daniel/ansible-bind9-role
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Releases Wiki Activity
Files
cb707f2110529c6be2dc0ab345a60ae3aca5c2ed
ansible-bind9-role/docs/BIND_VERSION_DIFFERENCES.md
Daniel Akulenok db379be31f docs: Add BIND9 version comparison and migration guidance 
- Generate BIND_VERSION_DIFFERENCES.md with detailed grammar comparison
- Document 44 breaking changes between BIND9 9.18.44 and 9.20.18
- Document 35 new options and 22 modified options in BIND9 9.20
- Document 3 newly deprecated options
- Add version compatibility section to CONFIGURATION_GRAMMAR.md
- Update CHANGELOG.md with version differences details
- Include migration guide for upgrading from 9.18 to 9.20

Closes #11
2026-02-07 23:43:51 +01:00

13 KiB
Raw Blame History

BIND9 Version Differences: v9.18.44 vs v9.20.18

This document compares BIND9 configuration grammar between v9.18.44 and v9.20.18.

Generated automatically by scripts/compare_bind_versions.py.

Summary

  • New Options: 35
  • Removed Options: 44 ⚠️
  • Modified Options: 22
  • Newly Deprecated: 3

⚠️ Breaking Changes

The following options were removed in v9.20.18 and will cause configuration errors:

options

  • alt-transfer-source
  • alt-transfer-source-v6
  • auto-dnssec
  • coresize
  • datasize
  • dscp
  • files
  • glue-cache
  • heartbeat-interval
  • keep-response-order
  • lock-file
  • maxz-zone-ttl
  • parent-registration-delay
  • parental-agents
  • primaries
  • random-device
  • recurse-ing-file
  • reserved-sockets
  • resolver-nonbackoff-tries
  • resolver-retry-interval
  • reuse
  • root-delegation-only
  • stacksize
  • suppress-initial-notify
  • tkey-dhkey
  • tkey-gssapi-credential
  • use-alt-transfer-source

forward.zoneopt

  • delegation-only

hint.zoneopt

  • delegation-only

mirror.zoneopt

  • alt-transfer-source
  • alt-transfer-source-v6
  • use-alt-transfer-source

primary.zoneopt

  • alt-transfer-source
  • alt-transfer-source-v6
  • auto-dnssec
  • update-check-ksk

secondary.zoneopt

  • alt-transfer-source
  • alt-transfer-source-v6
  • auto-dnssec
  • use-alt-transfer-source

stub.zoneopt

  • delegation-only
  • use-alt-transfer-source

delegation-only.zoneopt

  • type
  • zone

✨ New Features

The following options were added in v9.20.18:

options

  • allow-proxy
  • allow-proxy-on
  • cdnskey
  • cds-digest-types
  • check-svcb
  • cipher-suites
  • dnsrps-library
  • inline-signing
  • key-store
  • manual-mode
  • max-validation-failures-per-fetch
  • max-validations-per-fetch
  • min-transfer-rate-in
  • notify-defer
  • offline-ksk
  • pkcs11-uri
  • recursing-file
  • remote-servers
  • require-cookie
  • resolver-use-dns64
  • responselog
  • reuseport
  • sig0-checks-quota
  • sig0-checks-quota-exempt
  • sig0-key-checks-limit
  • sig0-message-checks-limit

mirror.zoneopt

  • min-transfer-rate-in
  • notify-defer

primary.zoneopt

  • check-svcb
  • checkds
  • notify-defer

secondary.zoneopt

  • checkds
  • min-transfer-rate-in
  • notify-defer

stub.zoneopt

  • min-transfer-rate-in

🔧 Modified Options

The following options have syntax changes in v9.20.18:

options

listen-on

v9.18.44:

[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>

v9.20.18:

[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>

response-policy

v9.18.44:

{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]

v9.20.18:

{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]

cookie-algorithm

v9.18.44:

( aes | siphash24 )

v9.20.18:

( siphash24 )

forwarders

v9.18.44:

[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]

v9.20.18:

[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]

listen-on-v6

v9.18.44:

[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>

v9.20.18:

[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>

also-notify

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

catalog-zones

v9.18.44:

{ zone <string> [ default-primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

{ zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

forward.zoneopt

forwarders

v9.18.44:

[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]

v9.20.18:

[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]

mirror.zoneopt

also-notify

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

primaries

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

primary.zoneopt

update-policy

v9.18.44:

( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesubject ) [ <string> ] <rrtype list>

v9.20.18:

( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtype list>

also-notify

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

parental-agents

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

forwarders

v9.18.44:

[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]

v9.20.18:

[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]

redirect.zoneopt

primaries

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

secondary.zoneopt

also-notify

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

parental-agents

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

forwarders

v9.18.44:

[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]

v9.20.18:

[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]

primaries

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

static-stub.zoneopt

forwarders

v9.18.44:

[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]

v9.20.18:

[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]

stub.zoneopt

forwarders

v9.18.44:

[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]

v9.20.18:

[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]

primaries

v9.18.44:

[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

v9.20.18:

[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]

📋 Newly Deprecated Options

The following options were marked as deprecated in v9.20.18:

options

  • sortlist

primary.zoneopt

  • max-zone-ttl

redirect.zoneopt

  • max-zone-ttl

Detailed File-by-File Comparison

options

  • v9.18.44: 334 options
  • v9.20.18: 333 options
  • Added: 26
  • Removed: 27
  • Modified: 7

forward.zoneopt

  • v9.18.44: 5 options
  • v9.20.18: 4 options
  • Added: 0
  • Removed: 1
  • Modified: 1

hint.zoneopt

  • v9.18.44: 5 options
  • v9.20.18: 4 options
  • Added: 0
  • Removed: 1
  • Modified: 0

in-view.zoneopt

  • v9.18.44: 2 options
  • v9.20.18: 2 options
  • Added: 0
  • Removed: 0
  • Modified: 0

mirror.zoneopt

  • v9.18.44: 44 options
  • v9.20.18: 43 options
  • Added: 2
  • Removed: 3
  • Modified: 2

primary.zoneopt

  • v9.18.44: 63 options
  • v9.20.18: 62 options
  • Added: 3
  • Removed: 4
  • Modified: 4

redirect.zoneopt

  • v9.18.44: 14 options
  • v9.20.18: 14 options
  • Added: 0
  • Removed: 0
  • Modified: 1

secondary.zoneopt

  • v9.18.44: 66 options
  • v9.20.18: 65 options
  • Added: 3
  • Removed: 4
  • Modified: 4

static-stub.zoneopt

  • v9.18.44: 12 options
  • v9.20.18: 12 options
  • Added: 0
  • Removed: 0
  • Modified: 1

stub.zoneopt

  • v9.18.44: 28 options
  • v9.20.18: 27 options
  • Added: 1
  • Removed: 2
  • Modified: 2

delegation-only.zoneopt

  • v9.18.44: 2 options
  • v9.20.18: 0 options
  • Added: 0
  • Removed: 2
  • Modified: 0

rndc.grammar

  • v9.18.44: 14 options
  • v9.20.18: 14 options
  • Added: 0
  • Removed: 0
  • Modified: 0

Migration Guide

Migrating from v9.18.44 to v9.20.18

  1. Remove unsupported options from your configuration

    • Review the Breaking Changes section above
    • Check if there are replacement options

  2. Plan for deprecated options

    • These options still work but may be removed in future versions
    • Start planning migration to recommended alternatives

  3. Test your configuration

    • Use named-checkconf to validate syntax
    • Test in a development environment before production
Reference in New Issue View Git Blame Copy Permalink