NSD 4.15.2rc1 pre-release

NSD
1

Dear all.

NSD 4.15.2rc1 pre-release is available:

https://nlnetlabs.nl/downloads/nsd/nsd-4.15.2rc1.tar.gz

sha256 3c40427abffc50c99413d6d7a736f769031b9b16dbb7d1e6b844e5beb89fc87a
pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.15.2rc1.tar.gz.asc

This is the maintainer’s pre-release of NSD 4.15.2rc1.
This release has many bugfixes, updated support for RR types and SVCB parameters and a few new features.

The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026:

User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419  146A A144 323D EAAC DF45

The key is available from NLnet Labs - Software Signing Keys

Please review this pre-release carefully. If all is well, the actual release will follow Wednesday, the 2nd of September 2026.

4.15.2 (in development)

FEATURES:

  • Merge #494: RFC 7830 EDNS0 padding option support with DoT with padding suggestions from RFC 8467 for responses
    Thanks kdrenard for the suggestion
  • Merge #498: Support for the HHIT and BRID RR types
  • Merge #499: Support for the “docpath” and “pvd” SVCB Service Parameter Keys
  • Merge #500: Support for the “oots” SVCB Service Parameter Key
  • An allow-proxy configuration file option to specify allow access control list for the PROXYv2 protocol port.
    Thanks to Qifan Zhang, Palo Alto Networks, for the suggestion.
  • Merge #502: An udp-padding-port configuration file ption to enable responding to the padding option on UDP, but on specific ports only. This is convenient for setups where NSD is behind a frontend handling the DNS over TLS.
  • --enable-multiple-catalog-zones option to configure to enable experimental support for multiple catalog consumer zones.

BUG FIXES:

  • Merge #495 from ruuda: Include inttypes.h from metrics.c.
  • Merge #496 from maertsen: Fix allow-query syntax in catalog documentation.
  • Fix that IXFR queries with overly large SOA records do not cause an assertion failure in the server child process. The malformed SOA record is rejected with FORMERR.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix that notify ahead of the zone serial does not cause perpetual retransfer. After one round, and after another retry, it gives up, and forgets the notified serial number. This allows the primary a moment to retrieve the new zone version.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix that AXFR out for a zone with an oversize record does not loop.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix that IXFR out for a zone with an oversize record does not loop.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix serve childs crashing when queried for a very long CNAME chain on ASAN builds. The maximum CNAME chain in responses is set to 18. The value can be configured with the --with-max-cname-chain=number option to configure.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix to have failed zone transfers retry after a time, instead of in a loop, for transfers with failed contents.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix that an increase verbosity level is needed to warn about unfound RRs to be deleted (from IXFR). Verbosity 2 for RRsets and RDATA that could not be found. Verbosity 3 to log which RR in the existing set does not match.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix to ignore NSEC3s with wrong non-base32hex chars in owner label.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix Y2038 bug, where the server process would fail with undefined behaviour, if it was built with address sanitizer undefined checks enabled, for the timestamp in EDNS cookies.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix to not let nsd-control zonestatus crash the xfrd processes when configured with multiple catalog consumers.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix to prevent a configured primary from hampering loading its own zone by providing a transfer with the OPT RR in the answer section and the UDP Payload size (i.e. class) of the OPT RR set to something else than 1 (IN).
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix to ignore NSEC3 records with malformed owner name. In depth fix to clear key for NSEC3 tree collisions. And a fix to limit the re-enactment of failed reloads, that ordinarily marks transfers as corrupt, so that for crashes it waits with that zone for retry. This allows other zones to update in the meantime.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix nsd-control reconfig so that change of a secondary zone while it is on the udp or tcp waiting list does not crash after that.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix to reset the length of the incoming packet buffer after a failed PROXYv2 header on UDP. It can cause an assertion failure on the next packet.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix XoT transfer authentication to not fall back to the common name if a DNS name is present in the certificate. This fixes the RFC6125 conformance.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.
  • Fix dnstap over TLS certificate check for reconnection. Also clean up file descriptor and SSL state on connection failures.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.

simdzone 0.2.6rc1

FEATURES:

  • Support for the HHIT and BRID RR types.
  • Support for the “docpath”, “pvd” and “oots” SVCB Service Parameters

BUG FIXES:

  • TXT records with more than 6465 rdata elements, crashes simdzone parsing.
    Thanks to Qifan Zhang, Palo Alto Networks, for the report.