<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 20px; line-height: 1.7; font-family: sans-serif, sans-serif; caret-color: rgb(45, 53, 123);"><span style="caret-color: rgb(255, 255, 255); font-family: mastodon-font-sans-serif, sans-serif; white-space: pre-wrap;">BIND-users,</span></p><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 20px; line-height: 1.7; font-family: sans-serif, sans-serif; caret-color: rgb(45, 53, 123);"><span style="caret-color: rgb(255, 255, 255); font-family: mastodon-font-sans-serif, sans-serif; white-space: pre-wrap;">Someone is sending emails from tryisc.com, pretending to be from Internet Systems Corporation, and offering information about undisclosed BIND software vulnerabilities. These emails are NOT from ISC, the authors of BIND, and they are not authorized by ISC.</span></p><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 20px; line-height: 1.7; font-family: sans-serif, sans-serif; caret-color: rgb(45, 53, 123);">If you feel you have received illegitimate communications from someone purporting to be an ISC staff member, please report it (<a href="https://www.isc.org/security-report/">https://www.isc.org/security-report/</a>). If someone other than ISC.org is offering to provide software vulnerability information about ISC software, this is suspicious and probably fraudulent. ISC does offer professional support services, which includes advance notification of security vulnerabilities in our software but we have not authorized anyone else to disclose that information prior to public disclosure.</p><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 20px; line-height: 1.7; font-family: sans-serif, sans-serif; caret-color: rgb(45, 53, 123);">Be safe out there, and check the domain name if you are not sure about the sender. <a href="http://ISC.org">ISC.org</a> is signed, so you can also validate it (since you are all operating resolvers, right?).</p><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 20px; line-height: 1.7; font-family: sans-serif, sans-serif; caret-color: rgb(45, 53, 123);">Vicky Risk (working at the actual <a href="http://ISC.org">ISC.org</a>)</p></body></html>