BIND 機能差分(9.9, 9.10, 9.11, 9.12) ver0.6
今回配布しております資料はベータ版です。
改版・修正など更新を行う予定です。（ベストエフォートで・・）
資料に関する誤りがございましたら、メール頂けますと幸いです。
yo_suematsu at qtnet.co.jp※この資料はISCの資料を基に作成されております。内容については無保証です。
・正確な情報と詳細は公式のドキュメントをご確認ください。
・BIND9 Significant Features Matrix
https://kb.isc.org/article/AA-01310/0/BIND9-Significant-Features-Matrix.html
・BIND 9.11 New Features
https://www.isc.org/downloads/bind/bind-9-11-new-features/
・[Knowledge Base] BIND 9.11 Features
https://kb.isc.org/category/219/0/10/Software-Products/BIND9/Features/BIND-9.11-Features/

9.11フルリゾルバでの動作影響
9.9Feature

9.9 S (stable preview)

9.10

9.10 S

9.11

9.11 S

9.12(デフォルトの設定での影響の有無)

defaultの設定関連するオプションと備考

dig + sigchase
Removed support for-lwresd-dlv trust anchor
Automatic interface scanning

all

all

all

all

all

影響有

default値 yes

automatic-interface-scan boolean;#Case-sensitive name compression
https://kb.isc.org/article/AA-01113/0

Case-sensitive name compression

9.9.5

9.9.5-S1

all

all

all

all

all

影響なし

defaultでは指定なし

no-case-compress { address̲match̲element; ... };有効する際は--enable-native-pkcs11#New Features in BIND 9.10
https://kb.isc.org/article/AA-01118/0
Crypto: Native PKCS#11

all

all

all

all

all

影響なし
クライアント側のCookieは"send-cookie"オプションで無効にすることができる。
サーバ側は"answer-cookie"オプションでBIND 9.11.4から追加予定。
・send-cookie yes̲or̲no;(Default yes). This is an option that is set globally or per-server and controls whether or notnamed will add a DNS COOKIE when sending queries to that server. It also controls theexpectations of the behavior of a remote server that has responded previously with support for
DNS Cookies. (In BIND 9.10 this was request-sit yes̲or̲no)・require-server-cookie yes̲or̲no;all (with --enable-sit); code point updated

DDOS Mitigation: DNSCOOKIE (previously called SIT)

to COOKIE in 9.10.3

allallallall(multiple cookie secret added)

影響有enable(Default no). This controls how a server will respond to a COOKIE-aware client.
・nocookie-udp-size number;
Use this option if you need to change the default maximum UDP response size when responding
to queries from clients that don't use DNS COOKIE (noting that max-udp-size may further limit theresponse size too)・cookie-secret secret-string;If you're running an anycast cluster, you can use this option to pre-set the server cookie string(instead of having it automatically generated at start-up)
・cookie-algorithm algorithm-id;
In the event that you want to change the way the default server COOKIE is generated at server
start-up, this option changes the algorithm that is used.
#DNSRPZ performance and scaleability when using multiple RPZ zones

影響なし
DDOS Mitigation: Faster RPZ and new triggers

allallallallall (refactored RPZ)

all (refactored RPZ)

9.9.6-S1 (revised 9.9.8-S1)

9.10.3 (with --enable-fetchlimit)

all

all

all

all

https://kb.isc.org/article/AA-01121/0
設定なし
fetches-per-server

The default is zero.（no limit）

fetch-quota-params
DDOS Mitigation: Fetch limits (DDoS mitigation for recursiveservers)

9.9.8 (with --enable-fetchlimit)

DDOS Mitigation: Minimal response to 'any' queries

all

DDOS Mitigation: Multiple response rate limiters for different domains

9.9.5-S1

all

all

fetches-per-zone

影響なし

all

影響なし

all

default is 100 (fetches-per-server有効時に関連するパラメータ)
The default is zero.（no limit）

minimal-responses

default is no.

minimal-any

default is no. ほかにない？

影響なし
rate-limit {all-per-second integer;
errors-per-second integer;
exempt-clients { address̲match̲element; ... }; ipv4-prefix-length integer;
ipv6-prefix-length integer;
log-only boolean;

DDOS Mitigation: Response rate limiting (RRL)

9.9.4 (with --enable-rrl)

all

all

all

all

all

max-table-size integer;allmin-table-size integer;
nodata-per-second integer; nxdomains-per-second integer;
qps-scale integer;
referrals-per-second integer; responses-per-second integer;
slip integer;
window integer;

DDOS Mitigation: SERVFAIL caching

9.9.6-S1

all

DDOS Mitigation: Size & ratio controls for response rate limiters

9.9.5-S1

all

all

all

DDOS Mitigation: Serve StaleDNSSEC: Automatic creation of CDS, CDSKEY records
DNSSEC: Negative trust anchors

9.9.6-S1

all

EDNS Client-Subnet (ECS) for resolver

exp

EDNS EXPIRE option (server side)

all (with experimental code point); EXPIRE code point
all finalized in 9.10.1

EDNS EXPIRE option (client side)

影響なし無効};影響有default is 1 second

servfail-ttl

影響なし

機能なし

all

影響なし

機能なし

all

all

all

影響なし

機能なし

all

all

all

影響なし

設定なし

影響なし

機能なし

all

EDNS Client-Subnet (ECS) option support for authoritative servers

all

all

all
exp

影響なし

設定なし

all

all

all

影響なし

default is yes

all

exp
all

exp
all

影響なし

defaultis 1 second

For currently (and recently) supported versions of BIND up to and including BIND 9.9, the fallback
algorithm for a 'new' authoritative server operates as follows:
Query with EDNS, advertising size 4096, DO (DNSSEC OK) bit set
If no response, retry with EDNS, size 512, DO bit set
If no response, retry without EDNS (no DNSSEC, and buffer size maximum 512)
If no response, retry the query over TCP
https://deepthought.isc.org/article/AA-01219/0/Refinements-to-EDNS-fallback-behavior-canEDNS: Improved EDNS fallback processing

all

EDNS Padding (RFC 7830)

all

all

9.10.5-S1

all

all

影響有

all

all

影響なし

アルゴリズムの変更

cause-different-outcomes-in-Recursive-Servers.html
options {geoip-directory "/path/to/geoip/database";};acl "example" {geoip country US;
geoip region CA;
geoip city "Redwood City"; /* names, etc., must be quoted if they contain spaces */};

GeoIP support

all

all

all

all

all

all

影響なし

Management: Detailed statistics counters

all

all

all

all

all

all

影響有
configured with --enable-dnstap
dnstap {auth;client response;resolver query;};
Using DNSTAP with BINDManagement: DNSTAP query/response logging

9.9.8-S5

all

all

all

影響なし

設定なし

Management: automatic DNSTAP file rolling9.9.9-S1

all

all

all

影響なし

機能なし

all

all

all

影響なし

機能なし

Management: timestamp suffix option for rolled log files and DNSTAP files

allhttps://kb.isc.org/article/AA-01342/0

configured with ̶with-libxml2 --with-libjson
statistics-channels {8080 allow {any;};

inet 10.0.0.1 port 80 allow {my̲nets;};

inet 192.168.1.1 port};

Operating statistics provided by BIND statistics channels
https://kb.isc.org/article/AA-01123/0/Operating-statistics-provided-by-BIND-statisticsManagement: JSON statistics
Management: New XML statistics schema

9.9.3

all

all

all

all

all

all

all (with --enable-newstats)

all

all

all

all

all

影響なし

設定なし

9.9.3から有効

channels.html
Operating statistics provided by BIND statistics channels https://kb.isc.org/article/AA-01123/04022. [func] Stop multiple spawns of named by limiting number ofprocesses to 1. This is done by using a lockfile andchecking whether we can listen on any configured
TCP interfaces. [RT #37908]
4080. [func] Completed change #4022, adding a "lock-file" option
to named.conf to override the default lock file,in addition to the "named -X <filename>" commandline option. Setting the lock file to "none"using either method disables the check completely.
[RT #37908]
Management: Squelch duplicate named servers

all

all

all

影響有

defaultで有効Management: Traffic size statistics (per RSSAC02)

all

all

all

影響有

default is terse

4402. [func] Collect statistics for RSSAC02v3 traffic-volume,traffic-sizes and rcode-volume reporting. [RT #41475]
zone-statistics ( full | terse | none | boolean );詳細はBIND 9.11 ARMのzone-statistics参照
NXDOMAIN Redirection Using DLZ in BIND 9.10 and later
https://kb.isc.org/article/AA-01150/0/NXDOMAIN-Redirection-Using-DLZ-in-BIND-9.10-andnxdomain-redirect option

9.9.8-S1

all

Performance: EDNS TCP keepalive support (RFC 7828)

all

all

all

all

影響なし

設定なし

all

all

影響なし

機能なし

all

all

影響なし

default value is text

all

影響なし

機能なし

later.html
masterfile-format ( map | raw | text );Using the 'map' zone file format in BIND

Performance: Fast "map" format zone files

all

all

all

Performance: glue cache

https://kb.isc.org/article/AA-01120/0

有効にする際にはconfigured with ̶with-tuning=large--with-tuning=large - about using this build-time option
Performance: Large server tuning

all

all

all

all

all

Performance: minimal responses

Performance: mutex locking fixes (resolver)allallall

all

影響なし

設定なし

all

影響なし

機能なし

https://kb.isc.org/article/AA-01314/0--with-locktype=ARG

all

Specify mutex lock type (adaptive or standard)

4041. [func] TCP sockets can now be shared while connecting.
(This will be used to enable client-side supportof pipelined queries.) [RT #38231]
4040. [func] Added server-side support for pipelined TCP
queries. Clients may continue sending queries via
TCP while previous queries are being processedin parallel. (The new "keep-response-order"
option allows clients to be specified for which
the old behavior will still be used.) [RT #37821]
Added server-side support for pipelined TCP queries. Clients may
continue sending queries via TCP while previous queries areprocessed in parallel. Responses are sent when they are ready, notnecessarily in the order in which the queries were received.
To revert to the former behavior for a particular client address orrange of addresses, specify the address prefix in the"keep-response-order" option. To revert to the former behavior for
Performance: Pipelined TCP queries (server side)

all 9.10.6-S2 maximum timeout increased

Performance: TCP connection sharing for update forwardingall

all maximum timeout increased all maximum timeout increased

all

all

all clients, use "keep-response-order { any; };".

影響あり

all
serial-query-rate (default 20)
serial-query-rate, notify-rate and startup-notify-rate: how they impact zone transfers in different
versions of BIND

Performance: Separate rate limiting for startup NOTIFY messages

9.9.7-S1

all

all

all

all

影響なし

https://kb.isc.org/article/AA-01313/0

all

all

all

影響なし

https://kb.isc.org/article/AA-01401/0

A short introduction to Catalog Zones
Provisioning: Catalog zones

What is dyndb and how is it better than DLZ?
Provisioning: Dynamic DB (DynDB) support

all

all

all

影響なし

設定なし

all

all

all

影響なし

設定なし

https://kb.isc.org/article/AA-01420/0/What-is-dyndb-and-how-%20is-it-better-than-DLZ.html
view external {match-clients { any; };zone example.com {in-view internal;}; };Provisioning: in-view zone option

all

all

Early refresh of cache records (cache prefetch) in BIND

影響有Resolver: Cache prefetch

all

all

all

all

all

all

all

all

Resolver: Prefer IPv6 when querying authoritative servers

9.9.8-S5all

RNDC: "showzone", "modzone", faster "delzone"

9.9.8-S5

all

all

all

all

all

all

all

9.9.9-S1

all

all

all

all

all

all

all

all

RNDC: Python module
RNDC: read-only option
RNDC: zone status reporting
RPZ: refactored RPZ
RPZ: Response Policy Service API

all

all

影響有

The default trigger TTL is 2

https://kb.isc.org/article/AA-01122/0

default is 50 milliseconds

https://kb.isc.org/article/AA-01349/0

IPv6 Changes in BIND 9.11.0, BIND 9.10.4 and BIND 9.9.9.

all

影響なし

機能なし

all

影響なし

機能なし

1