diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index e95043ce03..2f34646d67 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -349,6 +349,14 @@ If the key\*(Aqs revocation date is set and in the past, and the key is publishe .RS 4 If either of the key\*(Aqs unpublication or deletion dates are set and in the past, the key is NOT published or used to sign the zone, regardless of any other metadata\&. .RE +.PP +.RS 4 +If key\*(Aqs sync publication date is set and in the past, synchronization records (type CDS and/or CDNSKEY) are created\&. +.RE +.PP +.RS 4 +If key\*(Aqs sync deletion date is set and in the past, synchronization records (type CDS and/or CDNSKEY) are removed\&. +.RE .RE .PP \-T \fIttl\fR diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html index 45d84c12db..4e8e7967af 100644 --- a/bin/dnssec/dnssec-signzone.html +++ b/bin/dnssec/dnssec-signzone.html @@ -519,6 +519,22 @@ zone, regardless of any other metadata.

+
+
+

+ If key's sync publication date is set and in the past, + synchronization records (type CDS and/or CDNSKEY) are + created. +

+
+
+
+

+ If key's sync deletion date is set and in the past, + synchronization records (type CDS and/or CDNSKEY) are + removed. +

+
-T ttl
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 6019d08119..5f4e0c96d7 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -1501,17 +1501,17 @@ notrace. All debugging messages in the server have a debug print-time can be set to yes, no, or a time format specifier, which may be one of - local, iso8601 or - iso8601-utc. If set to + local, iso8601 or + iso8601-utc. If set to no, then the date and time will not be logged. If set to yes - or local, the date and time are logged + or local, the date and time are logged in a human readable format, using the local time zone. - If set to iso8601 the local time is + If set to iso8601 the local time is logged in ISO8601 format. If set to - iso8601-utc, then the date and time + iso8601-utc, then the date and time are logged in ISO8601 format, with time zone set to - UTC. The default is local. + UTC. The default is local.

print-time may @@ -3045,7 +3045,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]

Specifies the directory in which to store the configuration parameters for zones added via rndc addzone. - By default, this is the working directory. + By default, this is the working directory. If set to a relative + path, it will be relative to the working directory.

named-xfer
@@ -3671,12 +3672,14 @@ options {

Specifies the TTL to be returned on stale answers. - The default is 1 second. The minimal allowed is + The default is 1 second. The minimum allowed is also 1 second; a value of 0 will be updated silently - to 1 second. For stale answers to be returned + to 1 second. For stale answers to be returned, + they must be enabled (either in the configuration file + using stale-answer-enable or via + rndc), and max-stale-ttl must be set to a - non zero value and they must not have been disabled - by rndc. + nonzero value.

serial-update-method
@@ -4330,17 +4333,21 @@ options { nocookie-udp-size option.

-
serve-stale-enable
+
stale-answer-enable

Enable the returning of stale answers when the nameservers for the zone are not answering. This - is off by default but can be enabled/disabled via - rndc server-stale on and - rndc server-stale off which - override the named.conf setting. rndc - server-stale reset will restore control - via named.conf. + is off by default, but can be enabled/disabled via + rndc serve-stale on and + rndc serve-stale off, which + override the named.conf + setting. rndc serve-stale reset + restores the setting to the one specified in + named.conf. Note that + reloading or reconfiguring named + will not re-enable serving of stale records if they + have been disabled via rndc.

nocookie-udp-size
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 7684f75b8d..473dd3dede 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -41,7 +41,7 @@
Introduction
Download
License Change
-
Windows XP No Longer Supported
+
Legacy Windows No Longer Supported
Security Fixes
New Features
Removed Features
@@ -97,10 +97,11 @@ anything other than the changes you made to our software.

- This requirement will not affect anyone who is using BIND - without redistributing it, nor anyone redistributing it without - changes, therefore this change will be without consequence - for most individuals and organizations who are using BIND. + This requirement will not affect anyone who is using BIND, with + or without modifications, without redistributing it, nor anyone + redistributing it without changes. Therefore, this change will be + without consequence for most individuals and organizations who are + using BIND.

Those unsure whether or not the license change affects their @@ -112,10 +113,10 @@

-Windows XP No Longer Supported

+Legacy Windows No Longer Supported

- As of BIND 9.11.2, Windows XP is no longer a supported platform for - BIND, and Windows XP binaries are no longer available for download + As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported + platforms for BIND; "XP" binaries are no longer available for download from ISC.

@@ -343,13 +344,14 @@ zone's validated CDS or CDNSKEY records. It can produce a dsset file suitable for input to dnssec-signzone, or a series of - nsupdate to update the parent zone via dynamic - DNS. Thanks to Tony Finch for the contribution. [RT #46090] + nsupdate commands to update the parent zone + via dynamic DNS. Thanks to Tony Finch for the contribution. + [RT #46090]

  • - nsupdate and rndc now accepts + nsupdate and rndc now accept command line options -4 and -6 which force using only IPv4 or only IPv6, respectively. [RT #45632]

    @@ -534,13 +536,17 @@ these algorithms must be supported in OpenSSL; currently they are only available in the development branch of OpenSSL at - https://github.com/openssl/openssl. + + https://github.com/openssl/openssl. [RT #44696]

  • - EDNS KEY TAG options are verified and printed. + When parsing DNS messages, EDNS KEY TAG options are checked + for correctness. When printing messages (for example, in + dig), EDNS KEY TAG options are printed + in readable format.

    • @@ -679,15 +685,6 @@ are now fully rolled back in the event of failure. [RT #45841]

    -
  • -

    - Fixed a bug that was introduced in an earlier development - release which caused multi-packet AXFR and IXFR messages to fail - validation if not all packets contained TSIG records; this - caused interoperability problems with some other DNS - implementations. [RT #45509] -

    -

  • Multiple cookie-secret clauses are now diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index 6e508297af..0127511523 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -241,7 +241,7 @@

    Introduction
    Download
    License Change
    -
    Windows XP No Longer Supported
    +
    Legacy Windows No Longer Supported
    Security Fixes
    New Features
    Removed Features
    diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index 4a3e6f6219..893fbe67b9 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -537,6 +537,22 @@ zone, regardless of any other metadata.

    +
    +
    +

    + If key's sync publication date is set and in the past, + synchronization records (type CDS and/or CDNSKEY) are + created. +

    +
    +
    +
    +

    + If key's sync deletion date is set and in the past, + synchronization records (type CDS and/or CDNSKEY) are + removed. +

    +
    -T ttl
    diff --git a/doc/arm/notes.html b/doc/arm/notes.html index d6b8439792..68c5ed226d 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -57,10 +57,11 @@ anything other than the changes you made to our software.

    - This requirement will not affect anyone who is using BIND - without redistributing it, nor anyone redistributing it without - changes, therefore this change will be without consequence - for most individuals and organizations who are using BIND. + This requirement will not affect anyone who is using BIND, with + or without modifications, without redistributing it, nor anyone + redistributing it without changes. Therefore, this change will be + without consequence for most individuals and organizations who are + using BIND.

    Those unsure whether or not the license change affects their @@ -72,10 +73,10 @@

    -Windows XP No Longer Supported

    +Legacy Windows No Longer Supported

    - As of BIND 9.11.2, Windows XP is no longer a supported platform for - BIND, and Windows XP binaries are no longer available for download + As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported + platforms for BIND; "XP" binaries are no longer available for download from ISC.

    @@ -303,13 +304,14 @@ zone's validated CDS or CDNSKEY records. It can produce a dsset file suitable for input to dnssec-signzone, or a series of - nsupdate to update the parent zone via dynamic - DNS. Thanks to Tony Finch for the contribution. [RT #46090] + nsupdate commands to update the parent zone + via dynamic DNS. Thanks to Tony Finch for the contribution. + [RT #46090]

  • - nsupdate and rndc now accepts + nsupdate and rndc now accept command line options -4 and -6 which force using only IPv4 or only IPv6, respectively. [RT #45632]

    @@ -494,13 +496,17 @@ these algorithms must be supported in OpenSSL; currently they are only available in the development branch of OpenSSL at - https://github.com/openssl/openssl. + + https://github.com/openssl/openssl. [RT #44696]

  • - EDNS KEY TAG options are verified and printed. + When parsing DNS messages, EDNS KEY TAG options are checked + for correctness. When printing messages (for example, in + dig), EDNS KEY TAG options are printed + in readable format.

    • @@ -639,15 +645,6 @@ are now fully rolled back in the event of failure. [RT #45841]

    -
  • -

    - Fixed a bug that was introduced in an earlier development - release which caused multi-packet AXFR and IXFR messages to fail - validation if not all packets contained TSIG records; this - caused interoperability problems with some other DNS - implementations. [RT #45509] -

    -

  • Multiple cookie-secret clauses are now