Software Update: PowerDNS Recursor 4.0.1

PowerDNS is a dns server with a database as back-end, which makes it easy to manage a large number of dns entries. The developers previously decided to release the two parts that make up PowerDNS, a recursor and an authoritative name server, separately. This means that a new version can be released faster and more specifically, according to the developers.

If you do a dns lookup, a recursor will initially start asking this question to a dns root server. This can then redirect to other servers, from where it can redirect to other servers, and so on, until finally a server is reached that knows the answer or knows that the look-up is not possible. The latter can be the case if the name does not exist or the servers do not respond. The process of going through different authoritative servers is called recursion. The developers have released PowerDNS Recursor 4.0.1. The changes in this release are as follows:

PowerDNS Recursor 4.0.1

This release has several improvements with regards to DNSSEC validation and it improves interoperability with DNSSEC clients that expect an AD-bit on validated data when they query with only the DO-bit set.

Bug fixes

• #4119 Improve DNSSEC record skipping for non dnssec queries
• #4162 Don’t validate zones from the local auth store, go one level down while validating when there is a CNAME
• #4187: Don’t go bogus on islands of security. Check all possible chains for Insecures. Don’t go Bogus on a CNAME at the apex
• #4215 RPZ: default policy should also override local data RRs
• #4243 Fix a crash when the next name in a chained query is empty and rec_control current-queries is invoked

Improvements

• #4056 OpenSSL 1.1.0 support
• #4133 Add limits to the size of received {A,I}XFR (CVE-2016-6172)
• #4140 Fix warnings with gcc on musl-libc
• #4160 Also validate on +DO
• #4164 Fail to start when the lua-dns-script does not exist
• #4168 Add more Netmask methods for Lua
• #4210 Validate DNSSEC for security polling
• #4217 Turn on root-nx-trust by default and log-common-errors=off
• #4207 Allow for multiple trust anchors per zone
• #4242 Fix compilation warning when building without Protobuf