Second alpha release of PowerDNS DNSdist 2.0.0

Today we released the second alpha version of what will become PowerDNS DNSdist 2.0.0.

This release fixes a lot of issues, most of them related to either the new YAML configuration format or the new meson build mechanism. It also fixes CVE-2025-30193 and CVE-2025-30194, which have already been fixed in the 1.9.x stable branch.

This new release also comes with several new features:

• a new chain to apply rules on query timeouts has been implemented (@pacnal)
• more mitigations against misbehaving TCP and TLS clients have been added
• TLS session ticket keys are not automatically shared between identical frontends created using the YAML format, offering better performance
• switching TLS certificates based on the incoming Server Name Indication value sent by the client is now supported by the OpenSSL provider as well
• DSCP marking towards downstream servers has been implemented (@pacnal)
• it is now possible to call Lua methods just before stopping DNSdist

As this release introduces major changes compared to the 1.9 versions, we invite everyone to test it as soon as possible to make sure that all existing use cases are still working properly, and that there is no performance degradation.

Please see the DNSdist website for the changelog and the current documentation.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

The release tarball and its signature are available on the downloads website, and packages for several distributions are available from our repository.