summaryrefslogtreecommitdiff
path: root/usr.sbin/nsd/doc/RELNOTES
blob: 887636bc16eb057a57eca50cbd1e5ccca8cc3c67 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
NSD RELEASE NOTES

4.6.0
================
FEATURES:
	- Port zone-verification from CreDNS to NSD4.
BUG FIXES:
	- Fix static analyzer reports on ixfrcreate temp file.
	- Fixup wrong ixfrcreate fread return check.

4.5.0
================
FEATURES:
	- Merge PR #209: IXFR out
	  This adds IXFR out functionality to NSD. NSD can copy IXFRs from
	  upstream to downstream clients, or create IXFRs from zonefiles.
	  The options store-ixfr: yes and create-ixfr: yes can be used to
	  turn this on. Default is turned off. The options ixfr-number and
	  ixfr-size can be used to tune the number of IXFR transfers and
	  total data size stored. This is configured per zone, the IXFRs
	  are served to the hosts that are allowed to perform zone transfers.
	  And if TSIG is configured, signed with the same key. The content
	  is stored to file if a zonefile is configured for the zone, in
	  the zonefile.ixfr and zonefile.ixfr.2, .. files. They contain
	  readable text format. The number of IXFRs is num.rixfr in
	  statistics output, also per zone if per zone statistics are enabled.
	  If offline, nsd-checkzone -i can create ixfr files.
	  NSD already supports requesting IXFRs, this addition allows NSD
	  to serve IXFR transfers to clients.
	  NSD stops responding with NOTIMPL to IXFR requests, also for zones
	  that do not have IXFR enabled. The clients gets a full zone reply
	  or a status reply if the serial is up to date.
BUG FIXES:
	- Fix code analyzer zero divide warning.
	- Fix code analyzer large value with assertion.
	- Fix another code analyzer zero divide warning.
	- Fix code analyzer warning about uninitialized temp storage in loop.
	- Fix spelling error in comment in svcbparam_lookup_key.
	- Update cirrus script FreeBSD version.

4.4.0
================
FEATURES:
	- Merge #193: Lower memory usage of the XFRD process by default.
	  Instead of preallocating all elements, they are allocated when used.
	  There are options for managing the memory usage, defaults are the
	  same as before. xfrd-tcp-max sets the number of sockets for tcp
	  connections that xfrd can make to download zone contents. And
	  xfrd-tcp-pipeline the number of simultaneous transfers over the
	  same connection.
BUG FIXES:
	- Fix #200: nsd-checkzone succeeds even with incorrect serial in SOA
	  record.
	- Merge #204 from jonathangray: correct some spelling mistakes.
	- Fix to change file mode before changing file owner for the
	  nsd-control unix socket file.
	- Fix to document nsd-checkzone -p in the man page for nsd-checkzone.
	- Fix #206: build with --without-ssl fails.
	- Merge #207 Sync nsd-control-setup with unbound-control-setup to
	  generate certificates with SANs.
	- Fix unit tests for nds-control-setup exit code and the
	  xfrd-tcp-max default.

4.3.9
================
BUG FIXES:
	- Fix #198: nsd-control reconfig core dump.
	- Fix to remove git tracking and ci information from release tarballs.
	- Fix unit tests for new answer-cookie default.
	- Fix socket_partitioning unit test for FreeBSD.
	- Fix SVCB test to work around older dig with drill.

4.3.8
================
FEATURES:
	- Merge #185 by cesarkuroiwa: Mutual TLS.
	- Set default for answer-cookie to no. Because in server deployments
	  with mixed server software, a default of yes causes issues.
BUG FIXES:
	- Fix to compile with OpenSSL 3.0.0beta2.
	- Fix configure detection of SSL_CTX_set_security_level.
	- Fix deprecated functions use from openssl 3.0.0beta2.
	- For #184: Note that all zones can be targeted by some nsd-control
	  commands in the man page.
	- Fixes for #185: Document client-cert, client-key and client-key-pw
	  in the man page. Fix yacc semicolon. Fix unused variable warning.
	  Use strlcpy instead of strncpy. Fix spelling error in error
	  printout.
	- Merge #187: Support using system-wide crypto policies.
	- Fix #188: NSD fails to build against openssl 1.1 on CentOS 7.
	- Fix sed script in ssldir split handling.
	- Fix #189: nsd 4.3.7 crash answer_delegation: Assertion
	  `query->delegation_rrset' failed.
	- Fix #190: NSD returns 3 NSEC3 records for NODATA response.
	- Fix compile failure with openssl 1.0.2.
	- Fix #194: Incorrect NSEC3 response for SOA query below delegation
	  point.

4.3.7
================
FEATURES:
	- Syntax of SVCB and HTTPS RR type as per draft-ietf-dnsop-svcb-https
	- Client side DNS Zone Transfer-over-TLS (XoT) support as per
	  draft-ietf-dprive-xfr-over-tls
	- Interoperable DNS Cookies support as per RFC7873 and RFC9018
BUG FIXES:
	- Fix for #170: Fix build warnings when IPv6 is disabled.
	- Fix #170: Disabled IPv6 and DNSTAP enabled triggers a build error.
	- Fix for #128: Skip over sendmmsg invalid argument when port is zero.
	- Fix #171: Invalid negative response (NSEC3) after IXFR.
	- Fix to make nsec3_chain_find_prev return NULL if one nsec3 left.
	- Fix #174: NS Records below delegation are not ignored (nsd-checkzone
	  also does not raise any issue).
	- Fix #176: please review Loglevel on missing zonefile.
	- Update the ACX_CHECK_NONBLOCKING_BROKEN test for the configure
	  script.
	- Fix #179: log notice and server-count.
	- Update configure nonblocking test to use host.
	- Fix #168: Buffer overflow in the dname_to_string() function
	- Fixes for child server processes getting out of sync with the
	  dnstap-collector process
	- Fix gcc-11 warning on array bounds.
	- Fix compile of cookies on FreeBSD without IPv6.
	- Fix for loop initial declaration for nonc99 compiler
	- Fix typo in xfrd-tcp.c.

4.3.6
================
FEATURES:
	- Fix #146 with #147: DNSTAP log the local address of the server
	  with the dnstap logs.
	- Enable configuring a control-interface by interface name.
	- A -p option to nsd-checkzone to print a successfully read zone.
	- Add Extended DNS Errors RFC8914
	- Per zone Access Control List for queries
	  with an allow-query: option.
BUG FIXES:
	- Prevent a few more yacc clashes.
	- Merge PR #153 from fobser: Repair -fno-common linker errors
	  automatically.
	- Fix uninitialized access of log_buf in error printout on apply ixfr.
	- Fix AF_LOCAL compile error for Solaris.
	- Fix ifaddrs compile error for Solaris.
	- Fix ifaddrs.h compile error for Solaris.
	- Man page documentation for dnstap options.
	- Fix segfault on high verbosity for TLS channels with dnstap log
	  local address.
	- Fix #163: A TSIG noncompliance with RFC 2845.
	- Fix that wildcard is printed as a star instead of escaped, in
	  logs and in written zone files.
	- Fix double config.h include in configlexer.c
	- Fix to remove configyyrename from makedist.sh and also
	  update the flex and bison rules there to add the "c_" prefix.
	- Fix configure to use header checks with compile.
	- Fix warning about unused function log_addr.
	- Fix #154: TXT with parentheses fails in 4.3.5.
	- Align parsing of TXT elements with how bind does it.
	- Fix configure failure for enable systemd because of autoconf.


4.3.5
================
BUG FIXES:
	- Fix #143: xfrd no hysteresis with NOT IMPLEMENTED rcode.
	- Fix #144: Typo fix in nsd.conf.5.in.
	- For #145: Fix that service of remaining TCP and TLS connections
	  does not allow new queries to be made, the connection is closed.
	  Only existing queries and zone transfers are answered, new ones
	  are rejected by a close of the channel.
	- Fix that nsd-control has timeout when connection is down.
	- remove windows socket ifdefs from nsd-control.
	- Fix #148: CNAME need not be followed after a synthesized CNAME
	  for a CNAME query.
	- Fix configure.ac for autoconf 2.70.
	- Fix #150: TXT record validation difference with BIND.
	- Fix #151: DNAME not applied more than once to resolve the query.
	- Fix #152: '*' in Rdata causes the return code to be NOERROR instead
	  of NX.


4.3.4
================
FEATURES:
	- Merge PR #141: ZONEMD RR type.
BUG FIXES:
	- Fix #129: ambiguous use of errno, in log message if sendmmsg fails.
	- Fix #128: Fix that the invalid port number is logged for sendmmsg
	  failed: Invalid argument.
	- Fix #127: two minor `-Wcast-qual` cleanups
	- Fix #126: minor header hygiene
	- Fix #125: include config.h in compat/setproctitle.c and fix
	  prototype of `setproctitle`
	- Fix #133: fix 0-init of local ( stack ) buffer.
	- Fix missing parenthesis on size of fix to init buffer.
	- Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN.
	- Fix to add missing closest encloser NSEC3 for wildcard nodata type
	  DS answer.
	- Remove unused init_cfg_parse routine from configlexer.
	- Fix #138: NSD returns non-EDNS answer when QUESTION is empty.
	- Fix #142: NODATA answers missin SOA in authority section after
	  CNAME chain.
	- Fix for CVE-2020-28935 : Fix that symlink does not interfere
	  with chown of pidfile.


4.3.3
================
FEATURES:
	- Follow DNS flag day 2020 advice and
	  set default EDNS message size to 1232.
	- Merged PR #113 with fixes.  Instead of listing an IP-address to
	  listen on, an interface name can be specified in nsd.conf, with
	  ip-address: eth0.  The IP-addresses for that interface are then used.
	- Port TSIG code for openssl 3.0.0-alpha6.
BUG FIXES:
	- Fix make install with --with-pidfile="".
	- Merge #115 from millert: Fix strlcpy() usage. From OpenBSD.
	- Merge #117: mini_event.h (4.3.2 and 4.3.1) on OpenBSD cannot find
	  fd_set - patch.
	- Fix that configure checks for EVP_sha256 to detect openssl, because
	  HMAC_CTX_new is deprecated in 3.0.0.
	- Fix #119: fix compile warnings from new gcc.
	- Fix #119: warn when trying to parse a directory.
	- Merge PR #121: Increase log level of recreated database from
	  WARNING to ERR.
	- Remove unused space from LIBS on link line.
	- Updated date in nsd -v output.


4.3.2
================
FEATURES:
	- Fix #96: log-only-syslog: yes sets to only use syslog, fixes
	  that the default configuration and systemd results in duplicate
	  log messages.
	- Fix #107: nsd -v shows configure line, openssl version and libevent version.
	- Fix #103 with #110: min-expire-time option.  To provide a lower
	  bound for expire period.  Expressed in number of seconds or
	  refresh+retry+1.
BUG FIXES:
	- Fix for posix shell syntax for trap in nsd-control-setup
	- Fix to omit the listen-on lines from log at startup, unless verbose.
	- Fix uninitialised values for bindtodevice option at startup with
	  reuseport and multiple interfaces.
	- Fix #95: Removed make test check because tpkg not included in
	  release tarballs.
	- Fix unused parameter compile warnings.
	- Fix #97: EDNS unknown version: query not in response.
	- Fix #99: Fix copying of socket properties with reuseport enabled.
	- Document default value for tcp-timeout.
	- Merge PR#102 from and0x000: add missing default in documentation
	  for drop-updates.
	- Fix unlink of pidfile warning if not possible due to permissions,
	  nsd can display the message at high verbosity levels.
	- Removed contrib/nsd.service, example is too complicated and not
	  useful.
	- Do not log EAGAIN errors for sendmmsg, to stop log spam on OpenBSD.
	- Merge #108 from Nomis: Make the max-retry-time description clearer.
	- Retry when udp send buffer is full to wait until buffer space is
	  available.
	- Remove errno reset behaviour from sendmmsg and recvmmsg
	  replacement functions.
	- Fix unit test for different nsd-control-setup -h exit code.
	- Merge #112 from jaredmauch: log old and new serials when NSD
	  rejects an IXFR due to an old serial number.
	- Fix #106: Adhere better to xfrd bounds.  Refresh and retry times.
	- Fix #105: Clearing hash_tree means just emptying the tree.


4.3.1
================
BUG FIXES:
	- Fix #70: error: 'fd_set' undeclared.
	- Fix #71: error: 'for' loop initial declaration used outside C99
	  mode.
	- Fix to move declarations out of for loops in event test too.
	- Fix #76: cpuid typedef for Hurd, DragonflyBSD compile.
	- Fix #75: configure test for sched_setaffinity, and use
	  cpuset_setaffinity otherwise.  Also test for presence of sysconf.
	- Fix #74: GNU Hurd fix cast from pointer to integer of different size.
	- Fix for #74, #75: cpuset test for header contents and provide code.
	- Fix #78: Fix SO_SETFIB error on FreeBSD.
	- Merge PR #83 from noloader: Fix GNU HURD sched_setaffinity compile.
	- Fix #80: NetBSD and implicit declaration of reallocarray.
	- Fix unknown u_long in util.c for Issue #80 .
	- Merge PR #86 from noloader: Use precious variables for GREP, EGREP,
	  SED, AWK, LEX and YACC.
	- For PR #86: Fix that programs loaded after CFLAGS and stuff is
	  set, specifically the compiler, so that it can work if it needs
	  special flags from that.  Fix that lex only needs to support -i
	  if actually defined, otherwise the output included in the source
	  tarball can be used.
	- Merge PR #90 by phicoh: O_CLOEXEC should be FD_CLOEXEC.
	- Merge PR #92 by tonysgi: Fix typo.
	- Merge PR #91 by gearnode: nsd-control-setup recreate certificates.
	  The '-r' option recreates certificates.  Without it it creates them
	  if they do not exist, and does not modify them otherwise.


4.3.0
================
FEATURES:
	- Fix to use getrandom() for randomness, if available.
	- Fix #56: Drop sparse TSIG signing support in NSD.
	  Sign every axfr packet with TSIG, according to the latest
	  draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1.
	- Merge pull request #59 from buddyns: add FreeBSD support
	  for conf key ip-transparent.
	- Add feature to pin server processes to specific cpus.
	- Add feature to pin IP addresses to selected server processes.
	- Set process title to identify individual processes.
	- Merge PR#22: minimise-any: prefer polular and not large RRset,
	  from Daisuke Higashi.
	- Add support for SO_BINDTODEVICE on Linux.
	- Add support for SO_SETFIB on FreeBSD.
	- Add feature to drop queries with opcode UPDATE.
BUG FIXES:
	- Fix fname null check of fname in namedb_read_zonefile.
	- Fix implicit cast of size in udb_radnode_array_grow.
	- Fix ignore of return value of ssl_printf in remote.c.
	- Fix unused check of fd in parent_handle_reload_command.
	- Attempt to fix signedness of nscount lookup in ixfr query_process.
	- Fix identical branches for ssl_print of errors in remote.c.
	- Fix type cast bounds, signedness of opt_rdlen in edns_parse_record.
	- Fix to separate header and data lines in parse_zone_list_file.
	- Fix to define max number of EDNS records we are willing to
	  spend time on.
	- Fix size of string len and capacity type cast in udbradtree.
	- Fix to protect rrcount in tsig_find_rr from overflow.
	- Annotate radix_find_prefix_node not reachable trail code.
	- Fix to protect rrcount in packet_find_notify_serial from overflow.
	- Fix to close socket on error in create_tcp_accept_sock.
	- Fix to log on failure to chmod for socket for remote control.
	- Fix to remove unneeded if in open of socket for remote control.
	- Fix to restore input parameter on call failure in create_dirs.
	- Please checker by terminating and initialising string read
	  by remote control.
	- Fix to define upper bounds on rr counts read from untrusted packet
	  data.
	- Separate acl_addr_match_range functions for ip4 and ip6, to
	  please checkers.
	- Avoid unused variable warning in new match_range_v4 function.
	- Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters.
	- use-systemd is ignored in nsd.conf, when NSD is compiled with
	  libsystemd it always signals readiness, if possible.
	- Note that use-systemd is not necessary and ignored in man page.
	- Fix unreachable code in ssl set options code.
	- Fix bad shift in assertion code analyzer complaint.
	- Fix responses for IXFR so that the authority section is not echoed
	  in the response.
	- Merge PR#60: Minor portability fixes from michaelforney, with
	  avoid pointer arithmetic on void* and avoid unnecessary VLA.
	- Fix that the retry wait does not exceed one day for zone transfers.
CHANGES:
	- Set FD_CLOEXEC on opened sockets.


4.2.4
================
FEATURES:
	- Fix #48: Add make distclean that removes config.h made by configure.
	  And add maintainer-clean that removes bison and flex output.
BUG FIXES:
	- Detect fixed time memcmp for openssl 0.9.8 compatibility.
	- Detect EC_KEY_new_by_curve_name for openssl 0.9.8.
	- include limits.h for UINT_MAX.
	- If no recvmmsg, dont use msg_flags member, but errno for error,
	  where our fallback function left it, msg_flags also does not exist
	  on some systems.
	- Remove unused variable warning for portability.
	- Fix #52: do not log transient network full errors unless higher
	  verbosity is set.
	- Fix regressions in configparser.y where global variables were not
	  set for minimal-responses, round-robin and log-time-ascii.


4.2.3
================
FEATURES:
	- For #39: confine-to-zone configures NSD to not return out-of-zone
	  additional information. Contributed by Greg Bock.
	- For #21: pidfile "" allows to run NSD without a pidfile, for
	  startup management tools like daemontools.
	- For #21 add
	  contrib/patch_for_s6_startup_and_other_service_supervisors.diff
	  that adds support for readiness notification with READY_FD from
	  Cameron Nemo.
BUG FIXES:
	- Fix #35: excessive logging of ixfr failures, it stops the log when
	  fallback to axfr is possible. log is enabled at high verbosity.
	- Fixup warnings during --disable-ipv6 compile.
	- The nsd.conf includes are sorted ascending, for include statements
	  with a '*' from glob.
	- Fix #38: log address and failure reason with tls handshake errors,
	  squelches (the same as unbound) some unless high verbosity is used.
	- Fixup clang analysis warning in xfrd_parse_received_xfr_packet
	  master dereference.
CHANGES:
	- Number of different UDP handlers has been reduced to one. recvmmsg
	  and sendmmsg implementations are now used on all platforms.
	  Compatible implementations are in place for systems that lack the
	  system calls.
	- Socket options are now set in designated functions for easy reuse.
	- Socket setup has been simplified for easy reuse.
	- Configuration parser is now aware of the context in which an option
	  was specified.
	- Fix #44: document that remote-control is a top-level nsd.conf
	  attribute.


4.2.2
================
BUG FIXES:
	- Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the
	  dname_concatenate() function.  Reported by Frederic Cambus.
	  It causes the zone parser to crash on a malformed zone file,
	  with assertions enabled, an assertion catches it.
	- Fix #19: Out-of-bounds read caused by improper validation of
	  array index.  Reported by Frederic Cambus.  The zone parser
	  fails on type SIG because of mismatched definition with RRSIG.
	- PR #23: Fix typo in nsd.conf man-page.
	- Fix that NSD warns for wrong length of the hash in SSHFP records.
	- Fix #25: NSD doesn't refresh zones after extended downtime,
	  it refreshes the old zones.
	- Set no renegotiation on the SSL context to stop client
	  session renegotiation.
	- Fix #29: SSHFP check NULL pointer dereference.
	- Fix #30: SSHFP check failure due to missing domain name.
	- Fix to timeval_add in minievent for remaining second in microseconds.
	- PR #31: nsd-control: Add missing stdio header.
	- PR #32: tsig: Fix compilation without HAVE_SSL.
	- Cleanup tls context on xfrd exit.
	- Fix #33: Fix segfault in service of remaining streams on exit.
	- Fix error message for out of zone data to have more information.


4.2.1
================
FEATURES:
	- Added num.tls and num.tls6 stat counters.
	- PR #12: send-buffer-size, receive-buffer-size,
	  tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek.
	- Fix #14, tcp connections have 1/10 to be active and have to work
	  every second, and then they get time to complete during a reload,
	  this is a process that lingers with the old version during a version
	  update.
BUG FIXES:
	- Fix #13: Stray dot at the end of some log entries, removes dot
	  after updated serial number in log entry.
	- Fix TLS cipher selection, the previous was redundant, prefers
	  CHACHA20-POLY1305 over AESGCM and was not as readable as it
	  could be.
	- Consolidate server tls context create and remote control context
	  create, with hardening for the remote control tls context too.
	- Fix to init event structure for reassignment.
	- Fix to init event not pointer, in reassignment.
	- Fix #15: crash in SSL library, initialize variables for TCP access
	  when TLS is configured.
	- Fix tls handshake event callback function mistake, reported
	  by Mykhailo Danylenko.
	- Initialize event structures before event_set, to stop uninitialized
	  values from setting event library lists and assertions, that would
	  sometimes also show after event_del.
	- Do not use symbol from libc, instead use own replacement, if not
	  available, for accept4.
	- Fix output of nsd-checkconf -h.


4.2.0
================
FEATURES:
	- Print IP address when bind socket fails with error.
	- Fix #4249: The option hide-identity: yes stops NSD from responding
	  with the hostname for chaos class queries.  Implements the RFC4892
	  security considerations.
	- Patch to add support for TCP Fast Open, from Sara
	  Dickinson (Sinodun).
	- Patch to add support for tls service on a specified tls port,
	  from Sara Dickinson (Sinodun).
	- Use travis for build check, initial unit test and clang analysis.
	- TLS OCSP stapling support, enabled with tls-service-ocsp: filename,
	  patch from Andreas Schulze.
BUG FIXES:
	- Fix to delete unused zparser.default_apex member.
	- Fix that the TLS handshake routine sets the correct event to
	  continue when done.
	- Fix that TLS renegotiation calls the read and write routines again
	  with the same parameters when the desired event has been satisfied.
	- Fix that TCP Fastopen has better error message and supports OSX.
	- Fix to avoid buffer alloc with global buffer in tls write handler.
	- Fix to initialize event structure when accepting TCP connection.
	- Disable TLS1.0, TLS1.1 and weak ciphers, enable
	  CIPHER_SERVER_PREFERENCE, patch from Andreas Schulze.
	- further setup ssl ctx after the keys are loaded, for ECDH.
	- Fix #10: Fix memory leaks caused by duplicate rr and include
	  instructions.
	- Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.


4.1.27
================
FEATURES:
	- Deny ANY with only one RR in response, by default.  Patch from
	  Daisuke Higashi.  The deny-any statement in nsd.conf sets ANY
	  queries over UDP to be further moved to TCP as well.
	  Also no additional section processing for type ANY, reducing
	  the response size.
	- Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds
	  nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig
	  and del_tsig.  These changes are gone after reload, edit the
	  config file (or a file included from it) to make changes that
	  last after restart.
BUG FIXES:
	- Fix #4213: disable-ipv6 and dnstap compile error.
	- Fix to reduce region_log_stats if condition, this removes a
	  debug statement.
        - Fix for FreeBSD port with dnstap enabled.
	- Fix to remove unused code.
	- Fix #6: nsd-control-setup: Change validity time to a shorter
	  period (<2038).
	- Fix unused definition in header remote.h.
	- Fix #4236: IPV4_MINIMAL_RESPONSE_SIZE=1480 is slightly too big.
	- Fix #4235: IP_PMTUDISC_OMIT on IPv4/UDP sockets.
	- Fixed radtree_insert memory leak.
	- Fixed access recycled variable.


4.1.26
================
FEATURES:
	- DNSTAP support for NSD, --enable-dnstap and then config in nsd.conf.
	- Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes
	  option in nsd.conf.
	- Added nsd-control changezone.  nsd-control changezone name pattern
	  allows the change of a zone pattern option without downtime for
	  the zone, in one operation.
BUG FIXES:
	- Fix #4194: Zone file parser derailed by non-FQDN names in RHS of
	  DNSSEC RRs.
	- Fix #4202: nsd-control delzone incorrect exit code on error.
	- Tab style fix to use tab for 8 spaces, from Xiaobo Liu.
	- Fix #4205: enable-recvmmsg in mixed IPv4/IPv6 environment fails.
	  This sets the msg_hdr.msg_namelen correctly after receipt.
	- Fix to not set GLOB_NOSORT so the nsd.conf include: files are
	  sorted and in a predictable order.
	- Fix #3433: document that reconfig does not change per-zone stats.


4.1.25
================
FEATURES:
	- nsd-control prints neater errors for file failures.
BUG FIXES:
	- Fix that nsec3 precompile deletion happens before the RRs of
	  the zone are deleted.
	- Fix printout of accepted remote control connection for unix sockets.
	- Fix use_systemd typo/leftover in remote.c.
	- Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu.
	- append_trailing_slash has one implementation and is not repeated
	  differently.
	- Fix coding style in nsd.c
	- Fix to combine the same error function into one, from Xiaobo Liu.
	- Fix initialisation in remote.c.
	- please clang analyzer and fix parse of IPSECKEY with bad gateway.
	- Fix nsd-checkconf fail on bad zone name.
	- Annotate exit functions with noreturn.
	- Remove unused if clause during server service startup.
	- Fix #4156: Fix systemd service manager state change notification
	  When it is compiled, systemd readiness signalling is enabled.
	  The option in nsd.conf is not used, it is ignored when read.


4.1.24
================
FEATURES:
	- #4102: control interface via local socket.
	  configure it with control-interface: "/path/nsd.ctl"  The path
	  has to start with a / to separate it from an IP address.
	  The local socket does not use SSL, but unencrypted traffic, use
	  file and containing directory permissions to restrict access.
	- configure --enable-systemd (needs pkg-config and libsystemd) can
	  be used to then use-systemd: yes in nsd.conf and have readiness
	  signalling with systemd.
	- RFC8162 support, for record type SMIMEA.
BUG FIXES:
	- Patch to fix openwrt for mac os build darwin detection in configure.
	- Fix that first control-interface determines if TLS is used.  Warn
	  when IP address interfaces are used without TLS.
	- #4106: Fix that stats printed from nsd-control are recast from
	  unsigned long to unsigned (remote.c).
	- Fix that type CAA (and URI) in the zone file can contain
	  dots when not in quotes.
	- #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM
	  chain, NSD leniently attempts to find a working NSEC3PARAM.


4.1.23
================
BUG FIXES:
	- Fix NSD time sensitive TSIG compare vulnerability.


4.1.22
================
FEATURES:
	- refuse-any sends truncation (+TC) in reply to ANY queries over UDP,
	  and allows TCP queries like normal.
	- Use accept4 to speed up answer of TCP queries, on Linux, FreeBSD
	  and OpenBSD.
BUG FIXES:
	- Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones.
	- Fix to use same condition for nsec3 hash allocation and free.


4.1.21
================
FEATURES:
	- --enable-memclean cleans up memory for use with memory checkers,
	  eg. valgrind.
	- refuse-any nsd.conf option that refuses queries of type ANY.
	- lower memory usage for tcp connections, so tcp-count can be higher.
BUG FIXES:
	- Fix unused variable warnings and uninit variable in statistics
	  printout from clang analyzer.
	- Fix spelling error in xfr-inspect.
	- Fix #3562: explain build error when flex missing.
	- Fix buffer size warnings from compiler on filename lengths.
	- Fix #4093: Release notes not using 2018.


4.1.20
================
BUG FIXES:
	- Fix memory leak in zone file read of unknown rr formatted RRs.
	- Fix memory leak when rehashing nsec3 after axfr or zonefile read,
	  in the selectively allocated precompiled nsec3 hashes.


4.1.19
================
BUG FIXES:
	- ignore fallthrough compiler warning in flex EOF rule.
	- Fix warnings emitted by clang for --enable-packed.  Alignment is not
	  a problem for x86_64, don't enable packed when the platform
	  requires aligned access.
	- Fix spelling error in xfr-inspect.
	- Fix 3392: Fix regression in 4.1.18 for notify lists with ip4
	  and ip6 targets.
	- Add test for support of -Wno-address-of-packed-member for
	  --enable-packed.


4.1.18
================
FEATURES:
	- xfr-inspect, it is not installed, it prints xfr files from /tmp
	  made with 'make xfr-inspect' in the source dir.
	- retry timeout between sending notifies dropped from 15 to 3 sec.
	- NSD sends 16 notifies simultaneously.
	- configure --enable-packed reduces memory usage, at expense of
	  unaligned reads.  Saves about 17%.
	- Save memory by selectively allocate precompiled nsec3 hashes,
	  saves about 16% memory.
	- make ip-transparent option work on OpenBSD.
	- Save about 2% memory by changing usage count size in name tree.
	- Fix #2871: Increase number of sockets for xfrd transfers.
BUG FIXES:
	- Fix gcc 7.1.1 warnings.
	- Fix writev compile warning on FreeBSD.
	- Fix #1446: A corrupted zone file "propagates" to good ones.
	- nsd-control zonestatus prints wait time between attempts, for zones
	  that are in that waiting time.
	- Fix collision printout of nsec3 to print name, hash and reverse.
	- Fix #1567: Change crit to err log level for gettimeofday failure.
	  Add defines for compile without syslog.
	- Fix crash for DS query when parent and child zones both configured
	  in nsd.conf and parent zone has not loaded properly.


4.1.17
================
FEATURES:
	- zone parser parses type AVC (it has TXT format).
	- Fix #1272: use writev to put tcp length field with data for outgoing
	  zone transfer requests.
BUG FIXES:
	- Fix potential null pointer in nsec3 adjustment tree.
	- Fix text format of deletes for CDS and CDNSKEY, single 0 to represent
	  empty base64 or hex string.


4.1.16
================
FEATURES:
	- zone parser can parse acronyms for algorithms ED25519 and ED448.
	- Fix 1243: Option to make NSD emit really minimal responses,
	  minimal-responses: yes in nsd.conf.
BUG FIXES:
	- Calculate new udb index after growing the array, fix from
	  Chaofeng Liu.
	- Fix missing _t to _type conversion for disable-radix-tree option.
	- Printout serial error with hint it may be too big.
	- Fix 1228: OpenSSL include is not guarded with HAVE_SSL
	- Patch for expire state in multi-master when masters includes
	  broken master, from Manabu Sonoda.
	- minor manpage fix.


4.1.15
================
BUG FIXES:
	- Fix nsd-control and ipv6 only.
	- Squelch zone transfer error address family not supported by protocol
	  at low verbosity levels.
	- Fix #1195: Fix so that NSD fails on non-compliant values for Serial.
	- Fix to rename _t typedefs because POSIX reserves them.
	- Fix that nsec3 hash collisions only reported on verbosity level 3.


4.1.14
================
FEATURES:
	- Fix #1132 for SERVFAIL zones perform backoff, and remembers the
	  timeout on next startup.
BUG FIXES:
	- Fix null memcpy for radixtree with single link element.
	- Robust fix against missing master in tcp_open for xfrd.
	- Fix wildcards in include: config statements with chroot enabled.
	- suppress compile warning in lex files.
	- Fix to try every master once, then wait for timeout or notify.
	- Save backoff timeout into xfrd.state file, this file has a higher
	  version number now.  Old files are skipped silently (causes
	  refresh) and created as new files upon exit.
	- Fix restart of zone transfers when new config becomes available.


4.1.13
================
FEATURES:
	- multi-master-check: yes can be used to check all masters for the
	  last version, using the higher version from the configured masters,
	  from Manabu Sonoda.
	- Support RR type OPENPGPKEY from RFC 7929.
	- Can config key algorithms with the digest name, eg. 'sha256'.
	- configure --disable-radix-tree for about 15% lower memory usage.
	- for type SRV add A/AAAA to the additional section (if possible),
	  just like we already do for type MX.
	- more extensible edns option handling.
BUG FIXES:
	- Fix compile warnings about unused result from write and strtol.
	  and signcompare in minmax retrytime.
	- Fix #812: fix that make depend fails after distribution.
	- Fix #817: xfrd update failed loop.
	- Add robustness against unallocated data in nsec3 trees.
	- Fix README spelling error of BSD license (reported by Joerg Jung).
	- Fix multimaster for not tried full zone transfer for a expired zone.
	- Fix #827: fix compile with openssl 1.1.0 with api=1.1.0.


4.1.12
================
BUG FIXES:
	- Fix malformed edns query assertion failure, reported by
	  Michal Kepien (NASK).


4.1.11
================
FEATURES:
	- When tcp is more than half full, use short timeout for tcp session.
	- Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
	- Fix #790: size-limit-xfr can stop NSD from downloading infinite zone
	  transfer data size, from Toshifumi Sakaguchi.  Fixes CVE-2016-6173
	  JVN#63359718 JPCERT#91251865.
BUG FIXES:
	- Fix build without IPv6, patch from Zdenek Kaspar.
	- Fix #783: Trying to run a root server without having configured it
	  silently gives wrong answers.
	- Fix #782: Serve DS record but parent zone has no NS record.
	- Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.


4.1.10
================
FEATURES:
	- ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option
	  for Linux, binds to interfaces and addresses that are down.
	- NSD includes AAAA before A for queries over IPV6 (in delegations).
	  And TC is set if no glue can be provided with a delegation because
	  of packet size.
	- print notice that nsd is starting before taking off.
BUG FIXES:
	- Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl.
	- Fix #751: NSD fails to occlude names below a DNAME.
	- If set without nsd.db print "" as the default in the man pages.
	- Fix #755: NSD spins after a zone update and a lot of TCP queries.
	- Fix for NSEC3 with zone signed without exact match for empty
	  nonterminals, the answer for that domain gets closest encloser.
	- #772 Document that recvmmsg has IPv6 problems on some linux kernels.


4.1.9
================
BUG FIXES:
	- Change the nsd.db file version because of nanosecond precision fix.


4.1.8
================
FEATURES:
	- #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch
	  from Daisuke Higashi.
	- #739: zonefile changes when mtime is small are detected on reload,
	  if filesystem supports precision mtime values.
	- RR type CSYNC (RFC7477) syntax is supported.
BUG FIXES:
	- take advantage of arc4random_uniform if available, patch from
	  Loganaden Velvindron.
	- Fix flto check for OSX clang.
	- Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux.
	- Fix #736: segfault during zone transfer.
	- Fix #744: Fix that NSD replies for configured but unloaded zone
	  with SERVFAIL, not REFUSED.


4.1.7
================
FEATURES:
	- support configure --with-dbfile="" for nodb mode by default, where
	  there is no binary database, but nsd reads and writes zonefiles.
	- reuseport: no is the default, because the feature is not troublefree.
	- configure --enable-ratelimit-default-is-off with --enable-ratelimit
	  to set the default ratelimit to disabled but available in nsd.conf.
	- version: "string" option to set chaos version query reply string.
BUG FIXES:
	- Fix zones updates from nsd parent event loop when there are a lot
	  of interfaces.
	- portability fixes.
	- patch from Doug Hogan for SSL_OP_NO_SSLvx options, for the new
	  defaults in the ssl libraries.
	- updated contrib/nsd.spec, from Bálint Szigeti, with new configure
	  options.
	- Allocate less memory for TSIG digest.
	- Fix #721: Fix wrong error code (FORMERR) returned for unknown
	  opcode.  NOTIMP expected.
	- Fix zonec ttl mismatch printout to include more information.
	- Fix TCP responses when REUSEPORT is in use by turning it off.
	- Document default in manpage for rrl-slip, ip4 and 6 prefixlength.
	- Explain rrl-slip better in documentation.
	- Document that ratelimit qps and slip are updated in reconfig.
	- Fix up defaults in manpage.


4.1.6
================
BUG FIXES:
	- Fix #701: Fix that AD=1 set in a BADVERS response.
	- Fix typo in zonec.c inside error message.
	- Fix #711: Document that debug-mode yes is used for staying
	  attached to the supervisor console.
	- Document verbosity 3 prints more information.
	- nsd-checkconf warns for master zones with no zonefile statement.
	- Fix start failure when many file descriptors are in use.
	- The servfail rcode is not printed with a space in the middle.
	- print failed token for config syntax error or parse error.


4.1.5
================
BUG FIXES:
	- Fix #706: default port 53 not opened on ip4 because of getaddrinfo
	  hints initialisation failure.


4.1.4
================
FEATURES:
	- RFC7553 RR Type URI support.
	- removed hardcoded interface limit, --with-max-ips removed.
	- SO_REUSEPORT support, by default on Linux, or with reuseport: yes.
	- Admitted axfrs are logged at verbosity 1.  Refused at verbosity 2.
	- --enable-pie and --enable-relro-now options for a safer executable.
BUG FIXES:
	- Fix NSID response for short edns sizes.
	- Fix that for expired zones NSD performs an AXFR and accepts newer
	  and older serial numbers.
	- Document that minimal responses only minimizes responses to fit
	  in one datagram.  It does not minimize smaller responses.
	- Fix #618: documented need to list ip-addresses separately in
	  nsd.conf if there are multiple, because the source address of
	  replies can otherwise go wrong.
	- Fix that notify from nsd-control contains soa serial.
	- Fix #698 formatting errors and typos in nsd.8.in.


4.1.3
================
FEATURES:
	- nsd-control addzones and delzones read list of zones from stdin.
	- hmac sha224, sha384 and sha512 support, patch from David Gwynne.
	- max-interfaces raised to 32.
BUG FIXES:
	- Fix #665: when removing subdomain, nsd does not reparse parent zone.
	- Fix task and zonestat files to be stored in a subdirectory in tmp
	  to stop privilege elevation.
	- Fix crash in zone parser for relative dname after error in origin.
	- Fix that formerrors are ratelimited.


4.1.2
================
FEATURES:
	- Incoming notifies have serial number logged (at verbosity 1).
BUG FIXES:
	- Remove some duplicate header includes (from Brad Smith).
	- Fix tcp waiting list for zone transfers where the bind and connect
	  calls fail.
	- Fix segfault in zone reader on invalid input. (thanks John Van de
	  Meulebrouck Brendgard)
	- Fix segfault on double origin in zone reader (thanks John Van de
	  Meulebrouck Brendgard).
	- Fix b64pton out of bounds error on invalid zonefile input.
	  (thanks John Van de Meulebrouck Brendgard)
	- Fix origin directive from unused old value and subdomain parser
	  failure, reported by John Van de Meulebrouck Brendgard.
	- Fix use after free after zonefile syntax error followed by ttl
	  or origin directive, reported by John Van de Meulebrouck Brendgard.
	- Fix syntax error followed by too many TXT elements parse crash
	  reported by John Van de Meulebrouck Brendgard.
	- Fix buffer overflow in config parse of domain name,
	  reported by John Van de Meulebrouck Brendgard.
	- Use reallocarray for integer overflow protection, patch submitted
	  by Loganaden Velvindron.
	- Fix allocation integer overflow checks.
	- Fix #654: Fix contradiction in notify logging verbosity level.
	- Fix #655: Fix contradiction in verbosity for zone transfers.
	- Made log message more consistent, changed 'axfr refused' log message
	  to be more consistent with other messages.  Also notify refused.
	- verbosity 2 logs axfr refused and notify refused.
	  verbosity 1 contains less log messages.


4.1.1
================
FEATURES:
	- RFC 7344: CDS and CDNSKEY (read record types).
	- per zone statistics with --enable-zone-stats, config zone with
	  zonestats: "name", zones configured with the same string are added.
	- Disabled use of SSLv3 in nsd-control.
	- nsd-checkconf -f prints out full name of pidfile (with dir).
	- Synthesize CNAMEs with same TTL as DNAME.
BUG FIXES:
	- Fix that expired zones stay expired after a server restart.
	- Fix "xfrd_handle_ipc: bad mode" log errors when compiled 
	  with --disable-bind8-stats.
	- Fix #616: retry xfer for zones with no content after command.
	- Fix char used as array index warnings on NetBSD.
	- Fix that queries for noname CH TXT are REFUSED instead of nodata.
	- Fixes for wildcard addition and deletion, speedup for some cases.
	- Fix that failure to add tcp to tcp base does not leak the socket.
	- Patch nsd_munin_ from Philip Paeps to use type ABSOLUTE.
	- Fix spinning NSD with lots of failing transfers, due to pointer
	  comparison using void pointer subtraction (from Otto Moerbeek).
	- Fix bug#637: fix that nsd.db grows limitlessly, an off by one
	  on one megabyte free chunks, created during AXFRs of large zones,
	  that caused the one megabyte chunk to be leaked.
	- Fix casts for ctype functions (from Todd Miller).
	- correct some hyphen-used-as-minus-sign (from Andreas Schulze) in
	  man pages.
	- Fix zonesdir chroot error message.


4.1.0
================
FEATURES:
	- database: "" starts without mmap of database.  Less memory is used,
	  zones are read from text zonefile.
	- optimised zonefile parse code and zonefile write code.
	- zonefiles-write option in nsd.conf, enabled when database is "".
	  The server writes changed zonefiles to disk every hour.
	- xfrdfile: "" disables xfrd.state.  If enabled, zones that are
	  same as before are not checked for a serial update at server start.
	- include: "foo/nsd.d/*.conf" works, wildcard glob on includes.
	- nsd shuts down during init process if given signal.
	- log-time-ascii option, default yes, with readable timestamp in log.
	- nsd-control addzone reports if zone already exists.
	- Fix #564: add nsd-checkzone tool to check zonefile correctness.
	- Increased default --with-max-ips from 8 to 16, this increases the
	  number of interfaces you can specify in nsd.conf to listen to.
BUG FIXES:
	- Fixed shutdown message sporadically not printed on exit
	  (Thanks Anand Buddhdev).
	- Documented zonefile %s syntax in nsd.conf man page.
	- Fix manpage to put colon after zonefiles check and write.
	- Change from 'Zone" to "zone" with ".. serial .. is updated" log
	  message.
	- Changed maxbackoff for no-content secondary zones from 4h to 24h.
	- Fix print filename of encompassing config file on read failure.
	- Fix delete or rename of a lot of zones and make it take a
	  non-enormous time.
	- Speed up deletion of zone contents a lot, (56s to 1s), speeds up
	  delete, rename and AXFR for zones.
	- Fix #571: unused variable and incompatible pointer warnings when
	  compiled on a system without INET6.
	- Fix write_socket return value check in server.c (Thanks Brad Smith,
	  Mark Kettenis).
	- Fix that xfrd reaps children also if the signal is lost.
	- Fix #577: makefile incorrectly installed manpages from srcdir.
	- Fix #587: Default value for statistics is 0.
	- Fix #553: Improve TXT parsing.
	- Fix #590: rrl log does not print wildcard as a star but escaped.
	- Fix #591: rrl log messages at verbosity level 1.
	- fix strptime implicit declaration error on OpenBSD.
	- Fix -O3 compile flag to -O2 to avoid miscompilations.
	- Allow user to override the -g -O2 CFLAGS in ./configure.
	- Fix endian.h include for OpenBSD.
	- Fix #600: document that provide-xfr provides AXFR and not IXFR.
	- Fix rising-load-average or memory-leaks in OSes (Linux since 2.6),
	  that keep track of all past process parents, or leak memory
	  for them.  Fix makes it so there is no very deep string of
	  process parents.
	- Remove .LP after .SH in man pages.


4.0.3
================
BUG FIXES:
	- Fix nsd.db unclean close check.  Previous databases are considered
	  unclean by the code and are created anew.
	- Adds nsd.db larger than 400Tb check for sanity. Also test if
	  filesize as documented in the file is correct.
	- nsd waits for tasks to complete on stop, prevents nsd.db corruption.
	- fix to not delete tmpdir too early in shutdown process.
	- disabled udb checking functionality that made it very slow,
	  this was enabled when enable-checking was turned on.


4.0.2
================
FEATURES:
	- Return REFUSED for queries to non-hosted zones.

BUG FIXES:
	- Fix expired zones to give SERVFAIL, also when parent zone loaded.
	- documented nsd-control zonestatus output in nsd-control manpage.
	- remove mention of nsdc from nsd-checkconf manpage.
	- Disabled recvmmsg and sendmmsg usage by default because kernel
	  versions have implementation issues: ipv6 ignored, security issues.
	- Detect libevent2 install automatically by configure, and use
	  event2 header files if necessary.
	- Fix #551: change Regent to Copyright holder in the LICENSE,
	  to match the definition on opensource.org for the BSD License.
	- Fix #552: zonefile loads on nsd-control reconfig when the name
	  of the file has changed.
	- Fix leak of zone name after zonefile read and fix malloc too
	  large that would be leaked in the radix tree.
	- Fix from 3.2: make SOA RDATA comparisons in XFR more lenient (only
	  check serial).
	- Fix that NSD will delete and recreate not-clean-closed databases.


4.0.1
================
FEATURES:
	- recognizes ip-address and interface as synonyms for convenience.
	- Support for EUI48 and EUI64 RR types enabled by default (RFC 7043).
	- Support for CAA RRtype (RFC 6844).
	- NSID can be set with "ascii_somestring" in ascii.
	
BUG FIXES:
	- Fix xfrd when zone transfer TCP contains zero length packets.
	- Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3,
	  because AXFRs overwrote nsec3 administration in the child zone.
   	- Fix that bad IXFR updates do not result in double SOA records,
	  and that an AXFR is started (attempted) when the zone state seems
	  to be inconsistent with the master's zone state.
	- Log ip address for sendto and sendmmsg failures.
	- Fix segfaults after read of zones with rr type WKS from zonefile.
	- Seed PRNG for openssl at start of daemon, fixes SSL connection issue.
	- Bugfix #534: IXFR query loop over UDP for zones that are unchanged.
	- (same as in 3.2.16): fix wildcard cname to nxdomain repeated rrset.
	- (same as in 3.2.16): Bugfix #542: Match RRSIG TTL with SOA TTL in
	  negative response.
	- Check if configure in srcdir collides with outofdir build.
	- Fix #546:  output format errors in nsd_munin_ (Thanks Tom Hendrikx).
	- Fix printout of high-chars in TXT on NetBSD.

4.0.0	NSD 4.0
===============
FEATURES:
	- documented in doc/NSD-4-features. Change configuration without
	  restart, direct nameserver control with nsd-control, support a
	  higher number of zones. Higher performance (compared to NSD3).
	- nsdc is gone. Use kill -HUP for reload (also checks if zonefiles
	  have changed and rereads them), and kill -TERM for quit. Or use
	  nsd-control for detailed control.
	- cron job for nsdcpatch is gone. nsd-control write creates zonefiles.
	- nsd.db has a new format that compacts itself when it is changed,
	  thus nsdc patch is no longer necessary.
	- nsd.db is memory mapped, NSD needs (part of) that mmap in ram.
	- tcp-count can go above 1000; epoll/kqueue support with libevent.
	- nsd-control reconfig for updates with no restart (zones, keys, ..)
	- nsd-control-setup to create keys for nsd-control (enable nsd-control
	  with remote-control: yes in nsd.conf).
	- the NSD 3 feature of special zone stats are not ported to 4 yet,
	  as it would entail a complete reimplementation of the feature.
FEATURES (incremental from BETA5):
	- configure --disable-recvmmsg for compat with older Linux kernels,
	  by default it autodetects support in the kernel on the buildmachine.
	- Fix time at 2038, uint32s changed to time_t, support 64bit time_t.
	- Fix use of 32bit time, for 2038, thanks to Theo de Raadt for patch.
BUG FIXES (incremental from BETA5):
	- Bugfix #518 Incorrect RRL prefix length option names in nsd.conf
	  man page from Ville Mattila.
	- Fix that xfrd, and nsd-control, does not stop responding when reload
	  errors out. The pid is sent like it should by server_main.
	- Fix that EOF in quoted string error does not cause reload to exit.
	- Fixup errors from the stack code checker.
	- Removed use of random when arc4random is available. Thus, random
	  and srandom are then not linked with the executable.
	- Fix segfault with no logfile and chroot (Thanks Patrik Lundin).

4.0.0b5   BETA 5 release of NSD 4.0
==================================
FEATURES:
	- Optimizations for startup, qps and tcp speed, beta bug fixes and
	  merge with code changes with NSD 3.2.16.
	- nsd-mem tool (make nsd-mem) to estimate memory usage.
	- Same as NSD 3.2.16: --enable-draft-rrtypes(EUI48, EUI64), rr-slip,
	  rrl-ipv[46]-prefix-length, ip-transparent config options.
	- configure option --disable-flto.
	- improved RRL logging (query details that caused blockage).
	- nsd-control status prints out ratelimit if ratelimit is enabled.
	- nsd-control verbosity prints out verbosity level without argument.
	- Fix #491: pick program name (of executable) as syslog identity.
	- printout percentage for long activities (to log).  After about 5
	  seconds have passed.
BUG FIXES:
	- The same fixes up to NSD 3.2.16.
	- Fix that old zonefile does not override newer AXFR for slave zones.
	- Nicer printout of notify.
	- Fix tcp zonetransfer pipeline lookup function.
	- Fix compile on bigendian netbsd alpha.
	- Fixup the growth and shrinkage of nsd.db.  This should use less
	  calls to remap and change the file and mmap size.
	- notify information is logged at correct verbosity level, 1.
	- Fix memory statistics in nsd_munin_.
	- faster nsec3 updates.
	- Fixup contrib/bug390.patch for 4.0.0b4.
	- remove leak of nsec3.
	- allocate radixtree in region for small (5%) total savings and
	  about 15% savings in the radixtree itself (due to many small alloc
	  savings in region).
	- Patch from Lukas Wunner that makes nsd.conf include files work
	  inside chroot/etc environments on repattern and reconfig.
	- Fix race on exit of nsd, for restarts, so that the pidfile-pid
	  process waits until port53 has been closed before exiting.
	- Patch from Lukas Wunner that makes chroot more consistent.
	  Make all paths absolute with the chrootdir in front, or use
	  an absolute zonesdir with other paths relative to that.
	- Fix segfault on repeated reconfigs, double free of zone apex name.
	- Fix zone parser allocations are put in the db region.
	- Fix memory leak in zone parser for txt record.
	- Optimizations: -O3 if possible (user can override CFLAGS), udp
	  buffers are set to 1m by default (if socket options exist),
	  use recvmmsg and sendmmsg, or only recvmmsg, or recvfrom.
	- nsd.db 12% smaller, no nsec3 hash storage.  Also ups udb version
	  because of the format change.  The nsd.db is recreated when a 
	  different version number is detected on startup.
	- Fix region-allocator for speedup of load and change of large data.
	- Increase tcpbacklog default to 256 (silently capped to 128 on BSD).
	  For remote control keep it at 16, it has less TCP load.
	  It does not actually increase TCP performance (some except), but
	  reduces connection loss when there is a spike in TCP connections.
	- unlink xfr file if transfer is stopped, timeouted or interrupted.
	  And unlink xfr file in progress when the zone is deleted.

4.0.0b4   BETA 4 release of NSD 4.0
==================================
BUG FIXES:
	- remove -fwhole-program gcc flag usage.  We cannot reliably detect
	  if it works without failure.
	- fix zonefiles-check: entry in nsd.conf
	- fix gcc warning, do not use uninit value for rng init.
	- remove printout of "bad transfer" to the log for notimpl.
	- printout log less verbosely, not every axfr packet.
	- RRL documented in nsd.conf.sample
	- Fix is_apex flag for zones read from udb.
	- Fix that nsec3 zones are precompiled when read from udb.  This
	  caused assertion failures.
	- Less printout of 'bad transfer'.
	- Fix AXFR of NSEC3 slave zone.
	- Fix that old zonefile does not override newer AXFR for slave zones.
	- Nicer printout of notify on verbosity 2.

4.0.0b3   BETA 3 release of NSD 4.0
==================================
BUG FIXES:
	- applied patch from Robin Hack to remove double pid file truncation.
	- repattern is called reconfig (because most config options are
	  picked up, except for superuser options (chroot, logfile, port))
	- document that the zonefile attribute can be empty.
	- documented that the _implicit_ pattern names are used internally.
	- Added zonefiles-check option, default yes, check mtimes of zone files
	  on sighup and startup (from Robin Hack).
	- Fix spurious assertion failure for some rrl blocks.
	- Tabs and spaces nicer in nsd.conf.sample.
	- List libevent in README.
	- Fix configure for gentoo gcc and headers.
	- do-ip4 and do-ip6 nsd.conf options just like unbound.
	- do not leave task files in /tmp if nsd fails to startup because
	  of file permissions.
	- create xfrdir on make install (does not remove on make uninstall,
	  because this could be /tmp).
	- Fix segv if xfrdir does not exit.
	- log ip address with tcp failure.
	- Fix time calculation of zone transfer.

4.0.0b2   BETA 2 release of NSD 4.0
==================================
FEATURES:
	- Add and remove zones from nsd.conf with nsd-control repattern.
	- Merge changes from 3.2.15 (such as xname-rcode fix).

BUG FIXES:
	- Fix for use with libev.
	- 'nsd-control start' runs an absolute path to start sbin/nsd.
	- Fix for use with libevent-2.1.2.
	- --with-logfile sets the logfile inside the example documentation.
	- Fixed addzone and delzone inside chroot (thanks Will Pressly).
	- Fix make outside of source directory.

4.0.0b1   BETA 1 release of NSD 4.0
==================================
FEATURES:
	- add and remove zones without restart.
	- nsdc is gone, use nsd-control for direct server control.
	- performance increases
	- support lots of zones
	- and more ...
	- longer desc in doc/NSD-4-features

BUG FIXES:
	- core code is fixed like 3.2.15r3763 (12 dec 2012).


3.2.16 (development branch)
=================================

FEATURES:
	- New config option "ip-transparent:" to allow NSD to bind to
	  non local addresses. Default no.
	- Use IPV6 minimum MTU settings with TCP to reduce failures that
	  are caused by delays in learning working PMTU when communicating
	  through a tunnel.
	- Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental,
	  turned off by default. Enable with --enable-draft-rrtypes.
	- New config option "rrl-slip:" to set the average number of
	  packets discarded before we send back a truncated response.
	- New config option "rrl-ipv4-prefix-length:" and
	  "rrl-ipv6-prefix-length:" to set the prefix lengths.
	- Improved RRL logging, also print triggering query src address and
	  QTYPE.
	- Provide RRL documentation in nsd.conf.sample.

BUG FIXES:
	- Bugfix #357: Parent process waits until children closed down
	  sockets, to prevent NSD failing to bind to sockets when restarting.
	- Bugfix #487: lookup3.c determine endianness for BSD systems.
	- Bugfix #491: pick program name (0th argument) as syslog identity.
	- Bugfix #494: Exit with return code 1 if socket code fails.
	- RRtypes ASFDB, RP, RT should not compress dnames.
	- Fix outgoing-interface: Don't fail if family is IPv6 but
	  only IPv4 outgoing-interface is set, or vice versa.
	- RRtypes ASFDB, RP, RT should not compress dnames.
	- Check that zone directory is within chroot directory.
	- Better XFR checking, fallback to AXFR (if allowed) if three
	  malformed XFR packets have been seen.


3.2.15
=================================

FEATURES:
	- Support for ILNP RR types: NID, L32, L64, LP (RFC6742).
	- RRL, --enable-ratelimit at configure time and config options.
	- TSIG initialization only fails when there is no digest found
	  at all.

BUG FIXES:
	- Bugfix #478: Declaration after statement (for gcc 2.95).
	- Bugfix #483: Better error message in case of TSIG error.
	- Bugfix #485: TTL should not be greater than 2^31 - 1.
	- Fix RCODE when CNAME loop final answer does not exist, should
	  return NXDOMAIN as stated by RFC 6604.
	- Fix --disable-full-prehash bug, where after multiple incoming
	  IXFRs, NSEC3 can be removed unjustified.

3.2.14
================

FEATURES:
	- TCP writev support.

BUG FIXES:
	- Fix build on OpenBSD (thanks Oliver Peter).
	- Prioritize notify sender for requesting XFR (thanks Ilya Bakulin).
	- Fix crash in zonec if TXT string too long  (thanks Ilya Bakulin).
	- tzset before chroot for correct timezone (thanks Camiel Dobbelaar).
	- Fix --disable-full-prehash bug when nsdc patch happens while ixfr too,
	  it did not rehash the new database.
	- Bugfix #464: Conditionally define MAXHOSTNAMELEN.

3.2.13
================

BUG FIXES:
	- Fix for nsd-patch segfault if zone has been removed from nsd.conf
	  (thanks Ilya Bakulin).
	- Bugfix #460: man page correction - identity.
	- Bugfix #461: NSD child segfaults when asked for out-of-zone data
	  with --enable-zone-stats. [VU#517036 CVE-2012-2979]


3.2.12
================

BUG FIXES:
	- Fix for VU#624931 CVE-2012-2978: NSD denial of service 
	  vulnerability from non-standard DNS packet from any host
	  on the internet.
	  http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt


3.2.11
================

FEATURES:
	- Fallback to AXFR if IXFR is unknown at the primary. NSD considers
	  IXFR unknown at the primary if there is a negative response for the
	  IXFR RRtype. This does not override the value for
	  'allow-axfr-fallback'.
	- Allow for reading in new DNSKEY algorithm mnemonics (RFC5155,
	  RFC5702, RFC5933, and RFC6605 (ECDSA)).
	- Zone statistics, enable with --enable-zone-stats. This stores the
	  BIND8 stats per zone in a configurable statistics file. This option
	  does not scale and should therefore not be enabled when serving
	  many zones.
	- Support for TLSA RRtype (DANE).

BUG FIXES:
	- Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't
	  add the wildcard domain NSEC into the answer section. Instead,
	  put the wildcard expanded NSEC into the answer section and keep the
	  wildcard domain NSEC in the authority section.
	- Fix for accept spinning reported by OpenBSD.
	- Fix restart failed due to bad ixfr packet because of zone removed
	  from nsd.conf.
	- Bugfix #453: typo in nsdc man page.

OPERATIONAL NOTES:
	- NSD uses the query name for dname compression again (Fix #235 
	  had as side effect that this didn't happen anymore and is hereby
	  undone).


3.2.10
================

BUG FIXES:
	- Bugfix #421: Truncate pidfile on shutdown, before unlink.
	- Bugfix #423: Fix slow zone transfer processing due to
	  'Fix is_existing flag for ENT' bugfix.
	- Fix bug #430: segfault when MAX_INTERFACES set to more than 65K.
	- Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs update.


3.2.9
================

FEATURES:
	- Minimize responses to reduce truncation: NSD will only add optional
	  records to the authority and additional sections when the response
	  size does not exceed the minimal response size.

	  The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4),
	  1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is
	  smaller than the EDNS default. 

	  The feature is enabled by default. You can disable it by configuring 
	  NSD with --disable-minimal-responses.

	- Less NSEC3 prehashing. This will make NSD handle zone transfers
	  faster, but will decrease the performance of NXDOMAIN and wildcard
	  NODATA responses. Full prehashing is enabled by default. If you want
	  less NSEC3 prehashing, configure NSD with --disable-full-prehash.
	  Thanks Secure64 for the patch.

BUG FIXES:
	- Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone.
	- Bugfix #365: set patch style and zonec verbose for nsdc.
	- First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC.
	- Bugfix #375: typos in nsd.conf.5.
	- Bugfix #381: Binary escaped and transfers.
	- Bugfix #397: Don't allow relative domain names as origin in $INCLUDE
	  directives.
	- Fix printout of IPSECKEY by nsd-patch.
	- Fix is_existing flag for ENT when domain that has a shared ENT
	  is deleted by IXFR. (ENT == Empty Non-Terminal)
	- Fix bug if the zonefile is changed for a secondary but stored
	  transfers are applied, and stop it from applying ixfr to empty zone.
	  The zone is flagged with error and AXFR-ed.
	- Fix to have no authority NS set processing for CNAMEs.
	- Fix nsd-checkconf to check tsig algorithms properly.
	- Set the AA bit on responses that have an authoritative CNAME.
	- Fix denial of existence response for empty non-terminal that looks
	  like a NSEC3-only domain (but has data below it).

OPERATIONAL NOTES:
	- nsd.db version number increased because NSD 3.2.7 and earlier
	  zonec is not compatible due to the TXT strings change. Please
	  run nsdc rebuild before running NSD 3.2.9 and later versions.


3.2.8
=============

BUG FIXES:
	- Do setusercontext() before chroot(), otherwise login.conf etc. are
	  required inside chroot.
	- Bugfix #216: Fix leak of compressiontable when the domain table increases
	  in size.
	- Bugfix #348: Don't include header/library path if OpenSSL is in /usr
	- Bugfix #350: Refused notifies should log client ip.
	- Bugfix #352: Fix hard coded paths in man pages.
	- Bugfix #354: The realclean target deletes a bit too much.	
	- Bugfix #357, make xfrd quit with many zones.
	- Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious
	  warning messages.
	- Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok.
	- Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY.

OPERATIONAL NOTES:
	- Use 'make clean' to clean up files that make created.
	- Use 'make realclean' to also clean up files that were generated by
	  running ./configure.
	- Use 'make devclean' to also clean up autoconf, autoheader files.

3.2.7
=============

BUG FIXES:
	- Bugfix #253: Don't put NS RRs in a response with QTYPE=DS.	
	- Bugfix #320: use arcrandom(4) for QID generation if available.
	- Bugfix #328: nsd-checkconf overrun.
	- Bugfix #343: nsdc update fix.
	- Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation.
	- Bugfix: Allow for huge amount of strings in TXT (and other) records.
	- Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5.
	- Fixed several parts in the documentation, including #306, #345.

3.2.6
=============

BUG FIXES:
	- Bugfix #314: correctly print NSEC next field, escape spaces and
	  fix label overflows.

FEATURES:
	- Expand command line option '-a' and config option 'ip-address:'
	  with port number.

OPERATIONAL NOTES:
	- Configure options --disable-dnssec, --disable-nsid, --disable-tsig
	  are removed.
	- Configure option --max-interfaces is renamed to --max-ips.

3.2.5
=============
BUG FIXES:
	- NSD will not start if chroot is configured, but changing root is
	  not possible (it used to ignore the badly configured chroot).
	- Make use of the more secure strl* functions.
	- Bugfix #303: spelling error.

FEATURES:
	- New option 'nsid:', to specify the NSID (Bugfix #298).
	- The default chroot can be set with --with-chroot=<dir>.
	  If not set, by default chroot will not be used (thanks Jakob Schlyter).
	- Optimized zonec and b64_pton compatibility code (thanks Martin Svec).
	- Optimized memory allocations. Use mmap/munmap instead of malloc/free.
		Experimental, by default off. Enable it at build time with
		--enable-mmap (thanks Martin Svec).

OPERATIONAL NOTES:
	- NSID support is now enabled by default.

3.2.4
=============
BUG FIXES:
	- Bugfix #269: Additional C99 syntax.
	- Bugfix #276: Zonec prints debug data to stderr.
	- Bugfix #286: Document verbosity levels in nsd.conf manual page.
	- Bugfix #288: Ignore SIGHUP to child processes.
	- Fix typo in include file for setusercontext.

FEATURES:
	- Support DLV records.
	- New option 'tcp-query-count:', to limit the maximum number of
		DNS queries on a single tcp connection.
	- New option 'tcp-timeout:', to override the default tcp timeout.
		The default can also be set at build time, --with-tcp-timeout=<number>.
	- New option 'notify-retry:', to configure how many times NSD should retry
		a NOTIFY message.
	- New options 'ipv4-edns-size:' and 'ipv6-edns-size:'. to set your preferred
		EDNS buffer size.

OPERATIONAL NOTES:
	- UDP/IPv4 sockets have new options set that will disable the DF flag in IP
		packets.

3.2.3
=============
BUG FIXES:
	- Bugfix #236: Allow RRs before the SOA in a zonefile.
	- Bugfix #249: Remove the C99 code.
	- Bugfix #253: Don't put NS RRs in a response with QTYPE=DNSKEY.
	- Bugfix #263: Make TSIG algorithm comparison case insensitive.
	- Bugfix #266: Build failed on systems without strptime.
	- Bugfix: install hickup.
	- Fix to use 4096 EDNS limit for IPv6 on Linux.

3.2.2
=============
BUG FIXES:
	- Off-by-one buffer overflow fix while processing the QUESTION section.
	- Return BADVERS when NSD does not implement the VERSION level of the 
	  request, instead of 0x1<FORMERR>.
	- Bugfix #234.
	- Bugfix #235.
	- Reset 'error occurred' after notifying an error occurred at the $TTL or
		$ORIGIN directive (Otherwise, the whole zone is skipped because the
		error is reset after reading the SOA).
	- Minor bugfixes.

3.2.1
=============
OPERATIONAL NOTES:
	- NSD will now fallback to AXFR, only if the master does not support IXFR.
	- You can adjust nsdc patch to skip textfile patching. This will 
	  increase the patching process, but will not output to zonefiles 
	  anymore. By default, this is off.

BUG FIXES:
	- When configuring, don't do strptime test when cross-compiling.
	- Bug #230: Output non-error messages to stdout.
	- Better error message when ixfr.db old file format is read.
	- Bug #218: shared UDP query for all interfaces.
	- Bug #222: Remove bashism from nsdc script.
	- Nicer check for SHA-256 functionality.
	- Fixed some minor memory leaks that occurred on reload.
	- nsdc: check if a lockfile has not gone stale, when lock failed.
	- Bugfix strptime compatibility function

FEATURES:
	- New configuration option 'allow-afxr-fallback', "yes" by default. If
		set to "no", NSD will never do AXFR fallback, even if the master 
		does not support IXFR.
	- Allow file rotation on nsd.log.
	- The new nsd-patch options -s and -o allows you to skip writing 
		zonefiles and store the output directly to a database file, 
		respectively.

3.2.0
=============
OPERATIONAL NOTES:
	- Format of ixfr.db has changed. When you are planning an upgrade to the 
	  new NSD release, make sure to process the old ixfr.db before starting 
	  the new release (by running nsdc patch).
	- IXFR is transmitted over TCP by default instead of UDP. If you want to 
	  continue the use of IXFR/UDP, please modify your zone configuration 
	  file to:
		request-xfr: UDP 1.2.3.4 tsigkey
	  We strongly recommend to enable TSIG if you send IXFR over UDP.
	  When all masters fail to transmit IXFR/UDP, slave will fallback to 
		IXFR/TCP and eventually AXFR/TCP.
	- nsd-patch prints errors to stderr instead of stdout.

BUG FIXES:
	- Only normalize dnames in rdatas when rrtype is listed in RFC 4034, 
	  section 6.2: Canonical RR Form, following
	  draft-ietf-dnsext-dnssec-bis-updates (affects RRSIG and NSEC records).
	- Typo in zonec manpage.
	- Bugfix in log_finalize.
	- Fix race condition between nsdc patch and server reload.

FEATURES:
	- AXFR/TCP fallback in case of failing IXFR zone transfers.
	- RFC 4635: support for hmac-sha1 and hmac-sha256 TSIG algorithm 
		identifiers, "Bugfix #130".
	- Configure the source ip-address for notifies (master) and zone
		requests (slave) in nsd.conf, "Bugfix #148".
	- nsd-notify and nsd-xfer allow you to configure the outgoing 
		hostname and source port, in addition to the source address.
	- Additional debug and verbose log messages.

3.1.1
=============
BUG FIXES:
	- Try to avoid race conditions with NSD reloading and nsdc running, 
		by writing pidfile before closing old parent process.
	- Fixed NSEC3 memory leak in the case NSEC3 is not needed.
	- Fixed some memory leaks that happened on error, mostly on
		zone transfer errors.
	- Bugfix #191: nsd-checkconf allowed only (max_interfaces-1) interfaces.

FEATURES:
	- The number of maximum interfaces allowed is configurable with
		--with-max_interfaces=<number> (thanks John Lightsey).

3.1.0
=============
OPERATIONAL NOTES:
	- Default locations of nsd.db, ixfr.db & xfrd.state are changed to
          the /var/db/nsd directory.

BUG FIXES:
	- Zone compiler gives more sane error messages when out of
	  diskspace and bug #172: when compiling single zone file.
	- Changed man pages format from mdoc to mansun, to support the Solaris OS.
	- Log tcp read error only when connection not reset by peer or when 
	  verbosity level is high.
	- RRs are compared without checking the TTL value.

FEATURES:
	- NSD is now NSEC3 enabled by default. You can disable it by configuring 
		NSD with --disable-nsec3.
	- Added "hide-version" configuration setting. Enabling this feature 
		stops NSD from answering to CHAOS class version requests.
	- Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/.
	- Report source and zone for denied AXFR attempts.

3.0.8
=============
FEATURES:
	- Better logging for nsd-notify (show 'broken' zone)
	- Add configuration for chkconfig to control nsd service.

BUG FIXES:
	- Fixed nsdc start when nsd already running: do not initialize server, 
		since it is already running.
	- Fixup bug where data related files are looked up in the wrong
	  directory when chrooted with chrootdir ending with a slash.
	- Fixup bug where nsd would return FORMERR if received an edns
	  query with version set to zero and rdlen larger than zero.
	- Fixed strptime, so that zonec will also work on systems with broken 
		strptime (like leopard :-))
	- Do not answer nsec3 wildcard information when DO bit is not set
	- Better logging when creating database failed.
	- Various spelling errors

3.0.7
=============
BUG FIXES:
	- Error handling for malformed IXFRs improved.
	- Fixed man pages, consistent syntax.

3.0.6
=============
FEATURES:
	- Report source and zone for denied AXFR attempts.

BUG FIXES:
	- More elegant handling of malformed nsec3 records from a zone 
	  transfer.
	- Fixup ignored return value in region-allocator.
        - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/.

3.0.5
=============
BUG FIXES:
	- Fixed problem with reload waiting very long. If the OS has a 
	  raging herd problem, NSD could block in a UDP operation and
	  that process would stop reload from finishing. Made UDP sockets 
	  nonblocking. 
	- Made TCP listen sockets nonblocking. NSD could block in accept.
	- Handle the new CERT RDATA types defined in RFC 4398 (submitted by 
	  Mans Nilsson).
	- Fixed a bug where zonec would choke on unknown CERT RDATA types.
	- Change nsd-notify retry timer from linear into exponential
	  backoff (submitted by Mans Nilsson).
	- Debug flag (-d) behavior changed. Nsd now also forks children when 
	  run in debug mode.
	- Added verbosity mode (-V <level>) for extra operational logging.
	- zonesdir default is /etc/nsd.  This can be overridden in nsd.conf.
	- if clients drop the tcp connection this does not result in a logfile
	  entry, unless verbosity is set 2 or more.

3.0.4
=============
BUG FIXES:
	- zonec will print an error when other data is put next to a CNAME.
	- Fixup unaligned memory access that could occur when reading ixfr.db
	  with a partial transfer inside.
	- Fixup for the WKS RR type printout by nsd-patch and nsd-xfer.
	- Error message 'could not read database CRC' now only given on error.
	- ./configure --zonesdir=<directory for zone files> now works to
	  set a default value for the zonesdir: <dir> nsd.conf directive.
	  Set zonesdir: "" to disable the change of directory.
	- Bug: reload crashes with log message 'continuing with old database',
	  and after that no more zone updates. Manual fix is to kill -HUP,
	  but now fixed in software to try to reload again (and again).
	- Small speedup where xfrd could briefly be busy-waiting.
	- If master sends IXFR with glue that is already present in the zone
	  this is silently accepted. Printed in debug mode -L 2. To make
	  the log file smaller.
	- Exponential backoff for zones that never worked to max of 4 hours.
	  For expired zones the SOA retry values are used.
	- allow-notify acl entries 'NOKEY' match only queries without TSIG.
	- Answers to valid notifies contained wrong RR counts in the header.
	  The notifies were processed correctly, but now the acknowledgement
	  reply is in correct DNS format.
FEATURES:
	- Added contrib/nsd.zones2nsd.conf python script to convert NSD 2 to
	  NSD 3 config files, contributed by Stephane Bortzmeyer.
	- The nsdc control script will print 'nsd startup failed' if the nsd
	  executable does not start (due to bad permissions, bad config, ...).

3.0.3
=============
BUG FIXES:
	- Bug #152: NSD would not use the identity from nsd.conf, fixed.
	- Bug #153: When running with thousands of secondary zones, NSD would
	  run out of UDP sockets. Caused crash on FreeBSD, errors on Linux
	  ('out of file descriptors'), depending on ulimits. Fixed.
	- Fixed getaddrinfo error message to be more descriptive.
	- Fallback to ip4 if getaddrinfo fails for ip6.
	- Will no longer lose a notify message during reloads (IPC).
	- Will no longer lose transfer in progress when notified for that zone.
	- Nicer error when operator forgets to rebuild after deleting a zone.

3.0.2
=============
BUG FIXES:
	- Nice error from zonec on a wrong configuration zone name.
	- Nicer warning from zonec when starting secondary zone with
	  no zone file for the first time.
	- nsdc makes more portable use of 'which' (for SunOS5.9/bash2.05).
	- Bug #143: Improved handling of zonesdir: directive and relative 
	  pidfile, database, diff file, xfrdfile paths in nsdc.sh and 
	  nsd-patch. They would not find the files.
	- Bug #144: LOC RRtype default values for precision wrong. Fixed.
	- Bug #145: NSD failed to reload cases of simultaneous zone transfer.
	- Bug #146: NSD fails to write to xfrdfile when chrooted. Fixed.
		Also fix for difffile when chrooted.
	- Bug #147: NSD runs out of memory. Fixed, memory is reused.
	  Occurred when running NSD with very big zones and large updates.
	- nsd -L 1 logging is smaller, -L 2 contains all debug information.
	  (only available for debug compiles).
	- Bug #149: Fixed text for NOTAUTH error code. When notify is not
	  authorised REFUSED error code returned instead.

3.0.1
=============
BUG FIXES:
	- nsd-patch prints SOA record at start of zone files.

3.0.0
=============
FEATURES:
	- AXFR/IXFR zone transfer supported.
		- NSD requests but does not provide IXFR transfers.
		- NSD keeps track of SOA timeouts for secondary zones.
	- TSIG authentication supported.
		- For queries, for notifies, for zone transfers.
	- NOTIFY messages of zone updates, incoming and outgoing.
	- DNAME type is supported, including CNAME synthesis.
	- config file, nsd.conf(5), place to put TSIG keys, server settings,
	  and lists of ip-addresses/ranges for AXFR/IXFR and NOTIFY.
	- prepared for NSEC3 (--enable-nsec3), experimental code for testing
	  in workshops.
	- prepared for NSID (--enable-nsid), experimental code for testing in 
	  workshops.

OPERATIONAL NOTES:
	- config file needed, nsd.conf(5) supersedes nsd.zones and nsdc.conf.
	- AXFR transfers are denied by default. Allow in config file.
	- Zones only become secondary with "request-xfr:" items in config file.
	- NSD produces "ixfr.db" file with a journal of zone transfers.
	  Use nsdc patch to merge changes back to zone files and remake db.
	- NSD produces "xfrd.state" file with zone timeout information.
	  The file is text formatted.
	- NSD sends notifies automatically,
	  nsd-notify is deprecated and will be removed from the package. 
	- NSD requests AXFR/IXFR and reloads the updates automatically, 
	  nsd-xfer is deprecated and will be removed from the package.
	- Check your config file with nsd-checkconf.

BUG FIXES: 
	- contains all bug fixes from 2.3.5 and before.
	- The sighandler() bug is fixed more thoroughly,
	  by using pipes for interprocess communication.
	- CNAMEs are followed by the server to different zones and
	  information from that zone is returned. This saves a followup
	  query.
	- bug fixes (ported) 2.3.6.
		- nsd-notify will retry max 15 times 5 second retries.
		- Bug #105: nsdc lacks locking, fixed locking for root user.
		- Bug #134: nsd: make -N <large number> work again
		- Bug #135: Typo in locking code for nsdc, fixed.
		- uninitialised variable fixed.
		- unaligned memory access (on Solaris SPARC), in zonec 
		  LOC parsing, fixed.
		- Bug #138: nsd aborts trying to bind all interfaces if ip6 
		  is not enabled, instead it will fallback to ip4.
		- Bug #139: resync timer for stats to whole minute.
		- Bug #140: NSD did not clear CD bit on authoritative answers.
		- Bug #141: NSD did not clear flags on a formerror reply.

2.3.5
=============
BUG FIXES:
        - Bug #132: regression, nsd: fix compile with --disable-ipv6
        - Makefile: remove gnuisms

2.3.4
=============
BUG FIXES:
        - Unknown type codes for type code numbers > 48 and < 97 work again.       
          (this implies --enable-checking can be enabled again)
        - nsd: sighandler() fixes
	- Bug #118: nsd: nsd_notify waits for a response. Will retry the notify
	  after a timeout.
        - Bug #124: $(DESTDIR) was added to Makefile.in. 
	- Bug #128: zonec: parser can handle \\ at the end of a string.
        - zonec: lexer: add \r to the newline delimeter
        - zonec: use strtol with an explicit base 10 as parameter.
          (Scott Rose, Roy Arends)
        - nsd-xfer: print human readable error codes. Change logging to 
          be more in line with the rest

2.3.3
=============
BUG FIXES:
        - Apply the correct patch to nsdc.sh.in. 

2.3.2
=============
FEATURES:
        - Bug #101: add support for the SPF record.

BUG FIXES:
        - Bug #100: replaced non-portable use of timegm(3) with
          portable implementation (mktime_from_utc).
        - Bug #103: nsd: trim the SOA's TTL to the MINIMUM value when returning a 
          negative answer.
        - Bug #104: nsd: add a time_t timestamp to the log when logging to
          a file.
        - Bug #105: nsdc: use a lock file when rebuilding the database (patch by
          Jakob Schlyter/Ted Lindgreen/Sebastian/Ondrej Sury).
        - Bug #106: zonec: don't walk all 256 NSEC windows when that is not
          needed.
        - Bug #107: zonec: fixed a crash when encountering bad unknown rdata.
        - nsd: Don't print: "error: nsd is already running as <pid>, stopping"
          when in fact NSD continues to run.
        - nsd: Minimize the race window in sig_handler().

2.3.1
=============
BUG FIXES:
        - zonec: Don't crash when generating error messages outside of zone
          files.
        - nsd: when logging to a file the pid is now printed.
        - nsd: Reset 'boot' time in statistics when reloading the database,
          since the statistics are reset to 0 on a reload.
        - nsd-xfer.c: Added '-a' option to specify local address to connect
          from.  Original patch supplied by Walter Hop <nsd@walter.transip.nl>.
        - Bug #98: Allow mnemonics for DS and RRSIG algorithm field.

2.3.0
=============
FEATURES:
        - DNSSEC is now enabled by default. NSD should be fully
          compliant with RFC4033, RFC4034, and RFC4035.

BUG FIXES:
        - nsd: Ensure that the number of -a flags does not exceed the
          maximum specified by MAX_INTERFACES in config.h.
        - nsd-xfer: Use serial number arithmetic (RFC1982) for the
          zone serial check
        - nsdc: Don't pass (fake) serial number to nsd-xfer if the
          zone file does not exist.
        - zonec: Loading many zones would cause namedb_find_zone to
          slow down, performance patch by Kazunori Fujiwara.
        - Bug #96: nsd-xfer did not handle 8-bit domain names
          correctly.

2.2.1
=============
FEATURES:
        - The message priority is now included when logging to a file.

BUG FIXES:
        - Zero length RDATA using the unknown RR notation was not
          working (except for the APL RR type).
        - Bug #93: './configure' error message containing a comma must
          be properly bracketed.
        - Bug #94: nsd-xfer: Handle unexpected EOF when receiving AXFR
          data.  Timeout if no data is received for more than 120
          seconds (see the TCP_TIMEOUT parameter in config.h).
        - Bug #95: An owner starting with an asterisk label ("*") was
          being treated as its own wildcard child.

2.2.0
=============
FEATURES:
        - nsd-xfer: replacement program for named-xfer to perform zone
          transfers using AXFR. TSIG is supported by nsd-xfer but not
          yet by the nsd server. DNSSEC is also supported.  TSIG
          requires OpenSSL version 0.9.7 or higher, configure using
          --disable-tsig if you do not have OpenSSL installed.
          Configure using --with-ssl=path if OpenSSL is not installed
          at a standard location.

CODE CHANGES:
        - New data structure 'buffer_type' for representing binary
          buffers that can be read, written, and resized.  Data in
          these buffers is stored in network byte order.  This data
          structure replaces the iobuf field of 'struct query'.

BUG FIXES:
        - Fixed endian problem in WKS record.
        - Protocol can now be specified numerically in WKS record.
        - Allow escape sequences (\DDD) in TTL, RR class, and RR type.
        - The zone compiler now accepts many more characters in
          unquoted strings such as domain name labels.  The characters
          no longer need to be escaped with a backslash.
        - Close included files after reading.
        - Maximum TCP message size is now 65535 bytes.  AXFR response
          packets are still limited to 16383 bytes for optimal
          compression of dnames.
        - The TSIG key for AXFRs can now also be stored in the file
          <zonename>.tsiginfo.  This makes it possible to use TSIG
          with multiple master servers.
        - Signals are no longer blocked while performing I/O so the
          server should respond quicker to signals.
        - Fixed parsing of LOC rdata.  Fractions and altitude were not
          handled correctly.

2.1.5
=============
BUG FIXES:
        - Bug #90: handle \000 in TXT records correctly
        - Fixed undefined behavior in the use of vsnprintf when
          logging messages.  This caused crashes on Linux/PPC.

2.1.4
=============
BUG FIXES:
        - nsdc: Fixed a typo that caused AXFRs to stop working.

2.1.3
=============
FEATURES:
        - nsd: The pidfile can be specified using the '-P' option.

BUG FIXES:
        - Bug #87: allow @ in the rdata
        - Bug #88: allow ::FFFF:ipv4addr in AAAA records
        - Bug #89: Count the number of queries received over TCP,
          instead of the number of TCP connections.
        - Zonec: when - is used as input, set the filename to 'STDIN'.
        - The nsdc script handles failed AXFRs more gracefully.
        - NSD emits an error when it sees bitlabels (RFC 2673).
        - Only copy the CD bit when DNSSEC is enabled.

2.1.2
=============
FEATURES:
        - NSD now fully supports unknown record types using the
          notation specified in RFC3597.
        - Support for the following RR types has been added: WKS, X25,
          ISDN, RT, NSAP, PX, NAPTR, KX, CERT, DNAME, and APL.  DNAME
          special processing is not supported.

BUG FIXES:
        - Bug #84: NSD now uses SIGUSR1 instead of SIGILL to report stats.
        - Bug #85: Support for WKS records.
        - Bug #86: The characters "#%&^[]?" can now be used without
          backslash in zone file domain names.
        - Plugin callback return type fixed.
        - The maximum message length for IPv6 UDP packets is now
          limited to the IPv6 minimum MTU (1280) unless the
          IPV6_USE_MIN_MTU socket option is supported.

2.1.1
=============
BUG FIXES:
        - Bug #81: Handle unknown types correctly.
        - Bug #82: Zonec: don't report "0 errors" unless -v is
          specified.
        - Bug #83: Close zone files after parsing.
        - Handle AFSDB RR type.

2.1.0
=============
FEATURES:
        - New networking code allows a single server to handle both
          UDP and TCP connections.  By default up to 10 simultaneous
          TCP connections are supported.  Use the '-n' flag to change
          the default.

2.0.2
=============
BUG FIXES:
        - Allow the use of a mnemonic for the algorithm field of a
          DNSKEY record.
        - Behavior of the zonec -v flag has been modified.  By default
          zonec will only print a single line with a summary of the
          error count.
        - Bug #75: Fixed typo in previous "fix".

2.0.1
=============
BUG FIXES:
        - Queries for QTYPE DS (DNSSEC) were not handled correctly in
          certain cases.
        - Partial support for unknown RRs.  Known RR types with
          unknown RR data format is not yet supported.
        - Bug #75: Fixed bad error message when nsdc update is run for
          the first time.
        - Bug #78: Multiple zones, each with include directives, are
          now compiled correctly.

2.0.0
=============
FEATURES:
        - Experimental DNSSEC support implemented, but disabled by
          default.  Enable using the --enable-dnssec configuration
          option.
        - IPv6 enabled by default.  Disable using the --disable-ipv6
          configuration option.

BUG FIXES:
        - Bug #47: Domain name is now logged when a notify is
          received.
        - Bug #70: First include all A records in the additional
          section, followed by AAAA records.
        - Bug #77: Check length of domain name and label.
        - LOC records are supported again.

1.4.0-alpha1
=============
FEATURES:
        - New database format that is much more compact and portable
          across architectures.
        - The new zone compiler is now the default and the old zone
          compiler has been removed.
        - Name compression is done dynamically, removing one other
          difference with BIND in the responses generated (the full
          query name is now used for compression).
        - CNAME target records are now generated from wildcard
          records if necessary.

REGRESSIONS:
        - mmap(2) isn't currently supported.
        - Not all RR types are supported by zonec (such as LOC).

1.3.0-alpha1
=============
FEATURES:
        - New name lookup algorithm.  This required a change to the
          database format.  Performance should increase at the expense
          of database size and memory usage.
        - New zone compiler (zonec2) based on flex and yacc, fully RFC
          compliant (still in alpha).
        - Database can be loaded using mmap(2) (use the --enable-mmap
          configure option to enable).  This is useful on operating
          systems such as Solaris that do not allow memory overcommit.
        - Region based memory allocation and resource management.
        - New internal format for storing domain names.  Each dname
          now includes an array of label offsets within the domain
          name.
        - Updates to the plugin API.

BUG FIXES:
        - Bug #65: The syslog facility is now a compile time option
          (--with-facility=FACILITY).  The default facility is DAEMON.
        - Bug #66: Automatic periodic dumping of the statistics (using
          the -s option) is now continued after a database reload.

1.2.4
=============
BUG FIXES:
        - Bug #72: If an RRset for a child domain is defined before
          the RRset of the parent domain the parent's RRset would be
          "lost".

1.2.3
=============
BUG FIXES:
        - Bug #65: The syslog facility is now a compile time option
          (--with-facility=FACILITY).  The default facility is DAEMON.
        - Bug #66: Automatic periodic dumping of the statistics (using
          the -s option) is now continued after a database reload.
        - NSD would try to kill pid -1 on startup if forking of a child
          process failed.
        - Do not log EAGAIN errors on calls to recvfrom.  These errors
          should be harmless.

1.2.2
=============
BUG FIXES:
        - Bug #59: NSD returns FORMERR when the query name is >= 246
          bytes.
        - Bug #60: Zonec runs out of file descriptors with many zones.
        - Bug #61: nsdc uses /bin/sh hardwired (and should not).
        - Bug #62: NSD is not able to log to a file.
        - Bug #63: nsdc update and zonec are too talkative.
        - Bug #64: Answer for request of a host resolved by a
          wildcard-resource-record is not understandable by dig.

1.2.1
=============
BUG FIXES:
        - AXFR terminates early if a zone contains a CNAME pointing
          the the zone's domain name (SOA record) (bug #56).
        - During an AXFR memory above the top of the stack was
          accessed.  This could lead to occasional AXFR errors (bad
          packets).
        - NSD now prints its version number and exits when invoked
          with the -v flag (bug #57).
        - NSD prints help information and exits when invoked with the
          -h flag.

1.2.0
=============
FEATURES:
        - NSD is now a single parent process (handling child
          termination and database reloads) plus multiple UDP and TCP
          child processes handling queries.  Before the parent process
          also handled UDP queries.  This change simplifies the parent
          and child processes and allows the use of multiple
          concurrent UDP servers.
        - Experimental plugin support.  This required a minor,
          incompatible change to the database format.  Make sure you
          recompile your database.  Use --enable-plugins to enable.
        - Full IPv6 support (for multi-homing and for Linux, thanks to
          Colm MacCárthaigh and Jun-ichiro itojun Hagino).  Use
          --enable-ipv6 to enable.
        - Support for multi-homing with TCP connections.
        - Support for SunOS 4.x has been dropped.

CODE CHANGES:
        - NSD should now conform to the Single Unix Specification
          (http://www.unix.org/).
        - Const correctness for strings and some other data types.
        - Removed code for Berkeley DB, hash tables, and mmap(2).
        - Separate preprocessor flags from code flags (CPPFLAGS and
          CFLAGS).
        - Use uint8_t instead of u_char, uint{16,32}_t instead of
          u_int{16,32}_t.
        - Fixed warnings from mixing signed and unsigned types.
        - Use sigaction(2) instead of signal(2).
        - The query_process function has been split up for clarity.

BUG FIXES:
        - CHAOS TXT queries failed on big-endian machines.
        - Portability fixes for Tru64 (thanks to Stephane Bortzmeyer),
          HP-UX, and MacOS X (thanks to Ronald van der Pol).
        - Removed compile time limit on maximum number of TCP child
          servers.
        - Support for debugging UDP and TCP queries.
        - Always ensure there is enough room for the EDNS record when
          answering a query with EDNS enabled.

1.1
=============
FEATURES:
        - ANSI C
        - autoconf/configure
        - new parser
        - support for various RR types in zonec
        - support for UNKN RR types

BUG FIXES:
        - lots of zone parsing errors eliminated
        - empty node matching bug gives NXDOMAIN

1.0.3
=============
This release is a bug fix release and does not add any new features.

BUG FIXES:
        - Ignore SIGPIPE errors (bug #43).
        - Keep track of TCP child servers and restart if necessary.
          (bug #55)
        - Handle database reload failures correctly.
        - Close UDP sockets in TCP child servers.
        - Handle escaped characters (besides \.) in labels.
        - Preserve the query's RD flag in the answer.

1.0.2
=============
FEATURES:
        - -DBIND8_STATS to enable bind8 like [NX]STATS
        - -t flag to make nsd chroot to a certain directory
        - -s flag to make nsd produce statistics every s seconds
        - /etc/nsd/nsdc.conf to overwrite default variables
          for nsdc.sh
        - less loggin and more radical tcp connection (mis)handling
        - prefork -n processes to handle tcp connections
        - multiple -a flags

CHANGES:
        - named.stats file functionality is removed

BUG FIXES:
        - couple of pedantic fixes in C code
        - last zone in database axfr bug fixed
        - nsdc update wont update bug fixed

1.0.1
=============

FEATURES:
        - NSD drops permissions after binding the sockets
        - ``cache'' zones are no longer allowed
        - ID.Server & Version.Server compile time options
        - AXFR implemented (with tcpwrapper for access control)
        - nsdc update and nsdc notify functionality
        - using named-xfer with TSIG for inbound axfr


CHANGES:
        - the order of records in the database is from now
          on significant
        - since Berkeley DB doesnt define order for sequential
          access it is no longer supported

BUG FIXES:
        - white space problem in zonec is fixed

KNOWN BUGS:
        - please see appropriate man pages for the known bugs

1.0.0 RELEASE
=============

KNOWN BUGS:

- Although NSD allows one to configure a zone without SOA record and
  use it as so called ``cached'' non-authoritative data, it is decided
  that having this functionality is wrong, dangerous and will be removed
  from the further versions.

- If while processing EDNS(0) OPT record NSD encounters bad EDNS(0)
  version it will answer with Format Error instead of EDNS(0) BADVERS

PLATFORMS:

        Tested and working on i386 FreeBSD-4.4, i386 Linux, dec alpha Linux,
        sparc SunOS 4.x


1.0.0-BETA2
===========

FIXES:
        - wildcards bug fixed
        - AA bit for class ANY bug fixed
        - minor coredumps with really broken zones in zonec fixed
        - linux & SunOS port

1.0-ALPHA2
==========
FIXES:
        - IPv6 transport support added by Jun-ichiro itojun Hagino (Use -DINET6)
        - Makefile modified for easier compile time configuration
        - EDNS(0) bug fixed
        - Default database changed to all lowercase, red-black tree to make nsd
          DNSSEC ready
        - REQUIREMENTS are cleaned up and updated
        - Signal names changed in nsdc.sh.in
        - Default compile options dont include -DMIMIC_BIND8