• Print
  • Share
  • Dark
    Light
Contents
Contents x

BIND 9 Significant Features Matrix

  • Updated on 18 Oct 2018
  • 4 minutes to read
  • Contributors

The "S" (stable preview) editions and the other release branches of BIND 9 differ in a number of ways. This table lists the major feature differences for current main supported versions of BIND 9 (with some provisional but incomplete insight into our future release plans where features overlap with already-released branches).

Feature9.99.9-S (stable preview)
9.109.10-S9.119.11-S9.12
Removed support for      dig + sigchase
lwresd
dlv trust anchor

Automatic interface scanning

allallallallall
Case-sensitive name compression9.9.59.9.5-S1allallallallall
Crypto: Native PKCS#11

allallallallall
DDOS Mitigation: DNS COOKIE (previously called SIT)

all (with --enable-sit);
code point updated to COOKIE in 9.10.3		allallall
(multiple cookie secret added)		all
(multiple cookie secret added)
DDOS Mitigation: Faster RPZ and new triggers
allallallallall (refactored RPZ)all (refactored RPZ)
DDOS Mitigation:  Fetch limits (DDoS mitigation for recursive servers)9.9.8
(with --enable-fetchlimit)		9.9.6-S1
(revised 9.9.8-S1)		9.10.3 (with --enable-fetchlimit)allallallall
DDOS Mitigation: Minimal response to 'any' queries


 allallall
DDOS Mitigation: Multiple response rate limiters for different domains
9.9.5-S1
all
all 
DDOS Mitigation: Response rate limiting (RRL)9.9.4
(with --enable-rrl)		allallallallallall
DDOS Mitigation: SERVFAIL caching
9.9.6-S1
allallallall
DDOS Mitigation: Size & ratio controls for response rate limiters
9.9.5-S1
all
all 
DDOS Mitigation: Serve Stale     9.11.4-Sall
DNSSEC: Automatic creation of CDS, CDSKEY records


 allallall
DNSSEC: Negative trust anchors
9.9.6-S1
allallallall
EDNS Client-Subnet (ECS) for resolver


all
all
EDNS Client-Subnet (ECS) option support for authoritative servers


expexpexpexp
EDNS EXPIRE option (server side)  all (with experimental code point);
EXPIRE code point finalized in 9.10.1		allallallall
EDNS EXPIRE option (client side)    allallall
EDNS: Improved EDNS fallback processingallallallallall
EDNS Padding (RFC 7830)   9.10.5-S1 allall
GeoIP support
allallallallallall
Management: Detailed statistics counters
allallallallallall
Management: DNSTAP query/response logging
9.9.8-S5
allallallall
Management: automatic DNSTAP file rolling 9.9.9-S1 all allall
Management: timestamp suffix option for rolled log files
and DNSTAP files		   all allall
Management: JSON statistics
allallallallallall
Management: New XML statistics schema9.9.3all (with --enable-newstats)allallallallall
Management: Prevent duplicate named server instances allallall
Management: Traffic size statistics (per RSSAC02)allallall
nxdomain-redirect option9.9.8-S1allallallall
Performance: EDNS TCP keepalive support (RFC 7828)   all allall
Performance: Fast "map" format zone filesallallallall
Performance: glue cache      all
Performance: Large server tuningallallallallallall
Performance: minimal responses      all
Performance: mutex locking fixes (resolver)   allallallall
Performance: answer synthesis from cached NSEC      all
Performance: Pipelined TCP queries (server side)


all
9.10.6-S2 maximum timeout increased		allall
maximum timeout increased		all
maximum timeout increased
Performance: TCP connection sharing for update forwarding    allallall
Performance: Separate rate limiting for startup NOTIFY messages
9.9.7-S1
allallallall
Provisioning: Catalog zones


 allallall
Provisioning: Dynamic DB (DynDB) support


 allallall
Provisioning: in-view zone option

allallallallall
Resolver: Cache prefetch

allallallallall
Resolver: Prefer IPv6 when querying authoritative servers
9.9.8-S5
allallallall
RNDC: "showzone", "modzone", faster "delzone"
9.9.8-S5
allallallall
RNDC: Python module allallall
RNDC: read-only option9.9.9-S1allallallall
RNDC: zone status reporting

allallallallall
RPZ: refactored RPZ     allall
RPZ: Response Policy Service API      all

New utilities that have been introduced in each branch

Utility9.99.9-S (stable preview)9.109.10-S9.119.11 S9.12
delv  allallallallall
dnssec-cds      all
dnssec-checkds9.9.2allallallallallall
dnssec-coverage9.9.3allallallallallall
dnssec-importkey9.9.59.9.5-S1allallallallall
dnssec-keymgr    allallall
dnssec-verify9.9.2allallallallallall
dnstap-read    allallall
mdig    allallall
named-rrchecker  allallallallall
tsig-keygen  allallallallall

Notes:

  • "all" indicates that this feature was (or will be) introduced in the first public release of this branch.
  • Version numbers indicate that this feature was (or will be) introduced in the specified version, not in the first public release of the branch.
  • DNS COOKIE support was introduced in 9.10 as an experimental feature using the name SIT (server identity token). It can be enabled with --enable-sit in all Unix/Linux builds and is on by default in Windows. In 9.11 the name was changed to COOKIE and the feature is enabled by default in all builds.
Was this article helpful?

Quick Links