Knowledge Base ISC Main Website Ask a Question/Contact ISC
BIND 9.9.8-S6 Release Notes
Author: ISC Support Reference Number: AA-01361 Views: 2338 Created: 2016-03-09 18:40 Last Updated: 2016-03-09 19:31 0 Rating/ Voters


This document summarizes changes since the last production release of BIND on the corresponding major release branch.

BIND 9.9.8-S6 addresses the security issues described in CVE-2016-1285 and CVE-2016-1286.

BIND 9.9.8-S5 adds support for "dnstap" a fast and flexible method of capturing and logging DNS traffic. Improved performance of dual-stack systems by increasing the priority of IPv6 authoritative servers when selecting a server to query, and using servers matching the address family used for the query when possible. BIND 9.9.8-S5 also addresses the issues described in CVE-2016-1284.

BIND 9.9.8-S4 addresses the security issue described in CVE-2015-8704. It also fixes a serious regression in authoritative server selection that was introduced in 9.9.8.

BIND 9.9.8-S3 addresses the security issues described in CVE-2015-3193 (OpenSSL), CVE-2015-8000 and CVE-2015-8461.

BIND 9.9.8-S2 addresses the security issues described in CVE-2015-8000.

BIND 9.9.8-S1 adds a additional NXDOMAIN redirect method ("nxdomain-redirect"), updates "fetches-per-server" and "fetches-per-zone" and deprecates "client-drop-policy".


The latest versions of BIND 9 software can always be found at There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems.

Security Fixes

  • The resolver could abort with an assertion failure due to improper DNAME handling when parsing fetch reply messages. This flaw is disclosed in CVE-2016-1286. [RT #41753]

  • Malformed control messages can trigger assertions in named and rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]

  • A flag could be set in the wrong field when setting up nonrecursive queries; this could cause the SERVFAIL cache to cache responses it shouldn't, and in some circumstances lead to an assertion failure. New querytrace logging has been added which identified this error. Because of the possibility of an assertion with some configurations, this flaw has been disclosed in CVE-2016-1284. [RT #41155]

  • Specific APL data could trigger an INSIST. This flaw is disclosed in CVE-2015-8704. [RT #41396]

  • Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.

  • Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]

  • Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT #40987]

  • An incorrect boundary check in the OPENPGPKEY rdatatype could trigger an assertion failure. This flaw is disclosed in CVE-2015-5986. [RT #40286]

  • A buffer accounting error could trigger an assertion failure when parsing certain malformed DNSSEC keys.

    This flaw was discovered by Hanno Böck of the Fuzzing Project, and is disclosed in CVE-2015-5722. [RT #40212]

  • A specially crafted query could trigger an assertion failure in message.c.

    This flaw was discovered by Jonathan Foote, and is disclosed in CVE-2015-5477. [RT #40046]

  • On servers configured to perform DNSSEC validation, an assertion failure could be triggered on answers from a specially configured server.

    This flaw was discovered by Breno Silveira Soares, and is disclosed in CVE-2015-4620. [RT #39795]

New Features

  • Added support for dnstap, a fast, flexible method for capturing and logging DNS traffic, developed by Robert Edmonds at Farsight Security, Inc., whose assistance is gratefully acknowledged.

    To enable dnstap at compile time, the fstrm and protobuf-c libraries must be available, and BIND must be configured with --enable-dnstap.

    A new utility dnstap-read has been added to allow dnstap data to be presented in a human-readable format.

    For more information on dnstap, see

  • The fetches-per-server and fetches-per-zone options have been updated to take an additional argument, drop or fail, indicating whether queries that exceed the quota should be dropped or answered with SERVFAIL.

  • The experimental client-drop-policy option has been deprecated.

  • Statistics counters have been added to track the number of queries spilled due to the fetches-per-server and fetches-per-zone quotas.

  • An --enable-querytrace configure switch is now available to enable very verbose query tracelogging. This option can only be set at compile time. This option has a negative performance impact and should be used only for debugging.

  • The nxdomain-redirect option specifies a DNS namespace to use for NXDOMAIN redirection. When a recursive lookup returns NXDOMAIN, a second lookup is initiated with the specified name appended to the query name. This allows NXDOMAIN redirection data to be supplied by multiple zones configured on the server or by recursive queries to other servers. (The older method, using a single type redirect zone, has better average performance but is less flexible.) [RT #37989]

  • EDNS COOKIE options content is now displayed as "COOKIE: <hexvalue>".

Feature Changes

  • Updated the compiled in addresses for H.ROOT-SERVERS.NET.

  • Large inline-signing changes should be less disruptive. Signature generation is now done incrementally; the number of signatures to be generated in each quantum is controlled by "sig-signing-signatures number;". [RT #37927]

  • Retrieving the local port range from net.ipv4.ip_local_port_range on Linux is now supported.

  • Active Directory names of the form gc._msdcs.<forest> are now accepted as valid hostnames when using the check-names option. <forest> is still restricted to letters, digits and hyphens.

  • Names containing rich text are now accepted as valid hostnames in PTR records in DNS-SD reverse lookup zones, as specified in RFC 6763. [RT #37889]

  • The default preferred glue is now the address type of the transport the query was received over.

Bug Fixes

  • Negative trust anchors (NTAs) were incorrectly deleted when the server was reloaded or reconfigured. [RT #41058]

  • Authoritative servers that were marked as bogus (e.g. blackholed in configuration or with invalid addresses) were being queried anyway. [RT #41321]

  • Asynchronous zone loads were not handled correctly when the zone load was already in progress; this could trigger a crash in zt.c. [RT #37573]

  • A race during shutdown or reconfiguration could cause an assertion failure in mem.c. [RT #38979]

  • Some answer formatting options didn't work correctly with dig +short. [RT #39291]

  • Malformed records of some types, including NSAP and UNSPEC, could trigger assertion failures when loading text zone files. [RT #40274] [RT #40285]

  • Fixed a possible crash in ratelimiter.c caused by NOTIFY messages being removed from the wrong rate limiter queue. [RT #40350]

  • The default rrset-order of random was inconsistently applied. [RT #40456]

  • BADVERS responses from broken authoritative name servers were not handled correctly. [RT #40427]

  • Several bugs have been fixed in the RPZ implementation:

    • Policy zones that did not specifically require recursion could be treated as if they did; consequently, setting qname-wait-recurse no; was sometimes ineffective. This has been corrected. In most configurations, behavioral changes due to this fix will not be noticeable. [RT #39229]

    • The server could crash if policy zones were updated (e.g. via rndc reload or an incoming zone transfer) while RPZ processing was still ongoing for an active query. [RT #39415]

    • On servers with one or more policy zones configured as slaves, if a policy zone updated during regular operation (rather than at startup) using a full zone reload, such as via AXFR, a bug could allow the RPZ summary data to fall out of sync, potentially leading to an assertion failure in rpz.c when further incremental updates were made to the zone, such as via IXFR. [RT #39567]

    • The server could match a shorter prefix than what was available in CLIENT-IP policy triggers, and so, an unexpected action could be taken. This has been corrected. [RT #39481]

    • The server could crash if a reload of an RPZ zone was initiated while another reload of the same zone was already in progress. [RT #39649]

    • Query names could match against the wrong policy zone if wildcard records were present. [RT #40357]

End of Life

BIND 9.9 (Extended Support Version) will be supported until December, 2017. BIND 9.9-S (Supported Preview Edition) releases will continue to be published in tandem with BIND 9.9 releases until the Supported Preview Edition moves to new branch, which may happen before BIND 9.9 reaches end of life, but not later. See

Thank You

Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at

© 2001-2018 Internet Systems Consortium

For assistance with problems and questions for which you have not been able to find an answer in our Knowledge Base, we recommend searching our community mailing list archives and/or posting your question there (you will need to register there first for your posts to be accepted). The bind-users and the dhcp-users lists particularly have a long-standing and active membership.

ISC relies on the financial support of the community to fund the development of its open source software products. If you would like to support future product evolution and maintenance as well having peace of mind knowing that our team of experts are poised to provide you with individual technical assistance whenever you call upon them, then please consider our Professional Subscription Support services - details can be found on our main website.

  • There is no feedback for this article
Quick Jump Menu