash later
when using <span class="command"><strong>rndc addzone</strong></span>. Reconfiguration changes
are now fully rolled back in the event of failure. [RT #45841]
</p>
</li>
<li class="listitem">
<p>
Fixed a bug that was introduced in an earlier development
release which caused multi-packet AXFR and IXFR messages to fail
validation if not all packets contained TSIG records; this
caused interoperability problems with some other DNS
implementations. [RT #45509]
</p>
</li>
<li class="listitem">
<p>
Multiple <span class="command"><strong>cookie-secret</strong></span> clauses are now
supported. The first <span class="command"><strong>cookie-secret</strong></span> in
<code class="filename">named.conf</code> is used to generate new
server cookies. Any others are used to accept old server
cookies or those generated by other servers using the
matching <span class="command"><strong>cookie-secret</strong></span>.
</p>
</li>
<li class="listitem">
<p>
A new statistics counter has been added to track prefetch
queries. [RT #45847]
</p>
</li>
<li class="listitem">
<p>
The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
<span class="command"><strong>dnssec-dnskey-kskonly</strong></span> option in
<span class="command"><strong>named.conf</strong></span>, which suppress the use of
the ZSK when signing DNSKEY records, now also apply to
CDNSKEY and CDS records. Thanks to Tony Finch for the
contribution. [RT #45689]
</p>
</li>
</ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<p>
The introduction of <span class="command"><strong>libns</strong></span> caused a bug
in which TCP client objects were not recycled after use,
leading to unconstrained memory growth. [RT #46029]
</p>
</li></ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="end_of_life"></a>End of Life</h3></div></div></div>
<p>
The end of life for BIND 9.12 is yet to be determined but
will not be before BIND 9.14.0 has been released for 6 months.
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
</p>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
<p>
Thank you to everyone who assisted us in making this release possible.
If you would like to contribute to ISC to assist us in continuing to
make quality open source software, please visit our donations page at
<a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
</p>
</div>
</div>
</div></body>
</html>
Reference in New Issue View Git Blame Copy Permalink