---
title: PowerDNS Recursor 4.0.0 released! | PowerDNS Blog
description: We are pleased to announce the availability of the PowerDNS Recursor 4.0.0. As announced, the Recursor was part of the great PowerDNS 4.x Spring Cleaning.
---

[PowerDNS Blog ](https://blog.powerdns.com)

# [PowerDNS Recursor 4.0.0 released! | PowerDNS Blog](https://blog.powerdns.com/2016/07/11/powerdns-recursor-4-0-0-released)

 Written by [Pieter Lexis](https://blog.powerdns.com/author/pieterlexis) | Jul 11, 2016 4:00:00 AM

We are pleased to announce the availability of the PowerDNS Recursor 4.0.0. As announced, the Recursor was part of the great [PowerDNS 4.x Spring Cleaning](https://blog.powerdns.com/2015/11/28/powerdns-spring-cleaning/). And it was indeed kind of grand. More about the 4.0.0 release process can be found [here](https://blog.powerdns.com/2016/07/11/welcome-to-powerdns-4-0-0).

We changed many things internally to the nameserver:

- Moved to C++ 2011, a cleaner more powerful version of C++ that has allowed us to [improve the quality of implementation](http://bert-hubert.blogspot.nl/2015/01/on-c2011-quality-of-implementation.html) in many places.
- Implemented dedicated infrastructure for dealing with DNS names that is fully “DNS Native” and needs less escaping and unescaping.
- Switched to binary storage of DNS records in all places.
- Moved ACLs to a dedicated Netmask Tree.
- Implemented a version of [RCU](https://en.wikipedia.org/wiki/Read-copy-update) for configuration changes
- Instrumented our use of the memory allocator, reduced number of malloc calls substantially.
- The Lua hook infrastructure was redone using LuaWrapper; old scripts will no longer work, but new scripts are easier to write under the new interface. See the examples: 
    - Example with many features
    - DNS64
    - Policies

Due to these changes, PowerDNS Recursor 4.0.0 is almost an order of magnitude faster than the 3.7 branch.

- DNSSEC processing: if you ask for DNSSEC records, you will get them.
- DNSSEC validation: if so configured, PowerDNS perform DNSSEC validation of your answers.
- Completely revamped Lua scripting API that is “DNSName” native and therefore far less error prone, and likely faster for most commonly used scenarios. Loads and indexes a 1 million domain custom policy list in a few seconds.
- New asynchronous per-domain, per-ip address, query engine. This allows PowerDNS to consult an external service in realtime to determine client or domain status. This could for example mean looking up actual customer identity from a DHCP server based on IP address (option 82 for example).
- RPZ (from file, over AXFR or IXFR) support. This loads the largest Spamhaus zone in 5 seconds on our hardware, containing around 2 million instructions. 
    - More details [here](https://blog.powerdns.com/2016/06/28/response-policy-zone-support-in-powerdns-recursor/)
- All caches can now be wiped on suffixes, because of canonical ordering.
- Many, many more relevant performance metrics, including upstream authoritative performance measurements (‘is it me or the network that is slow’).
- EDNS Client Subnet support, including cache awareness of subnet-varying answers.

**DNSSEC**

As stated in the features section above, the PowerDNS Recursor now has DNSSEC processing and experimental DNSSEC validation support.

DNSSEC processing means the nameserver will return RRSIG records when requested to do so by the client (by means of the DO-bit) and will always retrieve the RRSIGs even if the client does not ask for. It will perform validation and set the AD-bit in the response if the client requests validation.

In fullblown DNSSEC-mode, the PowerDNS Recursor will validate the answers and set the AD-bit in validated answers if the client requests it and will SERVFAIL on bogus answers to all clients.

The DNSSEC support is marked experimental, but functional at the moment, as it has 2 limitations:

- Negative answers validated but the NSEC(3) proof is not fully checked.
- Zones that have a CNAME at the apex (which is ‘wrong’ anyway) validate as Bogus.

If you run with DNSSEC enabled and notice broken domains, do file an [issue](https://github.com/PowerDNS/pdns/issues).

**Changes compared to Release Candidate 1**

This release features the following fixes compared to rc1:

- [#3989](https://github.com/PowerDNS/pdns/pull/3989) Fix usage of std::distance() in DNSName::isPartOf() (signed/unsigned comparisons)
- [#4017](https://github.com/PowerDNS/pdns/pull/4017) Fix building without Lua. Add `isTcp` to `dq`.
- [#4023](https://github.com/PowerDNS/pdns/pull/4023) Actually log on dnssec=log-fail
- [#4028](https://github.com/PowerDNS/pdns/pull/4028) DNSSEC fixes (NSEC casing, send DO-bit over TCP, DNSSEC trace additions)
- [#4052](https://github.com/PowerDNS/pdns/pull/4052) Don’t fail configure on missing fcontext.hpp
- [#4096](https://github.com/PowerDNS/pdns/pull/4096) Don’t call `commit()` if we skipped all the records

It has the following improvements:

- [#3400](https://github.com/PowerDNS/pdns/pull/3400) Enable building on OpenIndiana
- [#4016](https://github.com/PowerDNS/pdns/pull/4016) Log protobuf messages for cache hits. Add policy tags in gettag()
- [#4040](https://github.com/PowerDNS/pdns/pull/4040) Allow DNSSEC validation when chrooted
- [#4094](https://github.com/PowerDNS/pdns/pull/4094) Sort included html files for improved reproducibility (Christian Hofstaedtler)

And these additions:

- [#3981](https://github.com/PowerDNS/pdns/pull/3981) Import Javascript sources for libs shipped with Recursor (Christian Hofstaedtler)
- [#4012](https://github.com/PowerDNS/pdns/pull/4012) add tags support to ProtobufLogger.py
- [#4032](https://github.com/PowerDNS/pdns/pull/4032) Set the existing policy tags in `dq` for `{pre,post}resolve`
- [#4077](https://github.com/PowerDNS/pdns/pull/4077) Add DNSSEC validation statistics
- [#4090](https://github.com/PowerDNS/pdns/pull/4090) Allow reloading the lua-config-file at runtime
- [#4097](https://github.com/PowerDNS/pdns/pull/4097) Allow logging DNSSEC bogus in any mode
- [#4125](https://github.com/PowerDNS/pdns/pull/4125) Add protobuf fields for the query’s time in the response

**Getting the Recursor**

The tarball is [here](https://downloads.powerdns.com/releases/pdns-recursor-4.0.0.tar.bz2)([sig](https://downloads.powerdns.com/releases/pdns-recursor-4.0.0.tar.bz2.sig)), and packages for Debian Jessie, Ubuntu Trusty, Wily and Xenial, CentOS 6 and 7, SUSE Linux Enterprise 12.1 and Raspbian Jessie are available from [our repositories](https://repo.powerdns.com/).

We would like to thank everybody who helped with ideas, code and testing the Recursor.

[View full post](https://blog.powerdns.com/2016/07/11/powerdns-recursor-4-0-0-released)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Pieter Lexis"
  },
  "dateModified" : "2025-06-20T09:05:57.651Z",
  "datePublished" : "2016-07-11T04:00:00Z",
  "headline" : "PowerDNS Recursor 4.0.0 released!",
  "image" : {
    "@type" : "ImageObject",
    "height" : 540,
    "url" : "https://20334960.fs1.hubspotusercontent-na1.net/hubfs/20334960/PowerDNS_recursor_release_blog.png",
    "width" : 934
  },
  "mainEntityOfPage" : "https://blog.powerdns.com/2016/07/11/powerdns-recursor-4-0-0-released",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "PowerDNS Blog"
  }
}
```