Operational Notification: Impact of Stricter Glue Checking

--===============4708368501249531797==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_9458E780-C6CF-4E66-89F5-ABC3DA1BCBA1"


--Apple-Mail=_9458E780-C6CF-4E66-89F5-ABC3DA1BCBA1
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Hello BIND users,

We have just published an Operational Notification at =
https://kb.isc.org/docs/strict-glue, which is included below. This is an =
issue you should be aware of, but it is not a software vulnerability, so =
there is no associated updated version of BIND.=20

- ISC Support

--------------------------
DOCUMENT VERSION: 1.0

POSTING DATE: 15 December 2025

CANONICAL URL: https://kb.isc.org/docs/strict-glue

PROGRAM IMPACTED: BIND

VERSIONS AFFECTED:

* BIND 9.18.41 and later

* BIND 9.20.15 and later

* BIND 9.21.14 and later

DESCRIPTION:

BIND versions released in October 2025 included changes in how BIND
processes referrals in delegations. BIND now only trusts glue records =
if,
in the associated NS record, the target name (right side) is a subdomain =
of
the owner name (left side). Glue associated with other names is ignored,
and those names are iteratively resolved instead. This enhances the
security posture of BIND, but some unintended side effects may also be
encountered. Operators should be aware of the potential consequences.

EXAMPLE:

Consider the following hypothetical delegations for <example.org.> from =
the
<com.> top-level-domain.

The glue in the following delegation would be accepted:

example.org. NS ns1.example.org.
example.org. NS ns2.example.org.
ns1.example.org. A 198.51.100.42
ns2.example.org. A 203.0.113.53

The glue in the following delegation would now be ignored (in prior
versions, it was acceptable). Instead, BIND will now proceed to resolve
<isc.org.>, and obtain NS and A records from the authoritative servers.

example.org. NS ns1.isc.org.
example.org. NS ns2.isc.org.
ns1.isc.org. A 149.20.2.26
ns2.isc.org. A 199.6.1.52

IMPACT:

* Increased outgoing queries:

- BIND resolvers may make an increased number of outgoing queries in
the process of following referrals.

- In some cases, referrals to nameservers will themselves result in a
new nameserver lookup. This can even repeat for longer chains of
nested lookups.

- The increased number of lookups may result in queries which
previously worked, now exceeding configured limits

- This often manifests as a query which gets SERVFAIL on the first
try, but works on a subsequent attempt, after some intermediate
records have already been cached.

* Broken delegations may be uncovered:

- Glue records may have accidentally been hiding problems with the
authoritative records

- Now BIND will find the authoritative records, which may have been
broken all along

- This often manifests as a domain that "was working" yielding
SERVFAIL or behaving inconsistently, after updating a BIND resolver

SOLUTION:

* Zone administrators should:

- Avoid long chains of nested referrals to new sets of name servers

- Avoid cyclic referrals entirely (A refers to B, B refers to A)

- Ensure glue records are consistent with records elsewhere

- Ensure NS records are consistent between parent and child zones

- Review all relevant records when changes are made, to maintain the
above over time

* Resolver administrators should:

- Be alert for trouble resulting from this change

- Adjust configuration parameters as appropriate to find a balance
between operational efficiency and any corresponding security
exposure


The configuration parameters most likely to be involved are:

* max-query-count

Iterative queries sent while resolving a single client query.
Cumulative across CNAME redirections.

* max-recursion-queries

Iterative queries sent while resolving a single name. Each CNAME
redirection begins a new counter at zero.

* max-recursion-depth

Depth of nesting while resolving a single name. For example, when an
NS record targets another domain, and that domain has an NS record
that targets a third name, and so on.

DIAGNOSTICS:

Log messages regarding these and similar limits are logged in the =
"resolver"
category, at debug level 3. Routinely logging at debug levels is usually
not recommended, due to the significant performance impact. It may be
appropriate on a small scale, such as a test lab, or a server collecting
samples.

To examine why a given name is not resolving, the "delv" tool with the
"+ns" switch can be used (available in BIND 9.20 and later). This
instantiates a full nameserver instance in the delv process, and uses it =
to
resolve the given query. The "-d" switch can be used to specify the =
debug
level. For example (all one line):

delv -d3 +ns failing-name.example.com. A | grep -i -e fail -e exceed

WORKAROUNDS:

Resolver administrators who find BIND can no longer resolve names for a
domain with broken glue can use a "static-stub" zone in their =
"named.conf" to
override published NS records and force a given set of name servers be =
used
to resolve the domain. For example:

// work around broken glue for "example.com" domain
zone "example.com." {
type static-stub;
server-addresses {
198.51.100.42; // ns1.example.com
203.0.113.53; // ns2.example.com
};
};

Note that long-term use of static-stub is not recommended. It is =
intended
to be used as a short-term workaround until a problem can be corrected.

DOCUMENT REVISION HISTORY:

* 1.0 Initial publication, 15 December 2025

DO YOU STILL HAVE QUESTIONS?

Questions regarding this notification should be mailed to
[email protected] or posted as confidential GitLab issues at
=
https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=
=3Dtrue

ISC SECURITY VULNERABILITY DISCLOSURE POLICY:

Details of our current security advisory policy and practice can be =
found
in the ISC Software Defect and Security Vulnerability Disclosure Policy =
at
https://kb.isc.org/docs/aa-00861

HOW TO SUBMIT A BUG REPORT TO ISC:

If you have encountered a problem with BIND (or with any other ISC
software), details on how to submit a report can be found at
https://www.isc.org/reportbug/

LEGAL DISCLAIMER:

Internet Systems Consortium (ISC) is providing this notice on an "AS IS"
basis. No warranty or guarantee of any kind is expressed in this notice =
and
none should be implied. ISC expressly excludes and disclaims any =
warranties
regarding this notice or materials referred to in this notice, =
including,
without limitation, any implied warranty of merchantability, fitness for =
a
particular purpose, absence of hidden defects, or of non-infringement. =
Your
use or reliance on this notice or materials referred to in this notice =
is
at your own risk. ISC may change this notice at any time. A stand-alone
copy or paraphrase of the text of this document that omits the document =
URL
is an uncontrolled copy. Uncontrolled copies may lack important
information, be out of date, or contain factual errors.=

--Apple-Mail=_9458E780-C6CF-4E66-89F5-ABC3DA1BCBA1
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" =
content=3D"text/html; charset=3Dus-ascii"></head><body =
style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; =
line-break: after-white-space;"><font face=3D"Calibri"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">Hello =
BIND users,</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">We have =
just published an Operational Notification at =
https://kb.isc.org/docs/strict-glue, which is included below. This is an =
issue you should be aware of, but it is not a software vulnerability, so =
there is no associated updated version of BIND.&nbsp;</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- ISC =
Support</span><br style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">--------------------------</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><span style=3D"font-size: 18px; =
background-color: rgb(255, 255, 255);">DOCUMENT VERSION: 1.0</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">POSTING =
DATE: 15 December 2025</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">CANONICAL URL:&nbsp;</span><span class=3D"clickylink" =
style=3D"box-sizing: border-box; font-size: 18px;"><a target=3D"_blank" =
href=3D"https://kb.isc.org/docs/strict-glue" style=3D"box-sizing: =
border-box; color: rgb(102, 102, 102); text-decoration: =
none;">https://kb.isc.org/docs/strict-glue</a></span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">PROGRAM =
IMPACTED: BIND</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">VERSIONS AFFECTED:</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">* BIND 9.18.41 and later</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">* BIND 9.20.15 and later</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">* BIND =
9.21.14 and later</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">DESCRIPTION:</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">BIND versions released in October 2025 included changes in how =
BIND</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">processes referrals in delegations. BIND now only trusts glue =
records if,</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">in the associated NS record, the target name (right side) is a =
subdomain of</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">the owner name (left side). Glue associated with other names is =
ignored,</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">and those names are iteratively resolved instead. This enhances =
the</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">security posture of BIND, but some unintended side effects may =
also be</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">encountered. Operators should be aware of the potential =
consequences.</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">EXAMPLE:</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Consider the following hypothetical delegations for =
&lt;example.org.&gt; from the</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">&lt;com.&gt; top-level-domain.</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">The =
glue in the following delegation would be accepted:</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">example.org. NS ns1.example.org.</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><span style=3D"font-size: 18px; =
background-color: rgb(255, 255, 255);">example.org. NS =
ns2.example.org.</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">ns1.example.org. A 198.51.100.42</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><span style=3D"font-size: 18px; =
background-color: rgb(255, 255, 255);">ns2.example.org. A =
203.0.113.53</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">The =
glue in the following delegation would now be ignored (in =
prior</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">versions, it was acceptable). Instead, BIND will now proceed to =
resolve</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">&lt;isc.org.&gt;, and obtain NS and A records from the =
authoritative servers.</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">example.org. NS ns1.isc.org.</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><span style=3D"font-size: 18px; =
background-color: rgb(255, 255, 255);">example.org. NS =
ns2.isc.org.</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">ns1.isc.org. A 149.20.2.26</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><span style=3D"font-size: 18px; =
background-color: rgb(255, 255, 255);">ns2.isc.org. A =
199.6.1.52</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">IMPACT:</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">* =
Increased outgoing queries:</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">- BIND resolvers may make an increased number of outgoing queries =
in</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">the =
process of following referrals.</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">- In some cases, referrals to nameservers will =
themselves result in a</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">new nameserver lookup. This can even repeat for =
longer chains of</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">nested lookups.</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">- The increased number of lookups may result in queries =
which</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">previously worked, now exceeding configured limits</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- This =
often manifests as a query which gets SERVFAIL on the first</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">try, =
but works on a subsequent attempt, after some intermediate</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">records =
have already been cached.</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">* Broken delegations may be uncovered:</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- Glue =
records may have accidentally been hiding problems with the</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">authoritative records</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">- Now BIND will find the authoritative records, which may have =
been</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">broken =
all along</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- This =
often manifests as a domain that "was working" yielding</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">SERVFAIL or behaving inconsistently, after updating a BIND =
resolver</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">SOLUTION:</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">* Zone =
administrators should:</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">- Avoid long chains of nested referrals to new sets of name =
servers</span><br style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- Avoid =
cyclic referrals entirely (A refers to B, B refers to A)</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- =
Ensure glue records are consistent with records elsewhere</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- =
Ensure NS records are consistent between parent and child =
zones</span><br style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- =
Review all relevant records when changes are made, to maintain =
the</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">above =
over time</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">* =
Resolver administrators should:</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">- Be alert for trouble resulting from this =
change</span><br style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">- =
Adjust configuration parameters as appropriate to find a =
balance</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">between operational efficiency and any corresponding =
security</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">exposure</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">The =
configuration parameters most likely to be involved are:</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">* =
max-query-count</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Iterative queries sent while resolving a single client =
query.</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Cumulative across CNAME redirections.</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">* =
max-recursion-queries</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Iterative queries sent while resolving a single name. Each =
CNAME</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">redirection begins a new counter at zero.</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">* =
max-recursion-depth</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Depth of nesting while resolving a single name. For example, when =
an</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">NS =
record targets another domain, and that domain has an NS =
record</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">that targets a third name, and so on.</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">DIAGNOSTICS:</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Log messages regarding these and similar limits are logged in the =
"resolver"</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">category, at debug level 3. Routinely logging at debug levels is =
usually</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">not recommended, due to the significant performance impact. It =
may be</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">appropriate on a small scale, such as a test lab, or a server =
collecting</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">samples.</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">To =
examine why a given name is not resolving, the "delv" tool with =
the</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">"+ns" =
switch can be used (available in BIND 9.20 and later). This</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">instantiates a full nameserver instance in the delv process, and =
uses it to</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">resolve the given query. The "-d" switch can be used to specify =
the debug</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">level. For example (all one line):</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">delv -d3 +ns failing-name.example.com. A | grep -i =
-e fail -e exceed</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">WORKAROUNDS:</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Resolver administrators who find BIND can no longer resolve names =
for a</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">domain =
with broken glue can use a "static-stub" zone in their "named.conf" =
to</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">override published NS records and force a given set of name =
servers be used</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">to resolve the domain. For example:</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">// work around broken glue for "example.com" =
domain</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">zone "example.com." {</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">type static-stub;</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><span style=3D"font-size: 18px; =
background-color: rgb(255, 255, 255);">server-addresses {</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">198.51.100.42; // ns1.example.com</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><span style=3D"font-size: 18px; =
background-color: rgb(255, 255, 255);">203.0.113.53; // =
ns2.example.com</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">};</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">};</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">Note =
that long-term use of static-stub is not recommended. It is =
intended</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">to be used as a short-term workaround until a problem can be =
corrected.</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">DOCUMENT REVISION HISTORY:</span><br style=3D"box-sizing: =
border-box; font-size: 18px;"><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">* 1.0 Initial publication, 15 December =
2025</span><br style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">DO YOU =
STILL HAVE QUESTIONS?</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Questions regarding this notification should be mailed =
to</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">[email protected] or posted as confidential GitLab issues =
at</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
class=3D"clickylink" style=3D"box-sizing: border-box; font-size: =
18px;"><a target=3D"_blank" =
href=3D"https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue" =
style=3D"box-sizing: border-box; color: rgb(102, 102, 102); =
text-decoration: =
none;">https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue</a></s=
pan><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">[confidential]=3Dtrue</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">ISC SECURITY VULNERABILITY DISCLOSURE POLICY:</span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">Details =
of our current security advisory policy and practice can be =
found</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">in the =
ISC Software Defect and Security Vulnerability Disclosure Policy =
at</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
class=3D"clickylink" style=3D"box-sizing: border-box; font-size: =
18px;"><a target=3D"_blank" href=3D"https://kb.isc.org/docs/aa-00861" =
style=3D"box-sizing: border-box; color: rgb(102, 102, 102); =
text-decoration: none;">https://kb.isc.org/docs/aa-00861</a></span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">HOW TO =
SUBMIT A BUG REPORT TO ISC:</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">If you have encountered a problem with BIND (or with any other =
ISC</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">software), details on how to submit a report can be found =
at</span><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
class=3D"clickylink" style=3D"box-sizing: border-box; font-size: =
18px;"><a target=3D"_blank" href=3D"https://www.isc.org/reportbug/" =
style=3D"box-sizing: border-box; color: rgb(102, 102, 102); =
text-decoration: none;">https://www.isc.org/reportbug/</a></span><br =
style=3D"box-sizing: border-box; font-size: 18px;"><br =
style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, 255);">LEGAL =
DISCLAIMER:</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><br style=3D"box-sizing: border-box; font-size: 18px;"><span =
style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">Internet Systems Consortium (ISC) is providing this notice on an =
"AS IS"</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">basis. No warranty or guarantee of any kind is expressed in this =
notice and</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">none should be implied. ISC expressly excludes and disclaims any =
warranties</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">regarding this notice or materials referred to in this notice, =
including,</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">without limitation, any implied warranty of merchantability, =
fitness for a</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">particular purpose, absence of hidden defects, or of =
non-infringement. Your</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">use or reliance on this notice or materials =
referred to in this notice is</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">at your own risk. ISC may change this notice at any =
time. A stand-alone</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">copy or paraphrase of the text of this document =
that omits the document URL</span><br style=3D"box-sizing: border-box; =
font-size: 18px;"><span style=3D"font-size: 18px; background-color: =
rgb(255, 255, 255);">is an uncontrolled copy. Uncontrolled copies may =
lack important</span><br style=3D"box-sizing: border-box; font-size: =
18px;"><span style=3D"font-size: 18px; background-color: rgb(255, 255, =
255);">information, be out of date, or contain factual =
errors.</span></font></body></html>=

--Apple-Mail=_9458E780-C6CF-4E66-89F5-ABC3DA1BCBA1--

--===============4708368501249531797==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
bind-announce mailing list
[email protected]
https://lists.isc.org/mailman/listinfo/bind-announce

--===============4708368501249531797==--