Vulnerabilities & updates
Thu, October 15
Thu, June 25
NSD 4.14.3 released
We are pleased to announce the release of version 4.14.4 of the authoritative DNS nameserver NSD. This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing …
Thu, March 19
NSD 4.14.2 released
Today, we released version 4.14.2 of the authoritative DNS nameserver NSD. This release addresses a bug in the processing of IXFRs when adding and deleting RRs in collated IXFRs within the same network packet. You can get source packages of this version from the downloads page . Related links …
Tue, February 24
NSD 4.14.1 released
Today, we released version 4.14.1 of the authoritative DNS nameserver NSD. The previous release promised reduced memory footprint from refactored RDATA storage (and it did for the vast majority of cases), but just after the release, we received a report that NSD was consuming more memory for specific …
Thu, December 4
NSD 4.14.0 released
Today, we released version 4.14.0 of the authoritative DNS nameserver NSD. NSD 4.14.0 comes with refactored RDATA storage, reducing the memory footprint of NSD. You can get source packages of this version from the downloads page . Related links: NSD project page Direct Download
Wed, September 3
NSD 4.13.0 released
Today, we released version 4.13.0 of the authoritative DNS nameserver NSD. NSD 4.13.0 now comes with the features --enable-bind8-stats , --enable-zone-stats , --enable-ratelimit , --enable-dnstap enabled by default, reducing confusion when using the same version of NSD packaged by different distributions with different configure options. Additionally, NSD 4.13 …
Thu, April 24
NSD 4.12.0 released
Today, we released version 4.12.0 of the authoritative DNS nameserver NSD. This release introduces Prometheus metrics that can be configured with enable-metrics (see nsd.conf(5)). You can get source packages of this version from the downloads page . Related links: NSD project page Direct Download
Sat, January 18
NSD 4.11.1 released
Today, we released version 4.11.1 of the authoritative DNS nameserver NSD. NSD version 4.11.0 had a serious bug in which applying updates to zones (and other modifications that require a reload, such as adding and deleting zones), could stop entirely after reception of a broken or …
Thu, December 12
NSD 4.11.0 released
Updated 2025-01-18: THIS VERSION HAS A SERIOUS BUG. Please upgrade to NSD 4.11.1 at the earliest opportunity. Today, we released version 4.11.0 of the authoritative DNS nameserver NSD. Version 4.11.0 sees various small features and bugfixes. One notable feature is that configuration can be …
Fri, August 2
NSD 4.10.1 released
Today, we released version 4.10.1 of the authoritative DNS nameserver NSD. Version 4.10.1 consists primarily of bug fixes. @bilias implemented mutual TLS authentication for zone transfers. Please consult the nsd.conf manual for details on the newly introduced configuration options tls-auth-port and tls-auth-xfr-only. Michael Orlitzky provided …
Thu, June 13
NSD 4.10.0 released
Today, we released version 4.10.0 of the authoritative DNS nameserver NSD. Version 4.10.0 integrates simdzone and drops the Flex+Bison zone parser. NSD used a Flex+Bison based zone parser since version 1.4.0. The parser served NSD well, but zones have increased in size …
Thu, April 4
NSD 4.9.1 released
Today, we released version 4.9.1 of the authoritative DNS nameserver NSD. This release fixes the builds scripts in the release of version 4.9.0. Version 4.9.0 adds support for DNS Catalog Zones (RFC 9432) version "2". Both producer and consumer roles for catalog zones are …
Wed, April 3
NSD 4.9.0 released
Today, we released version 4.9.0 of the authoritative DNS nameserver NSD. This release adds support for DNS Catalog Zones (RFC 9432) version "2". Both producer and consumer roles for catalog zones are implemented, but only a single consumer zone is allowed. The "coo" property, relevant when multiple consumer …
Wed, December 6
NSD 4.8.0 released
Today, we released version 4.8.0 of the authoritative DNS nameserver NSD. This release introduces PROXYv2 support and faster statistics gathering, removes the database option and fixes bugs. The proxy protocol support is an implementation of PROXYv2 for NSD. It can be configured with proxy-protocol-port: portnum with the port …
Wed, June 7
NSD 4.7.0 released
Today, we released version 4.7.0 of the authoritative DNS nameserver NSD. This release adds a script for bash autocompletion for nsd-control. Also nsd-control can be configured to use unencrypted operation also when compiled without openssl. There is also a systemd service unit example file contributed. The dnstap log …
Thu, November 10
NSD 4.6.1 released
Today, we released version 4.6.1 of the authoritative DNS nameserver NSD. This release has a couple of bug fixes. The alpn is set for dns over tls connections. And the SVCB type supports the dohpath parameter. You can get source packages of this version from the downloads page …
Thu, June 30
NSD 4.6.0 released
Today, we released version 4.6.0 of the authoritative DNS nameserver NSD. This release adds the zone verification support from the CreDNS code. There are also some bug fixes in the ixfr out code. Zone verification can start a verifier program that reads the new zone data. It can …
Fri, May 13
NSD 4.5.0 released
Today, we released version 4.5.0 of the authoritative DNS nameserver NSD. This release fixes a couple of minor bugs and adds IXFR out functionality. With this functionality NSD can respond to IXFR queries and serve IXFR transfers downstream. It is default disabled, that means it does not store …
Thu, February 17
NSD 4.4.0 released
Today, we released version 4.4.0 of the authoritative DNS nameserver NSD. This release changes the memory allocation for outgoing zonetransfers, and this reduces the memory footprint. The defaults for the amounts are the same as before, but there are config options to configure the memory usage. There are …
Thu, December 9
NSD 4.3.9 released
Today, we released version 4.3.9 of the authoritative DNS nameserver NSD. This release contains a small number of bug fixes. The reconfig failure is fixed for cpu-affinity config re-read. Version repository and continuous integration files are removed from the sourcecode tarball. You can get source packages of this …
Tue, October 12
NSD 4.3.8 released
Today, we released version 4.3.8 of the authoritative DNS nameserver NSD. This release fixes a crash bug in delegation answers, and fixes in NSEC3 answers. Also compile fixes for OpenSSL. The OpenSSL 3.0 API is supported. The Mutual TLS feature allows for client authentication for XFR-over-TLS connections …
Thu, July 22
NSD 4.3.7 released
Today, we released version 4.3.7 of the authoritative DNS nameserver NSD. This release fixes a crash in dnstap. New features are XoT which provides AXFR and IXFR over TLS, and DNS Cookies support and SVCB and HTTPS RR type support. For zone transfer TLS can be turned on …
Tue, April 6
NSD 4.3.6 released
Today, we released version 4.3.6 of the authoritative DNS nameserver NSD. This release contains a bug fix for a zone file parse failure for text records. The release also adds the feature to print a local address, if the address is configured, in dnstap logs. The interface for …
Tue, January 26
NSD 4.3.5 released
Today, we released version 4.3.5 of the authoritative DNS nameserver NSD. This release fixes a number of bugs. It fixes a number of corner case differences for the output more similar to Bind. The configure sources are compatible with the new autoconf 2.70. You can get source …
Tue, December 1
NSD 4.3.4 released
Today, we released version 4.3.4 of the authoritative DNS nameserver NSD. This release fixes CVE-2020-28935, this solves a problem where the pidfile is altered by a symlink, and fails if a symlink is encountered. See https://nlnetlabs.nl/downloads/nsd/CVE-2020-28935.txt for more information. Also there are …
Thu, October 8
NSD 4.3.3 released
Today, we released version 4.3.3 of the authoritative DNS nameserver NSD. This release contains the DNS Flag Day 2020 fixes. This sets the default EDNS buffer size to 1232, that should reduce fragmentation. https://dnsflagday.net/2020/ There is a new feature where it is possible to list …
Tue, July 14
NSD 4.3.2 released
Today, we released version 4.3.2 of the authoritative DNS nameserver NSD. This release fixes a number of bugs, and adds options to set log-only-syslog and min-expire-time in nsd.conf and nsd -v for configure line and library versions. You can get source packages of this version from the …
Thu, April 16
NSD 4.3.1 released
Today, we released version 4.3.1 of the authoritative DNS nameserver NSD. This release fixes a number of bugs, and fixes a bug for FreeBSD start. You can get source packages of this version from the downloads page . Related links: NSD project page Direct Download
Tue, March 17
NSD 4.3.0 released
Today, we released version 4.3.0 of the authoritative DNS nameserver NSD. This release adds CPU affinity. By pinning a server process to a specific CPU, having a separate network card also for that CPU, and an interface address also for that server process, the throughput is increased. This …
Tue, December 10
NSD 4.2.4 released
Today, we released version 4.2.4 of the authoritative DNS name server NSD. This release mainly fixes regressions in the configuration file parser for the minimal-responses: yesno , round-robin: yesno and log-time-ascii: yesno options. There are some portability fixes too, make distclean will now cleanup config.h and a maintainer-clean …
Wed, November 20
NSD 4.2.3 released
Today, we released version 4.2.3 of the authoritative DNS name server NSD. This release has log fixes, features of confine-to-zone and startup management, an implementation changes in the configuration parser and socket handling code simplifications. The implementation changes make the parser context aware, which is useful for the …
Mon, August 19
NSD 4.2.2 released
Today, we released version 4.2.2 of the authoritative DNS name server NSD. This release fixes a number of, smaller, bugs. Several failures are fixed in the zone file parser, reported by fuzzing from Frederic Cambus. NSD now warns when a zonefile is parsed with SSHFP records in it …
Tue, July 9
NSD 4.2.1 released
Today, we released version 4.2.1 of the authoritative DNS name server NSD. This release fixes issues in the stream handling, from 4.2.0, but also earlier, in the event handling of streams. The new statistics counters for TLS can give information about how many incoming DNS over …
Tue, June 11
NSD 4.2.0 released
Today, we released version 4.2.0 of the authoritative DNS name server NSD. This release contains new features, contributed from Sinodun, that implement TCP fast open support and also support for service on DNS over TLS. There is also TLS OCSP stapling support with the tls-service-ocsp option in nsd …
Mon, March 25
NSD 4.1.27 released
Today, we released version 4.1.27 of the authoritative DNS name server NSD. This release contains improved deny-any responses, and on-the-fly changes for tsig keys via nsd-control . There is a number of bug fixes as well. You can get source packages of this version from the downloads page . Related …
Tue, December 4
NSD 4.1.26 released
Today, we released version 4.1.26 of the authoritative DNS name server NSD. This version has DNSTAP support ( http://dnstap.info ). Use --enable-dnstap for ./configure to turn it on, then in nsd.conf enable the dnstap feature with dnstap-enable: yes and set one or more of dnstap-log-..-messages to …
Tue, September 25
NSD 4.1.25 released
Today, we released version 4.1.25 of the authoritative DNS name server NSD. This release contains mostly just bug fixes. The NSEC3 fixup helps certain NSEC3 failures, and there is a fix for systemd integration. You can get source packages of this version from the downloads page . Related links …
Mon, August 13
NSD 4.1.24 released
Today, we released version 4.1.24 of the authoritative DNS name server NSD. This version has a fix for a bug in resigning zones with different NSEC3 salt, where NSD would not pick up the NSEC3PARAM record, and serve answers that omit NSEC3 records. NSD is now lenient and …
Mon, July 30
NSD 4.1.23 released
Today, we released version 4.1.23 of the authoritative DNS name server NSD. NSD versions 4.1.22 and before are vulnerable in comparing TSIG information and this can be used to discover a TSIG secret. NSD uses TSIG to protect zone transfers. The TSIG code uses a secret …
Mon, June 11
NSD 4.1.22 released
Today, we released version 4.1.22 of the authoritative DNS name server NSD. This release fixes a bug where zone transfers would not succeed, because of an error in the selective NSEC3 allocation (introduced in 4.1.18). The refuse ANY query feature now sends truncated answers over UDP …
Mon, May 14
NSD 4.1.21 released
Today, we released version 4.1.21 of the authoritative DNS name server NSD. This release introduces query type ANY refusal. NSD already has RRL support that by default throttles queries, and also queries of type ANY. But an nsd.conf option has been added, this makes NSD refuse queries …
Tue, February 20
NSD 4.1.20 released
Today, we released version 4.1.20 of the authoritative DNS name server NSD. This version is a bug fix release intended to close two memory leaks. One leak may occur when reading the data of unknown record types from zone files, while the other may happen when rehashing NSEC3 …
Mon, December 11
NSD 4.1.19 released
This release fixes IPv6 for the notify sending feature from 4.1.18.
Thu, November 30
NSD 4.1.18 released
This release has features for saving memory and faster notification.With --enable-packed, 33% memory savings could be had, or somethingalong that size. Notification of secondary servers happens in parallel,and has faster timeouts. More sockets are used for zone transfers.This speeds up communication with a larger set of servers. Additionallya bug is fixed for dual-loaded parent-and-child zone configured at thesame time, when one of the zones has not loaded properly.
Fri, July 21
NSD 4.1.17 released
This release has a fix that likely stops zone transfer failures and this release can parse the pre-errata and fixed errata format for deletes in CDS and CDNSKEY records.
Tue, April 25
NSD 4.1.16 released
This release contains the minimal response nsd.conf option and bug fixes.
Thu, February 16
NSD 4.1.15 released
This release contains bugfixes, in serial number parsing and nsec3 hash collision reporting.
Thu, December 8
NSD 4.1.14 released
This version performs less zone transfer attempts, reducing load on the server. The xfrd state file has a new version number, to store theinformation. The new version of the file is written on exit of the daemon. And bug fixes.
Tue, September 27
NSD 4.1.13 released
Some features, such as multi master check option that does not upgrade from the first master that answers, but picks the best one. Additional section handling for type SRV. And bug fixes.