https://www.knot-resolver.cz/Resolve DNS names like it's 2026Tue, 16 Jun 2026 14:45:00 +0200https://www.knot-resolver.cz/2026-06-16-knot-resolver-6.4.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>packaging: rpm: require python3-setuptools (!1830, #952)</li> <li>packaging: rpm: provide user/group (!1837)</li> <li>controller: improved error handling when sending commands to workers (!1834)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>dns64: fix CNAME problems again (#797 …</li></ul></div>Tue, 16 Jun 2026 14:45:00 +0200tag:www.knot-resolver.cz,2026-06-16:/2026-06-16-knot-resolver-6.4.0.htmlhttps://www.knot-resolver.cz/2026-04-27-knot-resolver-6.3.0.html<div class="section" id="improvements"> <h2>Improvements:</h2> <ul class="simple"> <li>/local-data/rpz: support *.some.name. CNAME block.page. (!1808)</li> <li>/local-data/rpz: print line number in the RPZ on error (!1823)</li> <li>/local-data/nodata: also apply to <cite>rpz:</cite> and <cite>records:</cite> (!1812 …</li></ul></div>Mon, 27 Apr 2026 14:45:00 +0200tag:www.knot-resolver.cz,2026-04-27:/2026-04-27-knot-resolver-6.3.0.htmlhttps://www.knot-resolver.cz/2026-02-03-knot-resolver-6.2.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>DNS-over-QUIC (DoQ) is available for serving (beta, !1747)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix UDP answers without sendmmsg, e.g. on non-Linux (!1795)</li> <li>fix /logging/groups in python 3.8 (!1799)</li> </ul> </div> Tue, 03 Feb 2026 14:45:00 +0100tag:www.knot-resolver.cz,2026-02-03:/2026-02-03-knot-resolver-6.2.0.htmlhttps://www.knot-resolver.cz/2026-01-08-knot-resolver-6.1.0.html<p>6.1.0 is the first officially stable release of version 6. As of this release, version 6 is preferred over version 5.</p> <div class="section" id="improvements"> <h2>Improvements:</h2> <ul class="simple"> <li>logging: improved logging groups (!1768)</li> <li>support …</li></ul></div>Thu, 08 Jan 2026 14:45:00 +0100tag:www.knot-resolver.cz,2026-01-08:/2026-01-08-knot-resolver-6.1.0.htmlhttps://www.knot-resolver.cz/2025-07-17-knot-resolver-5.7.6.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>DoS: fix a rare segfault in <cite>resolve</cite> function (!1720) Someone controlling the DNS traffic might be able to trigger this crash intentionally and too often.</li> <li>DoS: drop a wrong …</li></ul></div>Thu, 17 Jul 2025 14:45:00 +0200tag:www.knot-resolver.cz,2025-07-17:/2025-07-17-knot-resolver-5.7.6.htmlhttps://www.knot-resolver.cz/2025-04-24-knot-resolver-5.7.5.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>DoS: fix unconfirmed crashes with the line below (!1683) [system] requirement &quot;h &amp;&amp; h-&gt;end &gt; h-&gt;begin&quot; failed in queue_pop_impl</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>tests: disable problematic config.http test (#925, !1678)</li> <li>validator …</li></ul></div>Thu, 24 Apr 2025 14:45:00 +0200tag:www.knot-resolver.cz,2025-04-24:/2025-04-24-knot-resolver-5.7.5.htmlhttps://www.knot-resolver.cz/2024-07-23-knot-resolver-5.7.4.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>reduce buffering of transmitted data, especially TCP-based in userspace Also expose some of the new tweaks in lua:<ul> <li>(require 'ffi').C.the_worker.engine.net.tcp.user_timeout = 1000</li> <li>(require 'ffi' …</li></ul></li></ul></div>Tue, 23 Jul 2024 14:45:00 +0200tag:www.knot-resolver.cz,2024-07-23:/2024-07-23-knot-resolver-5.7.4.htmlhttps://www.knot-resolver.cz/2024-05-30-knot-resolver-5.7.3.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>stats: add separate metrics for IPv6 and IPv4 (!1544)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix NSEC3 records missing in answer for positive wildcard expansion with the NSEC3 having over-limit iteration count (#910, !1550 …</li></ul></div>Thu, 30 May 2024 14:45:00 +0200tag:www.knot-resolver.cz,2024-05-30:/2024-05-30-knot-resolver-5.7.3.htmlhttps://www.knot-resolver.cz/2024-03-27-knot-resolver-5.7.2.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix on 32-bit systems with 64-bit time_t (!1510)</li> </ul> </div> Wed, 27 Mar 2024 14:30:00 +0100tag:www.knot-resolver.cz,2024-03-27:/2024-03-27-knot-resolver-5.7.2.htmlhttps://www.knot-resolver.cz/2024-02-13-knot-resolver-5.7.1.html<div class="section" id="security"> <h2>Security</h2> <ul> <li><dl class="first docutils"> <dt>CVE-2023-50868: NSEC3 closest encloser proof can exhaust CPU</dt> <dd><ul class="first last simple"> <li>validator: lower the NSEC3 iteration limit (150 -&gt; 50)</li> <li>validator: similarly also limit excessive NSEC3 salt length</li> <li>cache: limit the amount of …</li></ul></dd></dl></li></ul></div>Tue, 13 Feb 2024 14:30:00 +0100tag:www.knot-resolver.cz,2024-02-13:/2024-02-13-knot-resolver-5.7.1.htmlhttps://www.knot-resolver.cz/2023-08-22-knot-resolver-5.7.0.html<div class="section" id="security"> <h2>Security</h2> <ul> <li><p class="first">avoid excessive TCP reconnections in a few more cases Like before, the remote server had to behave nonsensically in order to inflict this upon itself, but it might be …</p></li></ul></div>Tue, 22 Aug 2023 14:30:00 +0200tag:www.knot-resolver.cz,2023-08-22:/2023-08-22-knot-resolver-5.7.0.htmlhttps://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html<div class="section" id="security"> <h2>Security</h2> <ul> <li><p class="first">avoid excessive TCP reconnections in some cases (!1380) For example, a DNS server that just closes connections without answer could cause lots of work for the resolver (and itself …</p></li></ul></div>Thu, 26 Jan 2023 18:30:00 +0100tag:www.knot-resolver.cz,2023-01-26:/2023-01-26-knot-resolver-5.6.0.htmlhttps://www.knot-resolver.cz/2022-09-21-knot-resolver-5.5.3.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix CPU-expensive DoS by malicious domains - CVE-2022-40188</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>fix config_tests on macOS (both HW variants)</li> </ul> </div> Wed, 21 Sep 2022 14:30:00 +0200tag:www.knot-resolver.cz,2022-09-21:/2022-09-21-knot-resolver-5.5.3.htmlhttps://www.knot-resolver.cz/2022-08-16-knot-resolver-5.5.2.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>support libknot 3.2 (!1309)</li> <li>priming module: hide failures from the default log level (!1310)</li> <li>reduce memory usage in some cases (!1328)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>daemon/http: improve URI checks to …</li></ul></div>Tue, 16 Aug 2022 14:30:00 +0200tag:www.knot-resolver.cz,2022-08-16:/2022-08-16-knot-resolver-5.5.2.htmlhttps://www.knot-resolver.cz/2022-06-14-knot-resolver-5.5.1.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>daemon/tls: disable TLS resumption via tickets for TLS &lt;= 1.2 (#742, !1295)</li> <li>daemon/http: DoH now responds with proper HTTP codes (#728, !1279)</li> <li>renumber module: allow rewriting subnet …</li></ul></div>Tue, 14 Jun 2022 14:30:00 +0200tag:www.knot-resolver.cz,2022-06-14:/2022-06-14-knot-resolver-5.5.1.htmlhttps://www.knot-resolver.cz/2022-03-15-knot-resolver-5.5.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>extended_errors: module for extended DNS error support, RFC8914 (!1234)</li> <li>policy: log policy actions; useful for RPZ debugging (!1239)</li> <li>policy: new action policy.IPTRACE for logging request origin (!1239)</li> <li>prefill …</li></ul></div>Tue, 15 Mar 2022 14:30:00 +0100tag:www.knot-resolver.cz,2022-03-15:/2022-03-15-knot-resolver-5.5.0.htmlhttps://www.knot-resolver.cz/2022-01-05-knot-resolver-5.4.4.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix bad zone cut update in certain cases (e.g. AWS; !1237)</li> </ul> </div> Wed, 05 Jan 2022 14:30:00 +0100tag:www.knot-resolver.cz,2022-01-05:/2022-01-05-knot-resolver-5.4.4.htmlhttps://www.knot-resolver.cz/2021-12-01-knot-resolver-5.4.3.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>lua: add kres.parse_rdata() to parse RDATA from string to wire format (!1233)</li> <li>lua: add policy.domains() for exact domain name matching (!1228)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>policy.rpz: fix origin detection …</li></ul></div>Wed, 01 Dec 2021 13:00:00 +0100tag:www.knot-resolver.cz,2021-12-01:/2021-12-01-knot-resolver-5.4.3.htmlhttps://www.knot-resolver.cz/2021-10-13-knot-resolver-5.4.2.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>dns64 module: also map the reverse (PTR) subtree (#478, !1201)</li> <li>dns64 module: allow disabling based on client address (#368, !1201)</li> <li>dns64 module: allow configuring AAAA subnets not allowed in …</li></ul></div>Wed, 13 Oct 2021 14:00:00 +0200tag:www.knot-resolver.cz,2021-10-13:/2021-10-13-knot-resolver-5.4.2.htmlhttps://www.knot-resolver.cz/2021-08-19-knot-resolver-5.4.1.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>docker: base image on Debian 11 (!1203)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix build without doh2 support after 5.4.0 (!1197)</li> <li>fix policy.DEBUG* logging and -V/--version after 5.4.0 …</li></ul></div>Thu, 19 Aug 2021 15:00:00 +0200tag:www.knot-resolver.cz,2021-08-19:/2021-08-19-knot-resolver-5.4.1.htmlhttps://www.knot-resolver.cz/2021-07-29-knot-resolver-5.4.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>fine grained logging and syslog support (!1181)</li> <li>expose HTTP headers for processing DoH requests (!1165)</li> <li>improve assertion mechanism for debugging (!1146)</li> <li>support apkg tool for packaging workflow (!1178)</li> <li>support …</li></ul></div>Thu, 29 Jul 2021 16:00:00 +0200tag:www.knot-resolver.cz,2021-07-29:/2021-07-29-knot-resolver-5.4.0.htmlhttps://www.knot-resolver.cz/2021-05-05-knot-resolver-5.3.2.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>validator: fix 5.3.1 regression on over-limit NSEC3 edge case (!1169) Assertion might be triggered by query/answer, potentially DoS.</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>cache: improve handling write errors from LMDB …</li></ul></div>Wed, 05 May 2021 12:00:00 +0200tag:www.knot-resolver.cz,2021-05-05:/2021-05-05-knot-resolver-5.3.2.htmlhttps://www.knot-resolver.cz/2021-03-31-knot-resolver-5.3.1.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>policy.STUB: try to avoid TCP (compared to 5.3.0; !1155)</li> <li>validator: downgrade NSEC3 records with too many iterations (&gt;150; !1160)</li> <li>additional improvements to nameserver selection algorithm (!1154 …</li></ul></div>Wed, 31 Mar 2021 17:00:00 +0200tag:www.knot-resolver.cz,2021-03-31:/2021-03-31-knot-resolver-5.3.1.htmlhttps://www.knot-resolver.cz/2021-02-25-knot-resolver-5.3.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>more consistency in using parent-side records for NS addresses (!1097)</li> <li>better algorithm for choosing nameservers (!1030, !1126, !1140, !1141, !1143)</li> <li>daf module: add daf.clear() (!1114)</li> <li>dnstap module: more …</li></ul></div>Thu, 25 Feb 2021 14:00:00 +0100tag:www.knot-resolver.cz,2021-02-25:/2021-02-25-knot-resolver-5.3.0.htmlhttps://www.knot-resolver.cz/2020-12-09-knot-resolver-5.2.1.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>doh2: send Cache-Control header with TTL (#617, !1095)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix map() command on 32-bit platforms; regressed in 5.2.0 (!1093)</li> <li>doh2: restrict endpoints to doh and dns-query (#636 …</li></ul></div>Wed, 09 Dec 2020 11:00:00 +0100tag:www.knot-resolver.cz,2020-12-09:/2020-12-09-knot-resolver-5.2.1.htmlhttps://www.knot-resolver.cz/2020-11-11-knot-resolver-5.2.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>doh2: add native C module for DNS-over-HTTPS (#600, !997)</li> <li>xdp: add server-side XDP support for higher UDP performance (#533, !1083)</li> <li>lower default EDNS buffer size to 1232 bytes (#538 …</li></ul></div>Wed, 11 Nov 2020 14:00:00 +0100tag:www.knot-resolver.cz,2020-11-11:/2020-11-11-knot-resolver-5.2.0.htmlhttps://www.knot-resolver.cz/2020-09-08-knot-resolver-5.1.3.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>capabilities are no longer constrained when running as root (!1012)</li> <li>cache: add percentage usage to cache.stats() (#580, !1025)</li> <li>cache: add number of cache entries to cache.stats() (#510 …</li></ul></div>Tue, 08 Sep 2020 13:59:00 +0200tag:www.knot-resolver.cz,2020-09-08:/2020-09-08-knot-resolver-5.1.3.htmlhttps://www.knot-resolver.cz/2020-07-01-knot-resolver-5.1.2.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>hints module: NODATA answers also for non-address queries (!1005)</li> <li>tls: send alert to peer if handshake fails (!1007)</li> <li>cache: fix interaction between LMDB locks and preallocation (!1013)</li> <li>cache garbage …</li></ul></div>Wed, 01 Jul 2020 14:30:00 +0200tag:www.knot-resolver.cz,2020-07-01:/2020-07-01-knot-resolver-5.1.2.htmlhttps://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix CVE-2020-12667: mitigation for <a class="reference external" href="https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/">NXNSAttack</a> DNS protocol vulnerability</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>control sockets: recognize newline as command boundary</li> </ul> <p>For more information please see blog post about <a class="reference external" href="https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/">NXNSAttack</a>.</p> </div> Tue, 19 May 2020 11:00:00 +0200tag:www.knot-resolver.cz,2020-05-19:/2020-05-19-knot-resolver-5.1.1.htmlhttps://www.knot-resolver.cz/2020-04-29-knot-resolver-5.1.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>cache garbage collector: reduce filesystem operations when idle (!946)</li> <li>policy.DEBUG_ALWAYS and policy.DEBUG_IF for limited verbose logging (!957)</li> <li>daemon: improve TCP query latency under heavy TCP load (!968 …</li></ul></div>Wed, 29 Apr 2020 13:30:00 +0200tag:www.knot-resolver.cz,2020-04-29:/2020-04-29-knot-resolver-5.1.0.htmlhttps://www.knot-resolver.cz/2020-02-05-knot-resolver-5.0.1.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>systemd: use correct cache location for garbage collector (#543)</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>cache: add cache.fssize() lua function to configure entire free disk space on dedicated cache partition (#524, !932)</li> </ul> </div> Wed, 05 Feb 2020 16:30:00 +0100tag:www.knot-resolver.cz,2020-02-05:/2020-02-05-knot-resolver-5.0.1.htmlhttps://www.knot-resolver.cz/2020-01-27-knot-resolver-5.0.0.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>see upgrading guide: <a class="reference external" href="https://knot-resolver.readthedocs.io/en/stable/upgrading.html">https://knot-resolver.readthedocs.io/en/stable/upgrading.html</a></li> <li>systemd sockets are no longer supported (#485)</li> <li>net.listen() throws an error if it fails to bind …</li></ul></div>Mon, 27 Jan 2020 14:00:00 +0100tag:www.knot-resolver.cz,2020-01-27:/2020-01-27-knot-resolver-5.0.0.htmlhttps://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html<div class="section" id="security-cve-2019-19331"> <h2>Security - CVE-2019-19331</h2> <ul class="simple"> <li>fix speed of processing large RRsets (DoS, #518)</li> <li>improve CNAME chain length accounting (DoS, !899)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>http module: use SO_REUSEPORT (!879)</li> <li>systemd: kresd&#64;.service now properly starts after …</li></ul></div>Wed, 04 Dec 2019 15:30:00 +0100tag:www.knot-resolver.cz,2019-12-04:/2019-12-04-knot-resolver-4.3.0.htmlhttps://www.knot-resolver.cz/2019-10-07-knot-resolver-4.2.2.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>lua bindings: fix a 4.2.1 regression on 32-bit systems (#514) which also fixes libknot 2.9 support on all systems</li> </ul> </div> Mon, 07 Oct 2019 14:30:00 +0200tag:www.knot-resolver.cz,2019-10-07:/2019-10-07-knot-resolver-4.2.2.htmlhttps://www.knot-resolver.cz/2019-09-26-knot-resolver-4.2.1.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>rebinding module: fix handling some requests, respect ALLOW_LOCAL flag</li> <li>fix incorrect SERVFAIL on cached bogus answer for +cd request (!860) (regression since 4.1.0 release, in less common …</li></ul></div>Thu, 26 Sep 2019 14:30:00 +0200tag:www.knot-resolver.cz,2019-09-26:/2019-09-26-knot-resolver-4.2.1.htmlhttps://www.knot-resolver.cz/2019-08-05-knot-resolver-4.2.0.html<div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>queries without RD bit set are REFUSED by default (!838)</li> <li>support forwarding to multiple targets (!825)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>tls_client: fix issue with TLS session resumption (#489)</li> <li>rebinding module: fix another …</li></ul></div>Mon, 05 Aug 2019 17:00:00 +0200tag:www.knot-resolver.cz,2019-08-05:/2019-08-05-knot-resolver-4.2.0.htmlhttps://www.knot-resolver.cz/2019-07-10-knot-resolver-4.1.0.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix CVE-2019-10190: do not pass bogus negative answer to client (!827)</li> <li>fix CVE-2019-10191: do not cache negative answer with forged QNAME+QTYPE (!839)</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>new cache garbage collector is …</li></ul></div>Wed, 10 Jul 2019 14:40:00 +0200tag:www.knot-resolver.cz,2019-07-10:/2019-07-10-knot-resolver-4.1.0.htmlhttps://www.knot-resolver.cz/2019-04-18-knot-resolver-4.0.0.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>see upgrading guide: <a class="reference external" href="https://knot-resolver.readthedocs.io/en/stable/upgrading.html">https://knot-resolver.readthedocs.io/en/stable/upgrading.html</a></li> <li>configuration: trust_anchors aliases .file, .config() and .negative were removed (!788)</li> <li>configuration: trust_anchors.keyfile_default is no longer accessible …</li></ul></div>Thu, 18 Apr 2019 18:00:00 +0200tag:www.knot-resolver.cz,2019-04-18:/2019-04-18-knot-resolver-4.0.0.htmlhttps://www.knot-resolver.cz/2019-01-10-knot-resolver-3.2.1.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>trust_anchors: respect validity time range during TA bootstrap (!748)</li> <li>fix TLS rehandshake handling (!739)</li> <li>make TLS_FORWARD compatible with GnuTLS 3.3 (!741)</li> <li>special thanks to Grigorii Demidov for his …</li></ul></div>Thu, 10 Jan 2019 13:00:00 +0100tag:www.knot-resolver.cz,2019-01-10:/2019-01-10-knot-resolver-3.2.1.htmlhttps://www.knot-resolver.cz/2018-12-17-knot-resolver-3.2.0.html<div class="section" id="new-features"> <h2>New features</h2> <ul class="simple"> <li>module edns_keepalive to implement server side of RFC 7828 (#408)</li> <li>module nsid to implement server side of RFC 5001 (#289)</li> <li>module bogus_log provides .frequent() table (!629, credit Ulrich …</li></ul></div>Mon, 17 Dec 2018 15:00:00 +0100tag:www.knot-resolver.cz,2018-12-17:/2018-12-17-knot-resolver-3.2.0.htmlhttps://www.knot-resolver.cz/2018-11-02-knot-resolver-3.1.0.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>hints.use_nodata(true) by default; that's what most users want</li> <li>libknot &gt;= 2.7.2 is required</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>cache: handle out-of-space SIGBUS slightly better (#197)</li> <li>daemon: improve TCP timeout …</li></ul></div>Fri, 02 Nov 2018 16:00:00 +0100tag:www.knot-resolver.cz,2018-11-02:/2018-11-02-knot-resolver-3.1.0.htmlhttps://www.knot-resolver.cz/2018-08-20-knot-resolver-3.0.0.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>cache: fail lua operations if cache isn't open yet (!639) By default cache is opened <em>after</em> reading the configuration, and older versions were silently ignoring cache operations. Valid …</li></ul></div>Mon, 20 Aug 2018 11:00:00 +0200tag:www.knot-resolver.cz,2018-08-20:/2018-08-20-knot-resolver-3.0.0.htmlhttps://www.knot-resolver.cz/2018-08-02-knot-resolver-2.4.1.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix CVE-2018-10920: Improper input validation bug in DNS resolver component (security!7, security!9)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>cache: fix TTL overflow in packet due to min_ttl (#388, security!8)</li> <li>TLS session …</li></ul></div>Thu, 02 Aug 2018 14:00:00 +0200tag:www.knot-resolver.cz,2018-08-02:/2018-08-02-knot-resolver-2.4.1.htmlhttps://www.knot-resolver.cz/2018-07-03-knot-resolver-2.4.0.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>minimal libknot version is now 2.6.7 to pull in latest fixes (#366)</li> </ul> </div> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix a rare case of zones incorrectly downgraded to insecure status (!576)</li> </ul> </div> <div class="section" id="new-features"> <h2>New …</h2></div>Tue, 03 Jul 2018 12:00:00 +0200tag:www.knot-resolver.cz,2018-07-03:/2018-07-03-knot-resolver-2.4.0.htmlhttps://www.knot-resolver.cz/2018-04-23-knot-resolver-2.3.0.html<div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix CVE-2018-1110: denial of service triggered by malformed DNS messages (!550, !558, security!2, security!4)</li> <li>increase resilience against slow lorris attack (security!5)</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>validation: fix SERVFAIL in …</li></ul></div>Mon, 23 Apr 2018 14:00:00 +0200tag:www.knot-resolver.cz,2018-04-23:/2018-04-23-knot-resolver-2.3.0.htmlhttps://www.knot-resolver.cz/2018-03-28-knot-resolver-2.2.0.html<div class="section" id="new-features"> <h2>New features</h2> <ul class="simple"> <li>cache server unavailability to prevent flooding unreachable servers (Please note that caching algorithm needs further optimization and will change in further versions but we need to gather operational …</li></ul></div>Wed, 28 Mar 2018 14:00:00 +0200tag:www.knot-resolver.cz,2018-03-28:/2018-03-28-knot-resolver-2.2.0.htmlhttps://www.knot-resolver.cz/2018-02-23-knot-resolver-2.1.1.html<div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>when iterating, avoid unnecessary queries for NS in insecure parent. This problem worsened in 2.0.0. (#246)</li> <li>prevent UDP packet leaks when using TLS forwarding</li> <li>fix the hints …</li></ul></div>Fri, 23 Feb 2018 14:00:00 +0100tag:www.knot-resolver.cz,2018-02-23:/2018-02-23-knot-resolver-2.1.1.htmlhttps://www.knot-resolver.cz/2018-02-16-knot-resolver-2.1.0.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>stats: remove tracking of expiring records (predict uses another way)</li> <li>systemd: re-use a single kresd.socket and kresd-tls.socket</li> <li>ta_sentinel: implement protocol draft-ietf-dnsop-kskroll-sentinel-01 (our draft-ietf-dnsop-kskroll-sentinel-00 implementation had inverted …</li></ul></div>Fri, 16 Feb 2018 15:00:00 +0100tag:www.knot-resolver.cz,2018-02-16:/2018-02-16-knot-resolver-2.1.0.htmlhttps://www.knot-resolver.cz/2018-01-31-knot-resolver-2.0.0.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>systemd: change unit files to allow running multiple instances, deployments with single instance now must use <cite>kresd&#64;1.service</cite> instead of <cite>kresd.service</cite>; see kresd.systemd(8) for …</li></ul></div>Wed, 31 Jan 2018 15:00:00 +0100tag:www.knot-resolver.cz,2018-01-31:/2018-01-31-knot-resolver-2.0.0.htmlhttps://www.knot-resolver.cz/2018-01-23-knot-resolver-1.5.3.html<p>Knot Resolver 1.5.3 is a tiny bugfix release.</p> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix the hints module on some systems, e.g. Fedora. Symptom: <cite>undefined symbol: engine_hint_root_file</cite></li> </ul> </div> Tue, 23 Jan 2018 15:00:00 +0100tag:www.knot-resolver.cz,2018-01-23:/2018-01-23-knot-resolver-1.5.3.htmlhttps://www.knot-resolver.cz/2018-01-22-knot-resolver-1.5.2.html<p>Knot Resolver 1.5.2 is a small security release.</p> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix CVE-2018-1000002: insufficient DNSSEC validation, allowing attackers to deny existence of some data by forging packets. Some combinations pointed …</li></ul></div>Mon, 22 Jan 2018 13:00:00 +0100tag:www.knot-resolver.cz,2018-01-22:/2018-01-22-knot-resolver-1.5.2.htmlhttps://www.knot-resolver.cz/2017-12-12-knot-resolver-1.5.1.html<div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>script supervisor.py was removed, please migrate to a real process manager</li> <li>module ketcd was renamed to etcd for consistency</li> <li>module kmemcached was renamed to memcached for consistency …</li></ul></div>Tue, 12 Dec 2017 14:00:00 +0100tag:www.knot-resolver.cz,2017-12-12:/2017-12-12-knot-resolver-1.5.1.htmlhttps://www.knot-resolver.cz/2017-11-02-knot-resolver-1.5.0.html<p>Knot Resolver 1.5.0 has been released.</p> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>fix loading modules on Darwin</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>new module ta_signal_query supporting Signaling Trust Anchor Knowledge using Keytag Query (RFC 8145 section 5 …</li></ul></div>Thu, 02 Nov 2017 14:00:00 +0100tag:www.knot-resolver.cz,2017-11-02:/2017-11-02-knot-resolver-1.5.0.htmlhttps://www.knot-resolver.cz/2017-10-26-knot-resolver-1.99.1-alpha.html<p>Knot Resolver 1.99.1-alpha has been released. This is an experimental release meant for testing aggressive caching.</p> <p>It contains some regressions and might (theoretically) be even vulnerable. The current …</p>Thu, 26 Oct 2017 18:00:00 +0200tag:www.knot-resolver.cz,2017-10-26:/2017-10-26-knot-resolver-1.99.1-alpha.htmlhttps://www.knot-resolver.cz/2017-09-22-knot-resolver-1.4.0.html<p>Knot Resolver 1.4.0 has been released.</p> <div class="section" id="incompatible-changes"> <h2>Incompatible changes</h2> <ul class="simple"> <li>lua: query flag-sets are no longer represented as plain integers. kres.query.* no longer works, and kr_query_t lost trivial methods …</li></ul></div>Fri, 22 Sep 2017 12:00:00 +0200tag:www.knot-resolver.cz,2017-09-22:/2017-09-22-knot-resolver-1.4.0.htmlhttps://www.knot-resolver.cz/2017-08-09-knot-resolver-1.3.3.html<p>Knot Resolver 1.3.3 has been released.</p> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>Fix a critical DNSSEC flaw. Signatures might be accepted as valid even if the signed data was not in bailiwick of …</li></ul></div>Wed, 09 Aug 2017 12:00:00 +0200tag:www.knot-resolver.cz,2017-08-09:/2017-08-09-knot-resolver-1.3.3.htmlhttps://www.knot-resolver.cz/2017-06-28-knot-resolver-1.3.2.html<p>Knot Resolver 1.3.2 has been released.</p> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>fix possible opportunities to use insecure data from cache as keys for validation</li> </ul> </div> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>daemon: check existence of config file even …</li></ul></div>Wed, 28 Jun 2017 14:00:00 +0200tag:www.knot-resolver.cz,2017-06-28:/2017-06-28-knot-resolver-1.3.2.htmlhttps://www.knot-resolver.cz/2017-06-23-knot-resolver-1.3.1.html<p>Knot Resolver 1.3.1 has been released.</p> <div class="section" id="bugfixes"> <h2>Bugfixes</h2> <ul class="simple"> <li>modules/http: fix finding the static files (bug from 1.3.0)</li> <li>policy.FORWARD: fix some cases of CNAMEs obstructing search …</li></ul></div>Fri, 23 Jun 2017 14:00:00 +0200tag:www.knot-resolver.cz,2017-06-23:/2017-06-23-knot-resolver-1.3.1.htmlhttps://www.knot-resolver.cz/2017-06-13-knot-resolver-1.3.0.html<p>Knot Resolver 1.3.0 has been released.</p> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>Refactor handling of AD flag and security status of resource records. In some cases it was possible for secure domains to …</li></ul></div>Tue, 13 Jun 2017 09:00:00 +0200tag:www.knot-resolver.cz,2017-06-13:/2017-06-13-knot-resolver-1.3.0.htmlhttps://www.knot-resolver.cz/2017-04-24-knot-resolver-1.2.6.html<p>Knot Resolver 1.2.6 has been released.</p> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>dnssec: don't set AD flag for NODATA answers if wildcard non-existence is not guaranteed due to opt-out in NSEC3</li> </ul> </div> <div class="section" id="improvements"> <h2>Improvements</h2> <ul class="simple"> <li>layer …</li></ul></div>Mon, 24 Apr 2017 16:20:00 +0200tag:www.knot-resolver.cz,2017-04-24:/2017-04-24-knot-resolver-1.2.6.htmlhttps://www.knot-resolver.cz/2017-04-05-knot-resolver-1.2.5.html<p>Knot Resolver 1.2.5 has been released.</p> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>layer/validate: clear AD if closest encloser proof has opt-outed NSEC3 (#169)</li> <li>layer/validate: check if NSEC3 records in wildcard expansion …</li></ul></div>Wed, 05 Apr 2017 15:30:00 +0200tag:www.knot-resolver.cz,2017-04-05:/2017-04-05-knot-resolver-1.2.5.htmlhttps://www.knot-resolver.cz/2017-03-07-knot-resolver-1.2.4.html<p>Knot Resolver 1.2.4 has been released.</p> <div class="section" id="security"> <h2>Security</h2> <ul class="simple"> <li>Knot Resolver 1.2.0 and higher could return AD flag for insecure answer if the daemon received answer with invalid …</li></ul></div>Tue, 07 Mar 2017 14:30:00 +0100tag:www.knot-resolver.cz,2017-03-07:/2017-03-07-knot-resolver-1.2.4.htmlhttps://www.knot-resolver.cz/2017-02-23-knot-resolver-1.2.3.html<p>Knot Resolver 1.2.3 has been released.</p> <div class="section" id="bugfixes"> <h2>Bugfixes:</h2> <ul class="simple"> <li>Disable storing GLUE records into the cache even in the (non-default) QUERY_PERMISSIVE mode</li> <li>iterate: skip answer RRs that don't match the …</li></ul></div>Thu, 23 Feb 2017 16:00:00 +0100tag:www.knot-resolver.cz,2017-02-23:/2017-02-23-knot-resolver-1.2.3.htmlhttps://www.knot-resolver.cz/2017-02-10-knot-resolver-1.2.2.html<p>Knot Resolver 1.2.2 has been released.</p> <div class="section" id="bugfixes"> <h2>Bugfixes:</h2> <ul class="simple"> <li>Fix -k argument processing to avoid out-of-bounds memory accesses</li> <li>lib/resolve: fix zonecut fetching for explicit DS queries</li> <li>hints: more NULL …</li></ul></div>Fri, 10 Feb 2017 13:00:00 +0100tag:www.knot-resolver.cz,2017-02-10:/2017-02-10-knot-resolver-1.2.2.htmlhttps://www.knot-resolver.cz/2017-02-01-knot-resolver-1.2.1.html<p>Knot Resolver 1.2.1 has been released.</p> <p>It was discovered during internal testing that under special query combinations the Knot Resolver can provide Insecure data from the cache on …</p>Wed, 01 Feb 2017 20:53:00 +0100tag:www.knot-resolver.cz,2017-02-01:/2017-02-01-knot-resolver-1.2.1.htmlhttps://www.knot-resolver.cz/2017-01-25-knot-resolver-1.2.0.html<p>Knot Resolver 1.2.0 has been released.</p> <p>CZ.NIC is proud to release a new release of Knot Resolver.</p> <p>The Knot Resolver team has worked very hard to bring …</p>Wed, 25 Jan 2017 14:00:00 +0100tag:www.knot-resolver.cz,2017-01-25:/2017-01-25-knot-resolver-1.2.0.htmlhttps://www.knot-resolver.cz/2016-12-20-no-dnssec-with-forward-policy.html<p>It was discovered that the documentation for <a class="reference external" href="http://knot-resolver.readthedocs.io/en/v1.1.1/modules.html#query-policies">FORWARD policy</a> missed the information about DNSSEC validation. The query policies are only applied on inbound queries and therefore the full DNSSEC validation …</p>Tue, 20 Dec 2016 14:00:00 +0100tag:www.knot-resolver.cz,2016-12-20:/2016-12-20-no-dnssec-with-forward-policy.htmlhttps://www.knot-resolver.cz/2016-08-24-knot-resolver-1.1.1.html<p>Knot Resolver 1.1.1 has been released.</p> <p>This Knot Resolver release fixes couple of bugs related to failures when nameservers were not available and Knot Resolver had to retry …</p>Wed, 24 Aug 2016 14:00:00 +0200tag:www.knot-resolver.cz,2016-08-24:/2016-08-24-knot-resolver-1.1.1.htmlhttps://www.knot-resolver.cz/2016-08-12-knot-resolver-1.1.0.html<p>Knot Resolver 1.1.0 has been released.</p> <p>The second production-ready release of Knot Resolver has been released.</p> <p>The list of notable features:</p> <ul class="simple"> <li>RFC7873 DNS Cookies</li> <li>RFC7858 DNS over TLS …</li></ul>Fri, 12 Aug 2016 08:00:00 +0200tag:www.knot-resolver.cz,2016-08-12:/2016-08-12-knot-resolver-1.1.0.htmlhttps://www.knot-resolver.cz/2016-05-30-knot-resolver-1.0.0.html<p>Knot Resolver 1.0.0 has been released.</p> <p>The first production-ready release of Knot Resolver has been released.</p> <p>The list of notable features:</p> <ul class="simple"> <li>Full DNSSEC Support</li> <li>Automated Root Trust Anchor …</li></ul>Mon, 30 May 2016 10:10:00 +0200tag:www.knot-resolver.cz,2016-05-30:/2016-05-30-knot-resolver-1.0.0.htmlhttps://www.knot-resolver.cz/2016-01-31-knot-resolver-beta3.html<p>Knot Resolver 1.0.0-beta3 released.</p> <ul class="simple"> <li>Outbound query deduplication</li> <li>CLI tools: kresd-host and kresd-query</li> <li>Automatic <a class="reference external" href="http://knot-resolver.readthedocs.org/en/v1.0.0/daemon.html#enabling-dnssec">bootstrap</a> of root TA</li> <li>Built-in <a class="reference external" href="http://knot-resolver.readthedocs.org/en/v1.0.0/build.html#building-with-security-compiler-flags">hardening</a></li> <li>More <a class="reference external" href="http://knot-resolver.readthedocs.org/en/v1.0.0/modules.html#statistics-collector">metrics</a> (dropped, nodata, timeout)</li> <li>Ported to libknot 2 …</li></ul>Sun, 31 Jan 2016 10:00:00 +0100tag:www.knot-resolver.cz,2016-01-31:/2016-01-31-knot-resolver-beta3.html