Hot on the heels of RC1, PowerDNS Recursor 4.1.0 RC2 is here!

We’d like to thank everyone that has helped us test Recursor RC1.

The second Release Candidate contains several correctness fixes for DNSSEC, mostly in the area of verifying negative responses.

Also thanks Christian Hofstaedtler for help on the documentation!

The full changelog looks like this:

Bug Fixes

• #5808: Check that the NSEC covers an empty non-terminal when looking for NODATA.
• #5835: Disable validation for infrastructure queries (e.g. when recursing for a name). Also validate entries from the Negative cache if they were not validated before.
• #5868: Fix DNSSEC validation for denial of wildcards in negative answers and denial of existence proofs in wildcard-expanded positive responses.
• #5873: Fix DNSSEC validation when using -flto.
• #5740: Lowercase all outgoing qnames when lowercase-outgoing is set.
• #5762: Create socket-dir from the init-script.
• #5803: Fix crashes with uncaught exceptions in MThreads.

Improvements

• #5834: Don’t directly store NSEC3 records in the positive cache.
• #5805: Improve logging for the built-in webserver and the Carbon sender.
• #5824: New b.root ipv4 address (Kees Monshouwer).
• #5774: Add experimental metrics that track the time spent inside PowerDNS per query. These metrics ignore time spent waiting for the network.
• #5842: Add log-timestamp setting. This option can be used to disable printing timestamps to stdout, this is useful when using systemd-journald or another supervisor that timestamps output by itself.

The tarball is available on downloads.powerdns.com (signature) and packages for CentOS 6 and 7, Debian Jessie and Stretch, Ubuntu Trusty, Yakkety, Xenial and Zesty are available from repo.powerdns.com.  (The Raspberry Pi packages will follow tomorrow morning.)

We invite you to test this release candidate and send us all feedback and issues you might have via the mailinglist, or in case of a bug, via GitHub.

Enjoy!