Blog entries for "BIND"

ISC BIND 9.9.0a1 -- feature preview

01 Sep 2011
by Evan Hunt

Yesterday afternoon, ISC published the first alpha release of BIND 9.9.0. This is an early technology preview, showing off some of the work we've been doing in BIND 9.

There will be more new features added in later alpha releases, but here's what's ready to debut now...

ISC BIND 9.8.1b3 provides startup-performance improvements

13 Jul 2011
by Evan Hunt


ISC BIND 9.8.1b3 is now available. This release includes startup-performance improvements described in A Major Improvement in BIND 9 Startup Performance (see http://www.isc.org/files/imce/startup-performance.pdf).

BIND 9.8.1b3 is the third beta release of BIND 9.8.
 

DNS forwarders

29 Apr 2011
Jelte

Recently, at a BIND 10 Face to face meeting, we scheduled a short slot of time to discuss the features of a DNS forwarder. As part of the development process of the BIND 10 recursive resolver, we initially implemented a basic forwarder. As we added actual recursive resolver features, the original 'forwarding' mode was left in, and got some of the features that were added for the 'resolving' mode, mostly on an ad-hoc basis.

DNSSEC and "lazy delegation"

27 Jan 2011
Michael Graff

Prior to deploying DNSSEC it has been possible to perform something I'm calling "lazy delegation." This is when a parent and direct child are served from the same name servers, so NS records in the parent are unnecessary in practice.

While consulting with various clients about how to best deploy their DNSSEC, this is a common discovery. Often times someone just forgot to add NS records, or their tools do not add them. No one notices because their DNS worked.

Preparing for a world consisting of larger DNS responses.

20 Jan 2011
Peter Losher

While many of you know ISC as the maintainer of the BIND DNS server software, we have always had our hand in the DNS operations field, including operating one of the 13 DNS root servers (F.ROOT-SERVERS.NET), as well as secondaring many ccTLD and non-commercial zones for over a decade. ISC has also been at the forefront of designing and implementing DNS Security Extensions (DNSSEC) which is a mechanism to cryptographically verify that the response given to a DNS request is correct.

Implementing IPv6 is no longer optional

04 Jan 2011
Sue Graves

The exhaustion of IPv4 space from IANA is coming as soon as February (yes, next month!) and the reserve held by the RIRs will be running dry shortly thereafter. The ability to provide (and use) IPv6 infrastructure is no longer optional; it is a requirement.

Standardizing the Severity of Security Vulnerabilities

18 Oct 2010
Larissa Shapiro, ISC Product Manager

ISC has recently become aware of a security advisory, CVE-2010-3762 filed against BIND 9 on October 5th 2010. ISC did not request this CVE, nor was it contacted by the submitter prior to its submission.

We believe the reported severity assessment of this CVE to be higher than is realistic. Specifically, because a recursive operator needs to have configured a specific zone to be trusted via adding a trust-anchor statement for it, we believe the impact of this vulnerability to be low.

Backwards compatibility issues in BIND 9.7.0 and 9.7.1

06 Jul 2010
Michael Graff

ISC has announced that there were some backwards compatibility problems in the 9.7.1 release. Here is a bit more information on the topic. These problems were also in 9.7.0.

The first issue was a problem in how those versions of BIND 9 processed certain formats of negative responses. In particular, BIND 9's internal logic expected certain records to be present because that is what BIND 9 generated. Some other types of servers (many were custom-created it appears) did not include everything we expected to find, and sometimes those had to be queried for.

Open source *more* secure?

25 May 2010
by Paul Vixie

I seem to read all the time that open source projects must be less secure, since the bad guys can look through the source code to find vulnerabilities. I was pleased to see an article today that takes the point of view that security through obscurity is not the right direction and that open source projects can be more secure than competing proprietary software.

Imminent Death of Internet Predicted. Film at 11.

11 May 2010
by Paul Ebersman

The press seems to love stories of doom and gloom. And for almost as long as the Internet has been around, there have been dire predictions of some resource exhaustion, success disaster or security flaw that will destroy the internet. And who is the villain in this week's piece? DNSSEC and the signing of all the root servers.

While I love a good story as much as the next person, it seems time to actually throw a few facts on the fire.