README 13.5 KB
Newer Older
Bob Halley's avatar
Bob Halley committed
1
BIND 9
Bob Halley's avatar
update    
Bob Halley committed
2

Bob Halley's avatar
Bob Halley committed
3
	BIND version 9 is a major rewrite of nearly all aspects of the
4
5
6
7
8
9
10
11
12
	underlying BIND architecture.  Some of the important features of
	BIND 9 are:

		- DNS Security
			DNSSEC (signed zones)
			TSIG (signed DNS requests)

		- IP version 6
			Answers DNS queries on IPv6 sockets
13
			IPv6 resource records (AAAA)
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
			Experimental IPv6 Resolver Library

		- DNS Protocol Enhancements
			IXFR, DDNS, Notify, EDNS0
			Improved standards conformance

		- Views
			One server process can provide multiple "views" of
			the DNS namespace, e.g. an "inside" view to certain
			clients, and an "outside" view to others.

		- Multiprocessor Support

		- Improved Portability Architecture

Bob Halley's avatar
Bob Halley committed
29
30
31
32

	BIND version 9 development has been underwritten by the following
	organizations:

33
34
35
36
37
38
39
40
		Sun Microsystems, Inc.
		Hewlett Packard
		Compaq Computer Corporation
		IBM
		Process Software Corporation
		Silicon Graphics, Inc.
		Network Associates, Inc.
		U.S. Defense Information Systems Agency
Bob Halley's avatar
Bob Halley committed
41
42
		USENIX Association
		Stichting NLnet - NLnet Foundation
43
		Nominum, Inc.
Bob Halley's avatar
update    
Bob Halley committed
44

45
46
47
48
49
50
	For a summary of functional enhancements in previous
	releases, see the HISTORY file.

	For a detailed list of user-visible changes from
	previous releases, see the CHANGES file.

51
        For up-to-date release notes and errata, see
Evan Hunt's avatar
Evan Hunt committed
52
        http://www.isc.org/software/bind9/releasenotes
53

54
55
56
57
BIND 9.10.0

	Named now listens on both IPv4 and IPv6 interfaces by default.

Evan Hunt's avatar
Evan Hunt committed
58
59
BIND 9.9.0

60
	BIND 9.9.0 includes a number of changes from BIND 9.8 and earlier
Evan Hunt's avatar
Evan Hunt committed
61
62
	releases.  New features include:

63
64
65
        - Inline signing, allowing automatic DNSSEC signing of
          master zones without modification of the zonefile, or 
          "bump in the wire" signing in slaves.
Evan Hunt's avatar
Evan Hunt committed
66
67
68
        - NXDOMAIN redirection.
        - New 'rndc flushtree' command clears all data under a given
          name from the DNS cache.
69
70
71
        - New 'rndc sync' command dumps pending changes in a dynamic
          zone to disk without a freeze/thaw cycle.
        - New 'rndc signing' command displays or clears signing status
Evan Hunt's avatar
Evan Hunt committed
72
          records in 'auto-dnssec' zones.
73
74
        - NSEC3 parameters for 'auto-dnssec' zones can now be set prior
          to signing, eliminating the need to initially sign with NSEC.
Evan Hunt's avatar
Evan Hunt committed
75
76
77
78
79
        - Startup time improvements on large authoritative servers.
        - Slave zones are now saved in raw format by default.
        - Several improvements to response policy zones (RPZ).
        - Improved hardware scalability by using multiple threads
          to listen for queries and using finer-grained client locking
Evan Hunt's avatar
Evan Hunt committed
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
        - The 'also-notify' option now takes the same syntax as
          'masters', so it can used named masterlists and TSIG keys.
        - 'dnssec-signzone -D' writes an output file containing only DNSSEC
          data, which can be included by the primary zone file.
        - 'dnssec-signzone -R' forces removal of signatures that are
          not expired but were created by a key which no longer exists.
        - 'dnssec-signzone -X' allows a separate expiration date to
          be specified for DNSKEY signatures from other signatures.
        - New '-L' option to dnssec-keygen, dnssec-settime, and
          dnssec-keyfromlabel sets the default TTL for the key.
        - dnssec-dsfromkey now supports reading from standard input,
          to make it easier to convert DNSKEY to DS.
        - RFC 1918 reverse zones have been added to the empty-zones
          table per RFC 6303.
        - Dynamic updates can now optionally set the zone's SOA serial
          number to the current UNIX time.
96
        - DLZ modules can now retrieve the source IP address of
Evan Hunt's avatar
Evan Hunt committed
97
          the querying client.
98
        - 'request-ixfr' option can now be set at the per-zone level.
Evan Hunt's avatar
Evan Hunt committed
99
100
        - 'dig +rrcomments' turns on comments about DNSKEY records,
          indicating their key ID, algorithm and function
Evan Hunt's avatar
Evan Hunt committed
101
        - Simplified nsupdate syntax and added readline support
Evan Hunt's avatar
Evan Hunt committed
102

Mark Andrews's avatar
9.8.0a1    
Mark Andrews committed
103
104
BIND 9.8.0

105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
        BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier
        releases.  New features include:

        - Built-in trust anchor for the root zone, which can be
          switched on via "dnssec-validation auto;"
        - Support for DNS64.
        - Support for response policy zones (RPZ).
        - Support for writable DLZ zones.
        - Improved ease of configuration of GSS/TSIG for
          interoperability with Active Directory
        - Support for GOST signing algorithm for DNSSEC.
        - Removed RTT Banding from server selection algorithm.
        - New "static-stub" zone type.
        - Allow configuration of resolver timeouts via
          "resolver-query-timeout" option.
	- The DLZ "dlopen" driver is now built by default.
	- Added a new include file with function typedefs
          for the DLZ "dlopen" driver.
	- Made "--with-gssapi" default.
	- More verbose error reporting from DLZ LDAP.
Mark Andrews's avatar
9.8.0a1    
Mark Andrews committed
125

126

Bob Halley's avatar
update    
Bob Halley committed
127
128
Building

Bob Halley's avatar
Bob Halley committed
129
	BIND 9 currently requires a UNIX system with an ANSI C compiler,
130
	basic POSIX support, and a 64 bit integer type.
Bob Halley's avatar
Bob Halley committed
131

132
	We've had successful builds and tests on the following systems:
Bob Halley's avatar
Bob Halley committed
133

134
		COMPAQ Tru64 UNIX 5.1B
135
		Fedora Core 6
136
		FreeBSD 4.10, 5.2.1, 6.2
137
		HP-UX 11.11
138
		Mac OS X 10.5
139
		NetBSD 3.x, 4.0-beta, 5.0-beta
140
141
142
		OpenBSD 3.3 and up
		Solaris 8, 9, 9 (x86), 10
		Ubuntu 7.04, 7.10
143
144
145
146
147
		Windows XP/2003/2008

        NOTE:  As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of
        Windows, including Windows NT and Windows 2000, are no longer
        supported.
148

149
150
151
152
153
154
	We have recent reports from the user community that a supported
	version of BIND will build and run on the following systems:

		AIX 4.3, 5L
		CentOS 4, 4.5, 5
		Darwin 9.0.0d1/ARM
155
156
157
		Debian 4, 5, 6
		Fedora Core 5, 7, 8
		FreeBSD 6, 7, 8
158
		HP-UX 11.23 PA
159
160
		MacOS X 10.5, 10.6, 10.7
		Red Hat Enterprise Linux 4, 5, 6
161
162
163
		SCO OpenServer 5.0.6
		Slackware 9, 10
		SuSE 9, 10
164

Bob Halley's avatar
Bob Halley committed
165
166
167
168
169
	To build, just

		./configure
		make

170
171
	Do not use a parallel "make".

Andreas Gustafsson's avatar
Andreas Gustafsson committed
172
173
	Several environment variables that can be set before running
	configure will affect compilation:
174

Andreas Gustafsson's avatar
Andreas Gustafsson committed
175
176
177
	    CC
		The C compiler to use.	configure tries to figure
		out the right one for supported systems.
178

Andreas Gustafsson's avatar
Andreas Gustafsson committed
179
180
	    CFLAGS
		C compiler flags.  Defaults to include -g and/or -O2
Mark Andrews's avatar
Mark Andrews committed
181
182
		as supported by the compiler.  Please include '-g'
		if you need to set CFLAGS.
183

Andreas Gustafsson's avatar
Andreas Gustafsson committed
184
185
186
187
	    STD_CINCLUDES
		System header file directories.	 Can be used to specify
		where add-on thread or IPv6 support is, for example.
		Defaults to empty string.
188

Andreas Gustafsson's avatar
Andreas Gustafsson committed
189
190
191
	    STD_CDEFINES
		Any additional preprocessor symbols you want defined.
		Defaults to empty string.
192

193
194
		Possible settings:
		Change the default syslog facility of named/lwresd.
195
196
197
198
		  -DISC_FACILITY=LOG_LOCAL0	
		Enable DNSSEC signature chasing support in dig.
		  -DDIG_SIGCHASE=1 (sets -DDIG_SIGCHASE_TD=1 and
				    -DDIG_SIGCHASE_BU=1)
199
200
		Disable dropping queries from particular well known ports.
		  -DNS_CLIENT_DROPPORT=0
Mark Andrews's avatar
Mark Andrews committed
201
202
203
204
	        Sibling glue checking in named-checkzone is enabled by default.
		To disable the default check set.  -DCHECK_SIBLING=0
		named-checkzone checks out-of-zone addresses by default.
		To disable this default set.  -DCHECK_LOCAL=0
205
206
207
		To create the default pid files in ${localstatedir}/run rather
		than ${localstatedir}/run/{named,lwresd}/ set.
		  -DNS_RUN_PID_DIR=0
208
		Enable workaround for Solaris kernel bug about /dev/poll
209
210
211
		  -DISC_SOCKET_USE_POLLWATCH=1
		  The watch timeout is also configurable, e.g.,
		  -DISC_SOCKET_POLLWATCH_TIMEOUT=20
212

213
214
215
	    LDFLAGS
		Linker flags. Defaults to empty string.

216
217
218
219
220
221
222
223
224
225
226
	The following need to be set when cross compiling.

	    BUILD_CC
		The native C compiler.
	    BUILD_CFLAGS (optional)
	    BUILD_CPPFLAGS (optional)
		Possible Settings:
		-DNEED_OPTARG=1		(optarg is not declared in <unistd.h>)
	    BUILD_LDFLAGS (optional)
	    BUILD_LIBS (optional)

Andreas Gustafsson's avatar
Andreas Gustafsson committed
227
	To build shared libraries, specify "--with-libtool" on the
228
229
	configure command line.

230
231
	For the server to support DNSSEC, you need to build it
	with crypto support.  You must have OpenSSL 0.9.5a
232
233
234
235
236
	or newer installed and specify "--with-openssl" on the
	configure command line.  If OpenSSL is installed under
	a nonstandard prefix, you can tell configure where to
	look for it using "--with-openssl=/prefix".

237
238
239
240
241
242
        To support the HTTP statistics channel, the server must
        be linked with at least one of the following: libxml2
        (http://xmlsoft.org) or json-c (https://github.com/json-c).
        If these are installed at a nonstandard prefix, use
        "--with-libxml2=/prefix" or "--with-libjson=/prefix".

Mark Andrews's avatar
Mark Andrews committed
243
244
245
246
	On some platforms it is necessary to explictly request large
	file support to handle files bigger than 2GB.  This can be
	done by "--enable-largefile" on the configure command line.

247
248
249
250
251
252
	On some platforms, BIND 9 can be built with multithreading
	support, allowing it to take advantage of multiple CPUs.
	You can specify whether to build a multithreaded BIND 9 
	by specifying "--enable-threads" or "--disable-threads"
	on the configure command line.  The default is operating
	system dependent.
Andreas Gustafsson's avatar
Andreas Gustafsson committed
253

254
255
256
257
258
        Support for the "fixed" rrset-order option can be enabled
        or disabled by specifying "--enable-fixed-rrset" or
        "--disable-fixed-rrset" on the configure command line.
        The default is "disabled", to reduce memory footprint.

259
260
261
	If your operating system has integrated support for IPv6, it
	will be used automatically.  If you have installed KAME IPv6
	separately, use "--with-kame[=PATH]" to specify its location.
262

Bob Halley's avatar
Bob Halley committed
263
264
265
266
	"make install" will install "named" and the various BIND 9 libraries.
	By default, installation is into /usr/local, but this can be changed
	with the "--prefix" option when running "configure".

267
268
269
270
271
272
273
274
275
276
277
278
279
	You may specify the option "--sysconfdir" to set the directory 
	where configuration files like "named.conf" go by default,
	and "--localstatedir" to set the default parent directory
	of "run/named.pid".   For backwards compatibility with BIND 8,
	--sysconfdir defaults to "/etc" and --localstatedir defaults to
	"/var" if no --prefix option is given.  If there is a --prefix
	option, sysconfdir defaults to "$prefix/etc" and localstatedir
	defaults to "$prefix/var".

	To see additional configure options, run "configure --help".
	Note that the help message does not reflect the BIND 8 
	compatibility defaults for sysconfdir and localstatedir.

280
281
282
283
	If you're planning on making changes to the BIND 9 source, you
	should also "make depend".  If you're using Emacs, you might find
	"make tags" helpful.

284
285
286
	If you need to re-run configure please run "make distclean" first.
	This will ensure that all the option changes take.

Bob Halley's avatar
Bob Halley committed
287
288
	Building with gcc is not supported, unless gcc is the vendor's usual
	compiler (e.g. the various BSD systems, Linux).
Mark Andrews's avatar
Mark Andrews committed
289
	
290
	Known compiler issues:
Mark Andrews's avatar
Mark Andrews committed
291
	* gcc-3.2.1 and gcc-3.1.1 is known to cause problems with solaris-x86.
Mark Andrews's avatar
Mark Andrews committed
292
	* gcc prior to gcc-3.2.3 ultrasparc generates incorrect code at -02.
293
	* gcc-3.3.5 powerpc generates incorrect code at -02.
Mark Andrews's avatar
Mark Andrews committed
294
	* Irix, MipsPRO 7.4.1m is known to cause problems.
Bob Halley's avatar
Bob Halley committed
295

296
297
298
299
	A limited test suite can be run with "make test".  Many of
	the tests require you to configure a set of virtual IP addresses
	on your system, and some require Perl; see bin/tests/system/README
	for details.
300

301
302
303
	SunOS 4 requires "printf" to be installed to make the shared
	libraries.  sh-utils-1.16 provides a "printf" which compiles
	on SunOS 4.
304

Mark Andrews's avatar
Mark Andrews committed
305
306
307
308
Known limitations

	Linux requires kernel build 2.6.39 or later to get the
	performance benefits from using multiple sockets.
309

310
311
312
Documentation

	The BIND 9 Administrator Reference Manual is included with the
313
314
	source distribution in DocBook XML and HTML format, in the
	doc/arm directory.
315
316

	Some of the programs in the BIND 9 distribution have man pages
317
318
	in their directories.  In particular, the command line
	options of "named" are documented in /bin/named/named.8.
319
	There is now also a set of man pages for the lwres library.
320
321

	If you are upgrading from BIND 8, please read the migration
322
323
	notes in doc/misc/migration.  If you are upgrading from
	BIND 4, read doc/misc/migration-4to9.
Bob Halley's avatar
Bob Halley committed
324

Andreas Gustafsson's avatar
English    
Andreas Gustafsson committed
325
	Frequently asked questions and their answers can be found in
Mark Andrews's avatar
Mark Andrews committed
326
327
	FAQ.

328
329
330
        Additional information on various subjects can be found
        in the other README files.

331

332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
Change Log

	A detailed list of all changes to BIND 9 is included in the 
	file CHANGES, with the most recent changes listed first.
	Change notes include tags indicating the category of the
	change that was made; these categories are:

	   [func]	  New feature

	   [bug]	  General bug fix

	   [security]	  Fix for a significant security flaw

	   [experimental] Used for new features when the syntax
	   		  or other aspects of the design are still
			  in flux and may change

	   [port]	  Portability enhancement

	   [maint]	  Updates to built-in data such as root
			  server addresses and keys

	   [tuning]	  Changes to built-in configuration defaults
	   		  and constants to improve performanceo

	   [protocol]	  Updates to the DNS protocol such as new
			  RR types

           [test]         Changes to the automatic tests, not
                          affecting server functionality

           [cleanup]      Minor corrections and refactoring

	   [doc]	  Documentation

	In general, [func] and [experimental] tags will only appear
	in new-feature releases (i.e., those with version numbers
	ending in zero).  Some new functionality may be backported to
	older releases on a case-by-case basis.  All other change
	types may be applied to all currently-supported releases.


374
Bug Reports and Mailing Lists
375

Bob Halley's avatar
Bob Halley committed
376
377
378
379
	Bugs reports should be sent to

		bind9-bugs@isc.org

Mark Andrews's avatar
Mark Andrews committed
380
	To join the BIND Users mailing list, send mail to
Bob Halley's avatar
Bob Halley committed
381

Mark Andrews's avatar
Mark Andrews committed
382
		bind-users-request@isc.org
Bob Halley's avatar
Bob Halley committed
383

384
385
	archives of which can be found via

Mark Andrews's avatar
Mark Andrews committed
386
		http://www.isc.org/ops/lists/
387

Bob Halley's avatar
Bob Halley committed
388
	If you're planning on making changes to the BIND 9 source
Mark Andrews's avatar
Mark Andrews committed
389
	code, you might want to join the BIND Workers mailing list.
Bob Halley's avatar
Bob Halley committed
390
391
	Send mail to

Mark Andrews's avatar
Mark Andrews committed
392
		bind-workers-request@isc.org
Bob Halley's avatar
Bob Halley committed
393

Bob Halley's avatar
add    
Bob Halley committed
394