+[no]ednsnegotiation+ Enable / disable EDNS version negotiation. By default + EDNS version negotiation is enabled. +
+[no]ednsopt[=code[:value]]
Specify EDNS option with code point code
@@ -654,13 +659,18 @@
is provided for backwards compatibility. The "vc"
stands for "virtual circuit".
+[no]zflag+ Set [do not set] the last unassigned DNS header flag in a + DNS query. This flag is off by default. +
The BIND 9 implementation of dig supports @@ -706,7 +716,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
If dig has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -720,14 +730,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
host(1), named(8), dnssec-keygen(8), @@ -735,7 +745,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
There are probably too many query options.
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index b4d43ff7b9..02da08907a 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -70,19 +70,19 @@Changing a zone from insecure to secure can be done in two ways: using a dynamic DNS update, or the auto-dnssec zone option.
@@ -1244,7 +1244,7 @@ options { keys can be done in two ways: using a dynamic DNS update, or the auto-dnssec zone option. +Dynamic DNS update method To perform key rollovers via dynamic update, you need to add
the K* files for the new keys so that
named can find them. You can then add the new
@@ -1266,7 +1266,7 @@ options {
named will clean out any signatures generated
by the old key after the update completes.
When a new key reaches its activation date (as set by dnssec-keygen or dnssec-settime), if the auto-dnssec zone option is set to @@ -1281,7 +1281,7 @@ options { completes in 30 days, after which it will be safe to remove the old key from the DNSKEY RRset.
+NSEC3PARAM rollovers via UPDATEAdd the new NSEC3PARAM record via dynamic update. When the new NSEC3 chain has been generated, the NSEC3PARAM flag field will be zero. At this point you can remove the old NSEC3PARAM @@ -1323,7 +1323,7 @@ options { adjusted so as to spread the re-sign load over time rather than all at once.
+NSEC3 and OPTOUT
named only supports creating new NSEC3 chains
where all the NSEC3 records in the zone have the same OPTOUT
@@ -1452,7 +1452,7 @@ $ dnssec-signzone -S -K keys example.net<
See the documentation provided by your HSM vendor for
information about installing, initializing, testing and
@@ -1461,7 +1461,7 @@ $
Native PKCS#11 mode will only work with an HSM capable of carrying
out every cryptographic operation BIND 9 may
@@ -1495,7 +1495,7 @@ $
OpenSSL-based PKCS#11 mode uses a modified version of the
OpenSSL library; stock OpenSSL does not fully support PKCS#11.
@@ -1553,7 +1553,7 @@ $
To link with the PKCS#11 provider, threads must be
enabled in the BIND 9 build.
@@ -1750,7 +1750,7 @@ $
To link with the PKCS#11 provider, threads must be
enabled in the BIND 9 build.
@@ -1772,7 +1772,7 @@ $
BIND 9 includes a minimal set of tools to operate the
HSM, including
@@ -1816,7 +1816,7 @@ $
For OpenSSL-based PKCS#11, we must first set up the runtime
environment so the OpenSSL and PKCS#11 libraries can be loaded:
@@ -1937,7 +1937,7 @@ example.net.signed
When using OpenSSL-based PKCS#11, the "engine" to be used by
OpenSSL can be specified in named and all of
@@ -1969,7 +1969,7 @@ $
If you want named to dynamically re-sign zones
using HSM keys, and/or to to sign new records inserted via nsupdate,
@@ -2056,7 +2056,7 @@ $
A DLZ database is configured with a dlz
statement in
For guidance in implementation of DLZ modules, the directory
@@ -4723,6 +4725,8 @@ avoid-v6-udp-ports {};
when the name server is first starting up, or when
zones have been newly added to the nameserver.
The default is 20 per second.
+ The lowest possible rate is one per second; when set
+ to zero, it will be silently raised to one.
@@ -4735,6 +4739,8 @@ avoid-v6-udp-ports {};
serial-query-rate option, an
integer, is the maximum number of queries sent
per second. The default is 20 per second.
+ The lowest possible rate is one per second; when set
+ to zero, it will be silently raised to one.
@@ -5104,7 +5110,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
@@ -6156,7 +6162,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
BIND 9 provides the ability to filter
out DNS responses from external DNS servers containing
@@ -7157,7 +7163,7 @@ example.com CNAME rpz-tcp-only.
The statistics-channels statement
@@ -7273,7 +7279,7 @@ example.com CNAME rpz-tcp-only.
The trusted-keys statement defines
@@ -7317,7 +7323,7 @@ example.com CNAME rpz-tcp-only.
The view statement is a powerful
feature
@@ -7777,10 +7783,10 @@ zone
The zone's name may optionally be followed by a class. If
a class is not specified, class
@@ -9051,7 +9057,7 @@ example.com. NS ns2.example.net.
When multiple views are in use, a zone may be
referenced by more than one of them. Often, the views
@@ -10924,7 +10930,7 @@ HOST-127.EXAMPLE. MX 0 .
Socket I/O statistics counters are defined per socket
types, which are
@@ -12212,7 +12218,7 @@ HOST-127.EXAMPLE. MX 0 .
Most statistics counters that were available
in BIND 8 are also supported in
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index efe5cdc6cd..a2a48e470f 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -46,7 +46,7 @@
Table of Contents
On UNIX servers, it is possible to run BIND
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index dd37c5ba52..547c489781 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -45,7 +45,7 @@
Table of Contents
+ dig +[no]ednsnegotiation can now be used enable /
+ disable EDNS version negotiation.
+
dig +header-only can now be used to send
queries without a question section.
@@ -182,6 +186,10 @@
to print TTL values with time-unit suffixes: w, d, h, m, s for
weeks, days, hours, minutes, and seconds.
+ dig +zflag can be used to set the last
+ unassigned DNS header flag bit. This bit in normally zero.
+
dig +dscp= [RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC1535] A Security Problem and Proposed Correction With Widely
+ [RFC1535] A Security Problem and Proposed Correction With Widely
Deployed DNS Software. October 1993. [RFC1536] Common DNS Implementation
+ [RFC1536] Common DNS Implementation
Errors and Suggested Fixes. October 1993. [RFC4074] Common Misbehaviour Against DNS
+ [RFC4074] Common Misbehaviour Against DNS
Queries for IPv6 Addresses. May 2005. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
+ [RFC2168] Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997. [RFC1876] A Means for Expressing Location Information in the
+ [RFC1876] A Means for Expressing Location Information in the
Domain
Name System. January 1996. [RFC2052] A DNS RR for Specifying the
+ [RFC2052] A DNS RR for Specifying the
Location of
Services. October 1996. [RFC2163] Using the Internet DNS to
+ [RFC2163] Using the Internet DNS to
Distribute MIXER
Conformant Global Address Mapping. January 1998. [RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC1101] DNS Encoding of Network Names
+ [RFC1101] DNS Encoding of Network Names
and Other Types. April 1989. [RFC1123] Requirements for Internet Hosts - Application and
+ [RFC1123] Requirements for Internet Hosts - Application and
Support. October 1989. [RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC1033] Domain administrators operations guide. November 1987. [RFC1033] Domain administrators operations guide. November 1987. [RFC1912] Common DNS Operational and
+ [RFC1912] Common DNS Operational and
Configuration Errors. February 1996. [RFC2825] A Tangled Web: Issues of I18N, Domain Names,
+ [RFC2825] A Tangled Web: Issues of I18N, Domain Names,
and the Other Internet protocols. May 2000. [RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC1464] Using the Domain Name System To Store Arbitrary String
+ [RFC1464] Using the Domain Name System To Store Arbitrary String
Attributes. May 1993. [RFC1713] Tools for DNS Debugging. November 1994. [RFC1713] Tools for DNS Debugging. November 1994. [RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
+ [RFC3258] Distributing Authoritative Name Servers via
Shared Unicast Addresses. April 2002. [RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
+ [RFC1712] DNS Encoding of Geographical
Location. November 1994. [RFC2065] Domain Name System Security Extensions. January 1997. [RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
+ [RFC3008] Domain Name System Security (DNSSEC)
Signing Authority. November 2000. [RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
+ [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
(RR) Secure Entry Point (SEP) Flag. April 2004. [RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. [RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. GNU make is required to build the export libraries (other
part of BIND 9 can still be built with other types of make). In
the reminder of this document, "make" means GNU make. Note that
@@ -912,7 +920,7 @@
Currently, win32 is not supported for the export
library. (Normal BIND 9 application can be built as
@@ -989,7 +997,7 @@ $ The IRS library supports an "advanced" configuration file
related to the DNS library for configuration parameters that
would be beyond the capability of the
@@ -1007,14 +1015,14 @@ $ Some sample application programs using this API are
provided for reference. The following is a brief description of
these applications.
It sends a query of a given name (of a given optional RR type) to a
specified recursive server, and prints the result as a list of
@@ -1078,7 +1086,7 @@ $
Similar to "sample", but accepts a list
of (query) domain names as a separate file and resolves the names
@@ -1119,7 +1127,7 @@ $
It sends a query to a specified server, and
prints the response with minimal processing. It doesn't act as a
@@ -1160,7 +1168,7 @@ $
This is a test program
to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -1177,7 +1185,7 @@ $
It accepts a single update command as a
command-line argument, sends an update request message to the
@@ -1272,7 +1280,7 @@ $
It checks a set
of domains to see the name servers of the domains behave
@@ -1329,7 +1337,7 @@ $ As of this writing, there is no formal "manual" of the
libraries, except this document, header files (some of them
provide pretty detailed explanations), and sample application
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 76f33cce51..ca9c0e6b17 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -114,19 +114,19 @@
arpaname translates IP addresses (IPv4 and
IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
tsig-keygen and ddns-confgen
are invocation methods for a utility that generates keys for use
@@ -87,7 +87,7 @@
delv
(Domain Entity Lookup & Validation) is a tool for sending
DNS queries and validating the results, using the the same internal
@@ -96,7 +96,7 @@
delv
provides a number of query options which affect the way results are
displayed, and in some cases the way lookups are performed.
@@ -465,12 +465,12 @@
dig(1),
named(8),
RFC4034,
diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html
index 3dce9e7932..02113ccba5 100644
--- a/doc/arm/man.dig.html
+++ b/doc/arm/man.dig.html
@@ -52,7 +52,7 @@
dig
(domain information groper) is a flexible tool
for interrogating DNS name servers. It performs DNS lookups and
@@ -99,7 +99,7 @@
The dig
provides a number of query options which affect
the way in which lookups are made and the results displayed. Some of
@@ -409,6 +409,11 @@
accepted. Setting a named flag (e.g. DO) will silently be
ignored. By default, no Z bits are set.
+ Enable / disable EDNS version negotiation. By default
+ EDNS version negotiation is enabled.
+
Specify EDNS option with code point
+ Set [do not set] the last unassigned DNS header flag in a
+ DNS query. This flag is off by default.
+
The BIND 9 implementation of dig
supports
@@ -724,7 +734,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
If dig has been built with IDN (internationalized
domain name) support, it can accept and display non-ASCII domain names.
@@ -738,14 +748,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
host(1),
named(8),
dnssec-keygen(8),
@@ -753,7 +763,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
There are probably too many query options.
dnssec-checkds
verifies the correctness of Delegation Signer (DS) or DNSSEC
Lookaside Validation (DLV) resource records for keys in a specified
@@ -59,7 +59,7 @@
dnssec-coverage
verifies that the DNSSEC keys for a given zone or a set of zones
have timing metadata set properly to ensure no future lapses in DNSSEC
@@ -78,7 +78,7 @@
dnssec-dsfromkey
outputs the Delegation Signer (DS) resource record (RR), as defined in
RFC 3658 and RFC 4509, for the given key(s).
The keyfile can be designed by the key identification
dnssec-keygen(8),
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
@@ -189,7 +189,7 @@
dnssec-importkey
reads a public DNSKEY record and generates a pair of
.key/.private files. The DNSKEY record may be read from an
@@ -71,7 +71,7 @@
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
@@ -142,7 +142,7 @@
A keyfile can be designed by the key identification
dnssec-keygen(8),
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
@@ -159,7 +159,7 @@
dnssec-keyfromlabel
generates a key pair of files that referencing a key object stored
in a cryptographic hardware service module (HSM). The private key
@@ -66,7 +66,7 @@
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
@@ -315,7 +315,7 @@
When dnssec-keyfromlabel completes
successfully,
@@ -354,7 +354,7 @@
dnssec-keygen(8),
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
@@ -363,7 +363,7 @@
dnssec-keygen
generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
and RFC 4034. It can also generate keys for use with
@@ -64,7 +64,7 @@
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
@@ -359,7 +359,7 @@
To generate a 768-bit DSA key for the domain
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
RFC 2539,
@@ -435,7 +435,7 @@
dnssec-revoke
reads a DNSSEC key file, sets the REVOKED bit on the key as defined
in RFC 5011, and creates a new pair of key files containing the
@@ -58,7 +58,7 @@
dnssec-settime
reads a DNSSEC private key file and sets the key timing metadata
as specified by the
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
@@ -210,7 +210,7 @@
dnssec-settime can also be used to print the
timing metadata associated with a key.
@@ -236,7 +236,7 @@
dnssec-keygen(8),
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
@@ -244,7 +244,7 @@
dnssec-signzone
signs a zone. It generates
NSEC and RRSIG records and produces a signed version of the
@@ -61,7 +61,7 @@
The following command signs the dnssec-verify
verifies that a zone is fully signed for each algorithm found
in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
@@ -58,7 +58,7 @@
genrandom
generates a file or a set of files containing a specified quantity
@@ -59,7 +59,7 @@
host
is a simple utility for performing DNS lookups.
It is normally used to convert names to IP addresses and vice versa.
@@ -214,7 +214,7 @@
If host has been built with IDN (internationalized
domain name) support, it can accept and display non-ASCII domain names.
@@ -228,12 +228,12 @@
dig(1),
named(8).
Versions of BIND 9 up to and including BIND 9.6 had a bug causing
HMAC-SHA* TSIG keys which were longer than the digest length of the
@@ -76,7 +76,7 @@
Secrets that have been converted by isc-hmac-fixup
are shortened, but as this is how the HMAC protocol works in
@@ -87,14 +87,14 @@
named-checkconf
checks the syntax, but not the semantics, of a
named configuration file. The file is parsed
@@ -70,7 +70,7 @@
named-checkconf
returns an exit status of 1 if
errors were detected and 0 otherwise.
named-checkzone
checks the syntax and integrity of a zone file. It performs the
same checks as named does when loading a
@@ -71,7 +71,7 @@
named-checkzone
returns an exit status of 1 if
errors were detected and 0 otherwise.
named-journalprint
prints the contents of a zone journal file in a human-readable
@@ -76,7 +76,7 @@
named-rrchecker
read a individual DNS resource record from standard input and checks if it
is syntactically correct.
@@ -78,7 +78,7 @@
RFC 1034,
RFC 1035,
diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html
index 9185f6f475..1ce14ee1cc 100644
--- a/doc/arm/man.named.html
+++ b/doc/arm/man.named.html
@@ -50,7 +50,7 @@
named
is a Domain Name System (DNS) server,
part of the BIND 9 distribution from ISC. For more
@@ -65,7 +65,7 @@
In routine operation, signals should not be used to control
the nameserver; rndc should be used
@@ -302,7 +302,7 @@
The named configuration file is too complex
to describe in detail here. A complete description is provided
@@ -319,7 +319,7 @@
nsec3hash generates an NSEC3 hash based on
a set of NSEC3 parameters. This can be used to check the validity
@@ -56,7 +56,7 @@
nsupdate
is used to submit Dynamic DNS Update requests as defined in RFC 2136
to a name server.
@@ -236,7 +236,7 @@
The TSIG key is redundantly stored in two separate files.
This is a consequence of nsupdate using the DST library
diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index af10612700..e4c95a11ad 100644
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -50,7 +50,7 @@
rndc-confgen
generates configuration files
for rndc. It can be used as a
@@ -66,7 +66,7 @@
The name server must be configured to accept rndc connections and
to recognize the key specified in the rndc
controls the operation of a name
server. It supersedes the ndc utility
@@ -81,7 +81,7 @@
A list of commands supported by rndc can
be seen by running rndc without arguments.
@@ -606,7 +606,7 @@
There is currently no way to provide the shared secret for a
+ dig +[no]ednsnegotiation can now be used enable /
+ disable EDNS version negotiation.
+
dig +header-only can now be used to send
queries without a question section.
@@ -162,6 +166,10 @@
to print TTL values with time-unit suffixes: w, d, h, m, s for
weeks, days, hours, minutes, and seconds.
+ dig +zflag can be used to set the last
+ unassigned DNS header flag bit. This bit in normally zero.
+
dig +dscp=dnssec-signzone -S -K keys example.net<
./configure --enable-native-pkcs11 \
./configure --enable-native-pkcs11 \
$
@@ -1730,7 +1730,7 @@ $ wget http://www.openssl.org/source/openssl-0.9.8y.tar.gz
./Configure linux-x86_64 -pthread \
./configure CC="gcc -m32" --enable-threads \
./configure CC="cc -xarch=amd64" --enable-thre
$
cd ../bind9
$ ./configure --enable-threads \
@@ -1793,7 +1793,7 @@ $ ./configure --enable-threads \
./configure --enable-threads \
dnssec-signzone -E '' -S example.net
dnssec-signzone -E '' -S example.net
named.conf:
@@ -2105,7 +2105,7 @@ $ dnssec-signzone -E '' -S example.net
contrib/dlz/example contains a basic
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index e5b57744d7..8cc6654ffd 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -78,19 +78,19 @@
@@ -4716,6 +4716,8 @@ avoid-v6-udp-ports {};
requests due to initial zone loading are subject
to a separate rate limit; see below.) The default is
20 per second.
+ The lowest possible rate is one per second; when set
+ to zero, it will be silently raised to one.
managed-keys {
name initial-key flags protocol algorithm key-data ;
[ name initial-key flags protocol algorithm key-data ; [...]]
@@ -7455,7 +7461,7 @@ example.com CNAME rpz-tcp-only.
zone_name [
zone_name [
IN (for Internet),
@@ -8120,7 +8126,7 @@ zone zone_name [
value
can now be used to set the DSCP code point in outgoing query
@@ -427,7 +435,7 @@
DNS Security Proposed Standards
Other Important RFCs About DNS
Implementation
Resource Record Types
DNS and the Internet
DNS Operations
Internationalized Domain Names
Obsolete and Unimplemented Experimental RFC
$
./configure --enable-exportlib
$ [other flags]make
@@ -927,7 +935,7 @@ $ make
$
cd lib/export
$ make install
@@ -949,7 +957,7 @@ $ make install
make
make
make
make
make
make
sample-update -a sample-update -k Kxxx.+nnn+mm
sample-update -a sample-update -k Kxxx.+nnn+mm
-
@@ -135,18 +135,18 @@
-
@@ -194,19 +194,19 @@
@@ -224,7 +224,7 @@
arpaname {ipaddress ...}DESCRIPTION
+DESCRIPTION
ddns-confgen [-a ] [algorithm-h] [-k ] [keyname-q] [-r ] [ -s randomfilename | -z zone ]DESCRIPTION
+DESCRIPTION
delv [queryopt...] [query...]DESCRIPTION
+DESCRIPTION
QUERY OPTIONS
+QUERY OPTIONS
SEE ALSO
+SEE ALSO
dig [global-queryopt...] [query...]DESCRIPTION
+DESCRIPTION
OPTIONS
+OPTIONS
-b option sets the source IP address of the query
to address. This must be a valid
@@ -260,7 +260,7 @@
QUERY OPTIONS
+QUERY OPTIONS
+[no]ednsnegotiation+[no]ednsopt[=code[:value]]code
@@ -672,13 +677,18 @@
is provided for backwards compatibility. The "vc"
stands for "virtual circuit".
+[no]zflagMULTIPLE QUERIES
+MULTIPLE QUERIES
IDN SUPPORT
+IDN SUPPORT
SEE ALSO
+SEE ALSO
BUGS
+BUGS
dnssec-dsfromkey [-l ] [domain-f ] [file-d ] [dig path-D ] {zone}dsfromkey pathDESCRIPTION
+DESCRIPTION
dnssec-coverage [-K ] [directory-l ] [length-f ] [file-d ] [DNSKEY TTL-m ] [max TTL-r ] [interval-c ] [compilezone path-k] [-z] [zone]DESCRIPTION
+DESCRIPTION
dnssec-dsfromkey [-h] [-V]DESCRIPTION
+DESCRIPTION
FILES
+FILES
Knnnn.+aaa+iiiii or the full file name
@@ -173,13 +173,13 @@
SEE ALSO
+SEE ALSO
dnssec-importkey {-f } [filename-K ] [directory-L ] [ttl-P ] [date/offset-D ] [date/offset-h] [-v ] [level-V] [dnsname]DESCRIPTION
+DESCRIPTION
TIMING OPTIONS
+TIMING OPTIONS
FILES
+FILES
Knnnn.+aaa+iiiii or the full file name
@@ -151,7 +151,7 @@
SEE ALSO
+SEE ALSO
dnssec-keyfromlabel {-l label} [-3] [-a ] [algorithm-A ] [date/offset-c ] [class-D ] [date/offset-E ] [engine-f ] [flag-G] [-I ] [date/offset-i ] [interval-k] [-K ] [directory-L ] [ttl-n ] [nametype-P ] [date/offset-p ] [protocol-R ] [date/offset-S ] [key-t ] [type-v ] [level-V] [-y] {name}DESCRIPTION
+DESCRIPTION
TIMING OPTIONS
+TIMING OPTIONS
GENERATED KEY FILES
+GENERATED KEY FILES
SEE ALSO
+SEE ALSO
dnssec-keygen [-a ] [algorithm-b ] [keysize-n ] [nametype-3] [-A ] [date/offset-C] [-c ] [class-D ] [date/offset-E ] [engine-f ] [flag-G] [-g ] [generator-h] [-I ] [date/offset-i ] [interval-K ] [directory-L ] [ttl-k] [-P ] [date/offset-p ] [protocol-q] [-R ] [date/offset-r ] [randomdev-S ] [key-s ] [strength-t ] [type-v ] [level-V] [-z] {name}DESCRIPTION
+DESCRIPTION
TIMING OPTIONS
+TIMING OPTIONS
EXAMPLE
+EXAMPLE
example.com, the following command would be
@@ -426,7 +426,7 @@
SEE ALSO
+SEE ALSO
dnssec-revoke [-hr] [-v ] [level-V] [-K ] [directory-E ] [engine-f] [-R] {keyfile}DESCRIPTION
+DESCRIPTION
dnssec-settime [-f] [-K ] [directory-L ] [ttl-P ] [date/offset-A ] [date/offset-R ] [date/offset-I ] [date/offset-D ] [date/offset-h] [-V] [-v ] [level-E ] {keyfile}engineDESCRIPTION
+DESCRIPTION
-P, -A,
@@ -76,7 +76,7 @@
TIMING OPTIONS
+TIMING OPTIONS
PRINTING OPTIONS
+PRINTING OPTIONS
SEE ALSO
+SEE ALSO
dnssec-signzone [-a] [-c ] [class-d ] [directory-D] [-E ] [engine-e ] [end-time-f ] [output-file-g] [-h] [-K ] [directory-k ] [key-L ] [serial-l ] [domain-M ] [domain-i ] [interval-I ] [input-format-j ] [jitter-N ] [soa-serial-format-o ] [origin-O ] [output-format-P] [-p] [-Q] [-R] [-r ] [randomdev-S] [-s ] [start-time-T ] [ttl-t] [-u] [-v ] [level-V] [-X ] [extended end-time-x] [-z] [-3 ] [salt-H ] [iterations-A] {zonefile} [key...]DESCRIPTION
+DESCRIPTION
EXAMPLE
+EXAMPLE
example.com
zone with the DSA key generated by dnssec-keygen
@@ -542,14 +542,14 @@ db.example.com.signed
%
dnssec-verify [-c ] [class-E ] [engine-I ] [input-format-o ] [origin-v ] [level-V] [-x] [-z] {zonefile}DESCRIPTION
+DESCRIPTION
genrandom [-n ] {numbersize} {filename}DESCRIPTION
+DESCRIPTION
host [-aCdlnrsTwv] [-c ] [class-N ] [ndots-R ] [number-t ] [type-W ] [wait-m ] [flag-4] [-6] [-v] [-V] {name} [server]DESCRIPTION
+DESCRIPTION
IDN SUPPORT
+IDN SUPPORT
SEE ALSO
+SEE ALSO
isc-hmac-fixup {algorithm} {secret}DESCRIPTION
+DESCRIPTION
SECURITY CONSIDERATIONS
+SECURITY CONSIDERATIONS
named-checkconf [-h] [-v] [-j] [-t ] {filename} [directory-p] [-x] [-z]DESCRIPTION
+DESCRIPTION
RETURN VALUES
+RETURN VALUES
named-compilezone [-d] [-j] [-q] [-v] [-c ] [class-C ] [mode-f ] [format-F ] [format-J ] [filename-i ] [mode-k ] [mode-m ] [mode-n ] [mode-l ] [ttl-L ] [serial-r ] [mode-s ] [style-t ] [directory-T ] [mode-w ] [directory-D] [-W ] {mode-o } {zonename} {filename}filenameDESCRIPTION
+DESCRIPTION
RETURN VALUES
+RETURN VALUES
named-journalprint {journal}DESCRIPTION
+DESCRIPTION
named-rrchecker [-h] [-o ] [origin-p] [-u] [-C] [-T] [-P]DESCRIPTION
+DESCRIPTION
SEE ALSO
+SEE ALSO
named [-4] [-6] [-c ] [config-file-d ] [debug-level-D ] [string-E ] [engine-name-f] [-g] [-L ] [logfile-m ] [flag-n ] [#cpus-p ] [port-s] [-S ] [#max-socks-t ] [directory-U ] [#listeners-u ] [user-v] [-V] [-x ]cache-fileDESCRIPTION
+DESCRIPTION
SIGNALS
+SIGNALS
CONFIGURATION
+CONFIGURATION
nsec3hash {salt} {algorithm} {iterations} {domain}DESCRIPTION
+DESCRIPTION
nsupdate [-d] [-D] [[-g] | [-o] | [-l] | [-y ] | [[hmac:]keyname:secret-k ]] [keyfile-t ] [timeout-u ] [udptimeout-r ] [udpretries-R ] [randomdev-v] [-T] [-P] [-V] [filename]DESCRIPTION
+DESCRIPTION
BUGS
+BUGS
rndc-confgen [-a] [-A ] [algorithm-b ] [keysize-c ] [keyfile-h] [-k ] [keyname-p ] [port-r ] [randomfile-s ] [address-t ] [chrootdir-u ]userDESCRIPTION
+DESCRIPTION
rndc.conf DESCRIPTION
+DESCRIPTION
rndc.conf is the configuration file
for rndc, the BIND 9 name server control
utility. This file has a similar structure and syntax to
@@ -136,7 +136,7 @@
NAME SERVER CONFIGURATION
+NAME SERVER CONFIGURATION
rndc.conf
@@ -220,7 +220,7 @@
rndc [-b ] [source-address-c ] [config-file-k ] [key-file-s ] [server-p ] [port-q] [-V] [-y ] {command}key_idDESCRIPTION
+DESCRIPTION
COMMANDS
+COMMANDS
LIMITATIONS
+LIMITATIONS
key_id without using the configuration file.
@@ -616,7 +616,7 @@
value
can now be used to set the DSCP code point in outgoing query