Changelogs for 4.1.x
====================

.. changelog::
  :version: 4.1.1
  :released: 16th of Feburary 2018

  This is the second release in the 4.1 train.

  This is a bug-fix only release, with fixes to the LDAP and MySQL backends, the ``pdnsutil`` tool, and PDNS internals.

  Changes since 4.1.1:

  .. change::
    :tags: Bug Fixes, Internals
    :pullreq: 6260
    :tickets: 6028

    Backport: forbid label compression in alias wire format

  .. change::
    :tags: Bug Fixes, Internals
    :pullreq: 6077

    Include unistd.h for chroot(2) et al. (Florian Obser)

  .. change::
    :tags: Bug Fixes, LDAP
    :pullreq: 6048

    Ldap: fix getdomaininfo() to set ``this`` as di.backend (Grégory Oestreicher)

  .. change::
    :tags: Bug Fixes, Improvements
    :pullreq: 6172

    Ixfr: correct behavior of dealing with dns name with multiple records (Leon Xu)

  .. change::
    :tags: Bug Fixes, MySQL
    :pullreq: 6134
    :tickets: 6115

    Auth: always bind the results array after executing a mysql statement

  .. change::
    :tags: Bug Fixes, Tools
    :pullreq: 6129
    :tickets: 6125

    Auth: init openssl and libsodium before chrooting in pdnsutil

  .. change::
    :tags: Bug Fixes, LDAP
    :pullreq: 6122
    :tickets: 6097, 6060

    Ldapbackend: fix listing zones incl. axfr (Chris Hofstaedtler)

  .. change::
    :tags: Bug Fixes, Internals
    :pullreq: 6103

    Auth: fix out of bounds exception in caa processing, fixes #6089

  .. change::
    :tags: Bug Fixes, Internals
    :pullreq: 6041
    :tickets: 6040

    Add the missing <sys/time.h> include to mplexer.hh for struct timeval

.. changelog::
  :version: 4.1.0
  :released: 30th of November 2017

  This is the first release in the 4.1 train.

  The full release notes can be read `on the blog <https://blog.powerdns.com/2017/11/30/powerdns-authoritative-server-4-1/>`_.

  The 4.1 release is a major upgrade for the Authoritative Server featuring many improvements and speedups:

  - Improved performance: 400% speedup in some scenarios,
  - Crypto API: DNSSEC fully configurable via RESTful API,
  - Improved documentation,
  - Database related improvements,
  - Enhanced tooling,
  - Support for TCP Fast Open,
  - Support for non-local bind,
  - Support for Botan 2.x (and removal of support for Botan 1.10),
  - Our packages now ship with PKCS #11 support.

  Recursor passthrough removal: This will impact many installations, and we realize this may be painful, but it is necessary. Previously, the PowerDNS Authoritative Server contained a facility for sending recursion desired queries to a resolving backend, possibly after first consulting its local cache. This feature (‘recursor=’) was frequently confusing and also delivered inconsistent results, for example when a query ended up referring to a CNAME that was outside of the Authoritative Server’s knowledge. To read more about this please see the blog post mentioned above or read the :doc:`migration guide <../../guides/recursion>`.

  Changes since 4.1.0-rc3:

  .. change::
    :tags: DNSSEC, Bug Fixes
    :pullreq: 5968

    Fix hang when PATCHing zone during rectify.

  .. change::
    :tags: Improvements
    :pullreq: 5976
    :tickets: 5974

    Report remote IP when SOA query comes back with empty question section.

  .. change::
    :tags: API, Improvements
    :pullreq: 5964
    :tickets: 5862

    Make the /cryptokeys endpoint consistently use CryptoKey objects.

  .. change::
    :tags: Removed Features
    :pullreq: 6004

    Remove deprecated SOA-EDIT values: INCEPTION and INCEPTION-WEEK.

  .. change::
    :tags: API, Bug Fixes
    :pullreq: 6007

    Deny cache flush, zone retrieve and notify if the API is read-only.

.. changelog::
  :version: 4.1.0-rc3
  :released: 17th of November 2017

  This is the third release candidate of the PowerDNS Authoritative Server in the 4.1 release train.

  This release features various bug fixes and some improvements to
  ``pdnsutil``.

  .. change::
    :tags: Bug Fixes
    :pullreq: 5905

    Use 302 redirects in the webserver for ringbuffer reset or
    resize. With the current 301 redirect it is only possible to reset
    or resize once. Every next duplicate action is replaced by the
    destination cached in the browser.

  .. change::
    :tags: Tools, Bug Fixes
    :pullreq: 5884
    :tickets: 5849

    Fix messages created by ``pdnsutil generate-tsig-key``.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5616

    Better support for deleting entries in NetmaskTree and NetmaskGroup.

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5917

    Use ``_exit()`` when we really really want to exit, for example
    after a fatal error. This stops us dying while we die. A call to
    ``exit()`` will trigger destructors, which may paradoxically stop
    the process from exiting, taking down only one thread, but harming
    the rest of the process.

  .. change::
    :tags: Tools, New Features
    :pullreq: 5883
    :tickets: 5853

    Add ``add-meta`` command to ``pdnsutil`` that can be used to append
    to existing metadata without clobbering it.

  .. change::
    :tags: Tools, Bug Fixes
    :pullreq: 5928
    :tickets: 5903

    Add back missing output details to rectifyZone.

  .. change::
    :tags: Tools, Improvements
    :pullreq: 5879
    :tickets: 3059, 5948, 5949

    Warn if records in a zone are occluded.

  .. change::
    :tags: API, Improvements
    :pullreq: 5935

    Throw exception for metadata endpoint with wrong zone. Before, We
    would happily accept this POST.

  .. change::
    :tags: API, New Features
    :pullreq: 5936
    :tickets: 5909, 5910

    Make it possible to disable DNSSEC via the API, this is equivalent
    to doing ``pdnsutil disable-dnssec``.

.. changelog::
  :version: 4.1.0-rc2
  :released: 3rd of November 2017

  This is the second release candidate of the PowerDNS Authoritative Server in the 4.1 release train.

  This release has several performance improvements, stability and
  correctness fixes.

  .. change::
    :tags: Packages, New Features
    :pullreq: 5665

    Add :doc:`PKCS#11 <../../dnssec/pkcs11>` support to packages on Operating Systems that support it.

  .. change::
    :tags: Bug Fixes, Internals, Tools
    :pullreq: 5684
    :tickets: 5673

    Improve trailing dot handling internally which lead to a segfault in
    pdnsutil before.

  .. change::
    :tags: Bug Fixes, Internals
    :pullreq: 5678

    Treat requestor's payload size lower than 512 as equal to 512.
    Before, we did not follow :rfc:`RFC 6891 section 6.2.3 <6891#section-6.2.3>` correctly.

  .. change::
    :tags: Improvements, LDAP
    :pullreq: 5584

    Add support for new record types to the LDAP backend.

  .. change::
    :tags: API, Bug Fixes
    :pullreq: 5696

    For zone PATCH requests, add new ``X-PDNS-Old-Serial`` and
    ``X-PDNS-New-Serial`` response headers with the zone serials before
    and after the changes.

  .. change::
    :tags: Bug Fixes
    :pullreq: 5710
    :tickets: 5692

    Remove "" around secpoll result which fixes ``pdns_control show
    security-status`` not working.

  .. change::
    :tags: Bug Fixes, BIND
    :pullreq: 5702

    Make bindbackend startTransaction to return false when it has
    failed. (Aki Tuomi)

  .. change::
    :tags: Bug Fixes, DNSSEC, API
    :pullreq: 5704

    Make default options singular and use defaults in Cryptokey API-endpoint

  .. change::
    :tags: Bug Fixes, Tools
    :pullreq: 5729
    :tickets: 5719

    Remove printing of DS records from ``pdnsutil export-zone-dnskey …``. This was not only inconsistent behaviour but also done incorrectly.

  .. change::
    :tags: Bug Fixes, DNSSEC
    :pullreq: 5722
    :tickets: 5721

    Make the auth also publish CDS/CDNSKEY records for inactive keys, as
    this is needed to roll without double sigs.

  .. change::
    :tags: Bug Fixes, DNSSEC
    :pullreq: 5734

    Fix a crash when getting a public GOST key if the private one is not set.

  .. change::
    :tags: Bug Fixes, Internals
    :pullreq: 5766
    :tickets: 5767

    Correctly purge entries from the caches after a transfer.  Since the
    QC/PC split up, we only removed entries for the AXFR'd domain from
    the packet cache, not the query cache.
    We also did not remove entries in case of IXFR.

  .. change::
    :tags: Bug Fixes, Internals
    :pullreq: 5791

    When throwing because of bogus content in the tinydns database,
    report the offending name+type so the admin can find the offending
    record.

  .. change::
    :tags: DNSSEC, Bug Fixes
    :pullreq: 5815

    Ignore SOA-EDIT for PRESIGNED zones.

  .. change::
    :tags: Bug Fixes, MySQL
    :pullreq: 5820
    :tickets: 5675

    Log the needed size when a MySQL result was truncated.

  .. change::
    :tags: API, DNSSEC, New Features
    :pullreq: 5779
    :tickets: 3417, 5712

    Rectify zones via the API. (Nils Wisiol)

    * Move the pdnsutil rectification code to the DNSSECKeeper
    * Generate DNSSEC keys for a zone when "dnssec" is true in an API POST/PATCH for zones
    * Rectify DNSSEC zones after POST/PATCH when API-RECTIFY metadata is 1
    * Allow setting this metadata via the "api-rectify" param in a Zone object
    * Show "nsec3param" and "nsec3narrow" in Zone API responses
    * Add an "rrsets" request parameter for a zone to skip sending RRSets in the response
    * Add rectify endpoint in the API

  .. change::
    :tags: Improvements
    :pullreq: 5842

    Add :ref:`setting-log-timestamp` option. This option can be used to disable
    printing timestamps to stdout, this is useful when using
    systemd-journald or another supervisor that timestamps stdout by
    itself. As the logs will not have 2 timestamps.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5498
    :tickets: 2250, 5734, 5797, 5889

    Add support for Botan 2.x and drop support for Botan 1.10 (the
    latter thanks to Kees Monshouwer).

  .. change::
    :tags: DNSSEC, Improvements
    :pullreq: 5838
    :tickets: 5767

    Stop doing individual RRSIG queries during outbound AXFR. (Kees Monshouwer)

  .. change::
    :tags: BIND, Improvements
    :pullreq: 5810
    :tickets: 5115, 5807

    Fix issues when b2b-migrating from the BIND backend to a database:

    * No masters were set in the target db (#5807)
    * Only the last master in the list of masters would be added to the target database
    * The BIND backend was not fully aware of native zones

.. changelog::
  :version: 4.1.0-rc1
  :released: 31st of August 2017

  This is the first release candidate of the PowerDNS Authoritative Server in the 4.1 release train.

  .. change::
    :tags: BIND, Improvements
    :pullreq: 5094

    Make the zone parser adhere to :rfc:`2308` with regards to implicit TTLs.

    Existing zone files may now be interpreted differently.
    Specifically, where we previously used the SOA minimum field for the default
    TTL if none was set explictly, or no $TTL was set, we now use the TTL from
    the previous line.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4373

    Revamp and clean label compression code. Speeds up large packet creation by ~40%.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4332
    :tickets: 4299

    Apply :ref:`setting-non-local-bind` to :ref:`setting-query-local-address` and :ref:`setting-query-local-address6` when possible.

  .. change::
    :tags: DNSUpdate, New Features
    :pullreq: 4058

    Allow the use of a :ref:`Lua script <dnsupdate-lua-dnsupdate-policy-script>` to validate DNS Update requests (Aki Tuomi).

  .. change::
    :tags: API, Improvements
    :pullreq: 4408
    :tickets: 4290

    Enable the webserver when :ref:`setting-api` is 'yes' (Christian Hofstaedtler).

  .. change::
    :tags: API, New Features
    :pullreq: 4093, 5038

    Add API endpoints for Domain metadata (Christian Kröger).

  .. change::
    :tags: API, New Features
    :pullreq: 4106
    :tickets: 706

    Implement :json:object:`CryptoKey` in the API (Wolfgang Studier, @MrM0nkey, Tudor Soroceanu, Benjamin Zengin).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 4424

    Fix compilation on systems with Boost < 1.54

  .. change::
    :tags: Internals, Improvements, Bug Fixes
    :pullreq: 4467, 4492

    A number of fixes and improvements that are difficult to untangle:

    * Remove the ASCII :cpp:class:`DNSResourceRecord` from the hot path of packet assembly.
    * Hash the storage of records in the BindBackend.
    * Hash the packetcache.
    * Fix some bugs in the LDAP backend and in the MyDNS backend.
    * Make the randombackend go 'native' and directly supply records that can be sent to packets
    * The performance benefit of this PR is measured in "factors" for being a root-server.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4504
    :tickets: 4503

    Improve cleaning, remove an unnecessary lock and improve performance of the packetcache (Kees Monshouwer).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4485

    Improve SOA records caching (Kees Monshouwer).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 4560, 4548
    :tickets: 4546

    Fix possible variable shadowing (Kees Monshouwer, Christian Hofstaedtler).

  .. change::
    :tags: API, Bug Fixes
    :pullreq: 4526
    :tickets: 4524

    Make the URL in zone info absolute (Christian Hofstaedtler).

  .. change::
    :tags: BIND, Bug Fixes
    :pullreq: 4650
    :tickets: 4328

    Do not corrupt data supplied by other backends in getAllDomains (Christian Hofstaedtler).

  .. change::
    :tags: Tools, Improvements
    :pullreq: 4007
    :tickets: 4005

    Implement subcommand printing all KSK DS records in pdnsutil (Jonas Wielicki).

  .. change::
    :tags: Tools, Bug Fixes
    :pullreq: 4740

    Avoid undefined behaviour in Clang vs. GCC when printing DS records in pdnsutil.

  .. change::
    :tags: API, Improvements
    :pullreq: 4751
    :tickets: 4132

    Prevent sending nameservers list and zone-level NS in rrsets in the API (Christian Hofstaedtler).

  .. change::
    :tags: Tools, Improvements
    :pullreq: 4584

     Allow setting the account of a zone via pdnsutil (Tuxis Internet Engineering).

  .. change::
    :tags: Internals, New Features
    :pullreq: 4624

    Add TCP management options described in :rfc:`section 10 of RFC 7766 <7766#section-10>`.

  .. change::
    :tags: Tools, Improvements
    :pullreq: 4719

    Print "$ORIGIN ." on ``pdnsutil list-zone``, so the output can be used in ``pdnsutil load-zone`` (Tuxis Internet Engineering).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 4855

    Fix ``getaddrinfo()`` returning address in triplicate.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4829

    Make sure AXFR only deletes records from a SLAVE domain in a multi backend setup (Kees Monshouwer).

  .. change::
    :tags: Tools, Improvements
    :pullreq: 4478

    pdnsutil: clarify error message when set-presigned fails with DNSSEC disabled (Peter Thomassen).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4908

    Tidy up UeberBackend (Christian Hofstaedtler).

  .. change::
    :tags: Tools, Improvements
    :pullreq: 3913

    pdnsutil: Validate names with address records to be valid hostnames (Håkan Lindqvist).

  .. change::
    :tags: Postgresql, Improvements
    :pullreq: 4711
    :ticket: 2138

    Enable setting custom pgsql connection parameters, like TLS parameters (Tarjei Husøy).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4944

    Improve API performance by instantiating only one DNSSECKeeper per request.

  .. change::
    :tags: Remote, Bug Fixes
    :pullreq: 4997

    Fix two problems with remotebackend (Aki Tuomi):

    * list method used domain-id json parameter, when it was supposed to use domain_id
    * NULL ordername was not passed as empty string in POST parameters builder, instead it threw an exception

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4953
    :tickets: 349, 602

    Incremental backoff for failed slave checks.

    When a SOA record for a slave domain can't be retrieved, use an increasing interval between checking the domain again.
    This prevents hammering down on already busy servers.

  .. change::
    :tags: LDAP, Bug Fixes
    :pullreq: 4922
    :tickets: 3165

    Fix ldap-strict autoptr feature.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4549

    Remove d_place from DNSResourceRecord (Christian Hofstaedtler).

  .. change::
    :tags: MyDNS, New Features
    :pullreq: 5043

    Add function to the MyDNS backend to allow backend-to-backend migrations (Aki Tuomi).

  .. change::
    :tags: Internals, Removed Features
    :pullreq: 4752
    :tickets: 4616, 4238, 4315, 3337, 2606, 2380

    Remove recursion. See :doc:`../guides/recursion` for migration strategies (Kees Monshouwer).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5117

    Turn exception in a qthread into an error instead of a crash.

  .. change::
    :tags: Webserver, Improvements
    :pullreq: 5116
    :tickets: 1844

    Report query statistics as full numbers, not scientific notation in the webserver.

  .. change::
    :tags: Tools, Bug Fixes
    :pullreq: 5125
    :tickets: 5124

    In ``pdnsutil create-slave-zone``, actually add all slaves.

  .. change::
    :tags: BIND, New Features
    :pullreq: 5115
    :tickets: 1284

    Support "native" zones in the BIND backend.

  .. change::
    :tags: Postgresql, Bug Fixes
    :pullreq: 4929
    :tickets: 4928

    Make statement actually unique (Christian Hofstaedtler).

  .. change::
    :tags: Tools, Improvements
    :pullreq: 5118

    Correct pdnsutil help output for add-zone-key.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5169

    Add an option to allow AXFR of zones with a different (higher/lower) serial (Kees Monshouwer).

  .. change::
    :tags: Tools, Improvements
    :pullreq: 5062
    :tickets: 512

    Check for valid hostnames in SRV, NS and MX records.

  .. change::
    :tags: Postgresql, Improvements
    :pullreq: 5121, 5221
    :tickets: 2358, 5193

    Use pkg-config to detect PostgreSQL libraries.

  .. change::
    :tags: Internals, New Features
    :pullreq: 5137
    :tickets: 5129

    Add TCP Fast Open support.

  .. change::
    :tags: ALIAS, Improvements
    :pullreq: 5182
    :tickets: 5119

    Disable ALIAS expansion by default.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5112
    :tickets: 4655

    Use the :ref:`setting-resolver` setting for the stub resolver, use resolv.conf as fallback.

  .. change::
    :tags: Internals, New Features
    :pullreq: 5132, 5258
    :tickets: 4204

    Hash the entire query in the packet cache, split caches. This makes the authoritative server pass the EDNS compliance test.

    Add cache hit/miss statistics (Kees Monshouwer).

  .. change::
    :tags: LDAP, New Features
    :pullreq: 4477
    :tickets: 3358

    Many improvements and additions to the LDAP backend (Grégory Oestreicher).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5212, 5249

    Remove duplicate dns2_tolower() function and move ascii-related function to one file (Thiago Farina).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5209

    Make copying locks impossible.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5250

    Re-implement the AXFR Filter with LuaContext (Aki Tuomi).

  .. change::
    :tags: GeoIP, New Features
    :pullreq: 5266, 5269, 5270
    :tickets: 4122, 5255

    Support 2-character country codes and the MaxMind cities database in the GeoIP backend (Aki Tuomi).

  .. change::
    :tags: GeoIP, Bug Fixes
    :pullreq: 5267
    :tickets: 4704

    Apply weights consistently during GeoIP lookups (Aki Tuomi).

  .. change::
    :tags: Tools, Bug Fixes
    :pullreq: 5303

    Fix off-by-one in dnsreplay --packet-limit

  .. change::
    :tags: Internals, New Features
    :pullreq: 5271, 5190
    :tickets: 3781

    Add an adjustable statistics interval (@phonedph1).

  .. change::
    :tags: DNSUpdate, New Features
    :pullreq: 5264, 5263, 5321
    :tickets: 4821

    Send a notification to all slave servers after every dnsupdate (Kees Monshouwer, Florian Obser).

  .. change::
    :tags: Remote, Bug Fixes
    :pullreq: 5308
    :tickets: 5306

    Don't copy data around in the Remote Backend when sending and receiving in the Unix Connector.

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5320

    Properly truncate trailing bits of EDNS Client Subnet masks.

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5161, 5083

    Fix regressions in the AXFR rectification code (Kees Monshouwer, Arthur Gautier).

  .. change::
    :tags: LDAP, Bug Fixes
    :pullreq: 5340
    :tickets: 5091

    Fix an erroneous '.' in ".ip6.arpa" (@shantikulkarni).

  .. change::
    :tags: Internals, New Features
    :pullreq: 5316

    Add option to set a global :ref:`setting-lua-axfr-script` (Kees Monshouwer).

  .. change::
    :tags: Tools, New Features
    :pullreq: 5339

    calidns: add --increment and --want-recursion flags.

  .. change::
    :tags: Internals, New Features
    :pullreq: 4965, 4964, 1701

    Allow forwarding of NOTIFY messages using :ref:`setting-forward-notify` (@DrRemorse).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5408

    Zero the port when creating a netmask from a ComboAddress.

  .. change::
    :tags: API, Improvements
    :pullreq: 5389
    :tickets: 5305

    Forbid mixing CNAMEs and other RRSets in the API (Christan Hofstaedtler).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5387

    Allow control socket to listen on IPv6 (@Gibheer).

  .. change::
    :tags: Types, New Features
    :pullreq: 5379

    Support the SMIMEA RRType.

  .. change::
    :tags: Postgresql, MySQL, Bug Fixes
    :pullreq: 5245
    :tickets: 5005, 3824

    Reconnect to the server if the My/Pg connection has been closed.

  .. change::
    :tags: Internals, Removed Features
    :pullreq: 5468

    Remove the experimental Lua Policy Engine (Aki Tuomi).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5512

    Drop (broken) support for packet-specific SOA replies from backends (Christian Hofstaedtler).

  .. change::
    :tags: Oracle, Bug Fixes
    :pullreq: 5506

    Add missing query for last key insert id in the goracle backend (Aki Tuomi).

  .. change::
    :tags: Postgresql, Improvements
    :pullreq: 5426

    Use BIGSERIAL for records.id in the gpgsql backend (Arsen Stasic).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5525

    Fix validation at the exact RRSIG inception or expiration time

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5523

    Fix typo in two log messages (Ruben Kerkhof).

  .. change::
    :tags: API, Bug Fixes
    :pullreq: 5516

    Avoid creating fake DNSPacket objects just for calling getAuth() from API code (Christian Hofstaedtler).

  .. change::
    :tags: LDAP, Improvements
    :pullreq: 5509

    Ship ldapbackend schema files in tarball (Christian Hofstaedtler).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5542

    Update YaHTTP (to fix a warning reported by Coverity).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5541

    Clarify how we check the return value of std::string::find() (reported by Coverity).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5543

    Wrap the webserver's and Resolver::tryGetSOASerial objects into smart pointers.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 4692

    SSql: Use unique_ptr for statements (Aki Tuomi).

  .. change::
    :tags: MySQL, Improvements
    :pullreq: 5605

    mydnsbackend: Initialize d_query_stmt (Aki Tuomi).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5599

    Fix libatomic detection on ppc64 (Sander Hoentjen).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5588

    Switch the default webserver's ACL to "127.0.0.1, ::1".

  .. change::
    :tags: API, Bug Fixes
    :pullreq: 5589

    Check if the API is read-only on crypto keys methods.

  .. change::
    :tags: API, Bug Fixes
    :pullreq: 5556

    Fix getSOA() in luabackend (@zilopbg).

  .. change::
    :tags: MySQL & Postgresql, Improvements
    :pullreq: 5518

    Schema changes for MySQL / MariaDB and PostgreSQL to for storage requirements of various versions (Kees Monshouwer).

  .. change::
    :tags: GeoIP, Improvements
    :pullreq: 5548

    Add ability to have service record for apex record and any other static record (Aki Tuomi).

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5519

    Lookups one level (or more) below apex did confuse getAuth() for qytpe DS (Kees Monshouwer).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5611

    NOTIMP is only appropriate for an unsupported opcode (Kees Monshouwer).

  .. change::
    :tags: Tools, Bug Fixes
    :pullreq: 5610

    Fix that pdnsutil edit-zone complains about auth=1 problems on all data.

  .. change::
    :tags: Internals, Bug Fixes
    :pullreq: 5633

    First and last SOA in an AXFR must be identical (Kees Monshouwer).

  .. change::
    :tags: API, Improvements
    :pullreq: 4195

    Prevent duplicate records in single RRset (Christian Hofstaedtler).

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5641

    Catch DNSName exception in the Zoneparser.

  .. change::
    :tags: Internals, Improvements
    :pullreq: 5583

    Listen on 127.0.0.1 during regression tests (@tcely).
