net/knot 3.6.0 NetBSD

Improvements: knotd: added MONOTONIC_USEC to sd_notify() for systemd's notify-reload service type Bugfixes: knotd: ZONEMD verification omits regular nodes that collide with NSEC3 ones (Thanks to Joshua Rogers) knotd: catalog updates can purge non-catalog zones with conflicting names (Thanks to Joshua Rogers) knotd: blocking transfer freeze operation returns prematurely libknot: connection table exhaustion during QUIC sweep libknot: uncontrolled compression-pointer traversal in DNS message parsing libknot: unbounded write-backpressure busy-spin in the DoT send path tests: build fails if --disable-daemon is specified

Features: mod-ecs: new module for setting the ECS scope prefix length (Thanks to Branko Mijuskovic) Improvements: knotd: additional SOA consistency checks when processing incoming XFR knotd: DDNS over 0-RTT QUIC/TLS is forbidden knotd: new warning if difference(-no-serial) is enabled on a secondary zone knotc: control blocking timeout is per full command, not per each zone kdig: backward compatibility for +noidn as an alias for +noidnout libknot: extra checks for malformed IPv4 and TCP packets in XDP filter (Thanks to Joshua Rogers) src,tests: various compatibility fixes for SmartOS #980 doc: various improvements Bugfixes: knotd: missing synchronization between catalog reload and worker suspension …

Knot DNS 3.6.0 (2026-09-08) Features: knotd: DELEG-aware answering (see 'zone.deleg-aware') knotd: DELEG-aware zone signing (see 'policy.deleg-adt') knotd: configurable storage for the last signed serial (see 'zone.dnssec-metadata-db') knotd: optional jitter for DNSSEC events (see 'policy.dnssec-jitter') knotd: optional jitter for SOA refresh events (see 'zone.refresh-jitter') knotd: implemented a "trash bin" for deleted DNSSEC keys (see 'DNSSEC key delete and recovery') knotc: zone retransfer with automatic IXFR fix-up (see '+fixfr') kdig: per zone DNSSEC answer validation (see '+validate') utils: automatic LMDB migration from version 0.9 using embedded LMDB 0.9.35 libknot: support for DELEG and DELEGPARAM record types Improvements: …

Knot DNS 3.5.8 (2026-09-04) Improvements: knotc: better compatibility with SmartOS #979 knotd: added a check for possible errors while reading a backup label file knotd: more robust parsing of data stored in LMDB (Thanks to Jim Alves-Foss) Bugfixes: knotd: unauthenticated TSIG chosen-prefix signing that enables DDNS forgery (Thanks to Gia Bui) knotd: server crash due to a missing check for malformed TCP packet in XDP mode (Thanks to Kushal Das) kzonecheck: defective zone origin detection if the file name is too short (Thanks to Kushal Das)