<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">ISC has joined with the other major open source DNS publishers in an effort to upgrade the DNS by removing workarounds for older, ‘broken’ DNS implementations. We have all committed to having versions of our software available that remove these workarounds by February 1, 2019. This industry initiative is described on the web site at <a href="https://dnsflagday.net" class="">https://dnsflagday.net</a> and on the ISC blog at <a href="https://www.isc.org/blogs/dns-flag-day/" class="">https://www.isc.org/blogs/dns-flag-day/</a> .<div class=""><br class=""></div><div class="">We expect the actual impact of DNS Flag Day will be seen only gradually, and will be limited to older (mostly Microsoft) DNS servers and installations with overly aggressive DNS firewall rules. </div><div class=""><br class=""></div><div class="">You might be wondering what you should do. We have published a new KB article on this topic: <a class="theme markdown__link" href="https://kb.isc.org/docs/dns-flag-day-will-it-affect-you" rel="noreferrer" target="_blank" style="box-sizing: border-box; background-color: rgb(255, 255, 255); color: rgb(35, 137, 215); text-decoration: none; cursor: pointer; word-break: break-word; font-family: "Open Sans", sans-serif; font-size: 13.5px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2;">https://kb.isc.org/docs/dns-flag-day-will-it-affect-you</a></div><div class=""><div class=""><br class=""></div><div class=""><b class="">Authoritative System Operators</b></div><div class="">BIND authoritative servers are and have been fully compliant for many years, and all currently supported versions of BIND are compliant as authoritative systems. However, you might wish to test a few of your zones to ensure your firewalls are not blocking EDNS traffic. You can test this at either the <a href="https://dnsflagday.net" class="">https://dnsflagday.net</a> site, or at <a href="http://ednscomp.isc.org" class="">ednscomp.isc.org</a>. These hosted tests are very busy right now. You can also run many of the same tests using dig (see <a href="https://kb.isc.org/docs/edns-compatibility-dig-queries" class="">https://kb.isc.org/docs/edns-compatibility-dig-queries</a>) or if you want to test a number of domains, you can download and install the edns compliance test tool yourself <a href="https://gitlab.isc.org/isc-projects/DNS-Compliance-Testing" class="">https://gitlab.isc.org/isc-projects/DNS-Compliance-Testing</a>.</div><div class=""><br class=""></div><div class=""><b class="">Resolver Operators</b></div><div class="">BIND resolvers have been doing workarounds for non-BIND non-compliant authorities for years. These consist of retrying without EDNS and other similar work arounds. Resolver operators won’t see a change until they update to a version of BIND that removes the workarounds. BIND 9.14.0 will remove those workarounds: the feature change has been available to development users in BIND 9.13.4 for a while. </div><div class=""><br class=""></div><div class="">If you have questions, please feel free to post on <a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a> so we can answer them where everyone will see the answers.</div><div class=""><br class=""></div><div class="">Thank you!</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Victoria Risk</div><div class="">Product Manager</div><div class="">Internet Systems Consortium</div><div class=""><a href="mailto:vicky@isc.org" class="">vicky@isc.org</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></div></div></body></html>