===> The following configuration options are available for nsd-4.15.4:
BIND8_STATS=on: BIND8-like NSTATS & XSTATS
CHECKING=off: Internal run-time checks
DNSTAP=on: Enable dnstap logging support
DOCS=on: Build and/or install documentation
IPV6=on: IPv6 protocol support
LARGEFILE=on: Largefile support
MINRESPSIZE=on: Minimial response sizing
MMAP=off: Use mmap instead of malloc (experimental)
MUNIN_PLUGIN=off: Install Munin plugin (requires BIND8_STATS)
NSEC3=on: NSEC3 support
PACKED=off: Enable packed structures for reduced memory use
RADIXTREE=on: Enabled: more (15%) memory use but less CPU cycles
RRL=on: Response Rate Limiting
ZONE_STATS=on: Separate statistics for each zone
===> Use 'make config' to modify these settings
To run nsd from startup, add nsd_enable="YES" to your etc/rc.conf
Starting with nsd version 4 the old nsdc control program has been
replaced by nsd-control. This requires some manual setup with
nsd-control-setup and editing of the config files.
nsd-control is incompatible with nsdc so when that is used in scripts,
these should be adapted
dns/nsd: Update 4.15.3 => 4.15.4
This release has many bugfixes, updated support for
RR types and a few new features.
Release Notes:
https://community.nlnetlabs.nl/t/nsd-4-15-4-released/3494
PR: 300088
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
*/*: Bump PORTREVISION for devel/protobuf-c update
libprotobuf-c.so once again has version info. Force a rebuild of
its consumers.
PR: 282060
MFH: 2025Q3
Sponsored by: <If the change was sponsored by an organization.>
dns/nsd: Update to 4.11.1
ChangeLog: https://www.nlnetlabs.nl/news/2025/Jan/18/nsd-4.11.1-released/
BUG FIXES:
* Fix #415: Fix out of tree builds.
* Fix #414: XoT interoperability with BIND and Knot
* Fix #421: old-main can quit before the reload process received
r* om old-main that it is done on the reload_listener pipe.
h* anks Otto Retter.
* Fix whitespace in comment.
* Fix #424: Stalled updates after corrupt transfer.
PR: 284156
Reported by: jaap@NLnetLabs.nl (maintainer)
dns/nsd: Update to 4.10.0
ChangeLog: https://nlnetlabs.nl/news/2024/Jun/13/nsd-4.10.0-released/
* Merge #278: Replace Flex+Bison based zone parser with simdzone.
Performance of loading zones and IXFRs is greatly improved by using
the simdzone project by NLnet Labs. The optimized presentation
format parser leverages SIMD instructions in modern CPUs to improve
throughput. Right now SSE4.2 and AVX2 instruction sets are
supported, other instruction sets will use the fallback
implementation, which still is a decent improvement over the
Flex+Bison based parser.
BUG FIXES:
* Fix that when the server truncates the pidfile, it does not follow
(Only the first 15 lines of the commit message are shown above )
dns/nsd: Update to 4.7.0
ChangeLog: https://www.nlnetlabs.nl/news/2023/Jun/07/nsd-4.7.0-released/
4.7.0
================
FEATURES:
- Merge #263: Add bash autocompletion script for nsd-control.
- Fix #267: Allow unencrypted local operation of nsd-control.
- Merge #269 from Fale: Add systemd service unit.
- Fix #271: DNSTAP over TCP, with dnstap-ip: "127.0.0.1@3333".
- dnstap over TLS, default enabled. Configured with the
options dnstap-tls, dnstap-tls-server-name, dnstap-tls-cert-bundle,
dnstap-tls-client-key-file and dnstap-tls-client-cert-file.
(Only the first 15 lines of the commit message are shown above )
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
dns/nsd: Update to 4.5.0
Changes: https://www.nlnetlabs.nl/news/2022/May/13/nsd-4.5.0-released/
This release fixes a couple of minor bugs and adds IXFR out
functionality. With this functionality NSD can respond to IXFR queries
and serve IXFR transfers downstream.
It is default disabled, that means it does not store IXFR contents for
zones by default. The response on the wire is different, also with IXFR
disabled, because it is now supported, and thus also for those zones a
reply is served, that no differential data is available.
FEATURES:
- Merge PR #209: IXFR out
(Only the first 15 lines of the commit message are shown above )
dns/nsd: Update version 4.3.9=>4.4.0
- Pet portclippy
This release changes the memory allocation for outgoing zonetransfers,
and this reduces the memory footprint. The defaults for the amounts are
the same as before, but there are config options to configure the memory
usage. There are also bug fixes.
4.4.0
================
FEATURES:
- Merge #193: Lower memory usage of the XFRD process by default.
Instead of preallocating all elements, they are allocated when used.
There are options for managing the memory usage, defaults are the
(Only the first 15 lines of the commit message are shown above )
dns/nsd: Update 4.3.4 -> 4.3.5
This release fixes a number of bugs. It fixes a number of corner
case differences for the output more similar to Bind. The configure
sources are compatible with the new autoconf 2.70.
PR: 253026
Submitted by: jaap@NLnetLabs.nl (maintainer)
dns/nsd: update 4.3.2 -> 4.3.3
This release contains the DNS Flag Day 2020 fixes. This sets the
default EDNS buffer size to 1232, that should reduce fragmentation.
https://dnsflagday.net/2020/
There is a new feature where it is possible to list an interface by
name. This pulls in the IP addresses associated with the interface
at server start.
FEATURES:
- Follow DNS flag day 2020 advice and
set default EDNS message size to 1232.
- Merged PR #113 with fixes. Instead of listing an IP-address to
listen on, an interface name can be specified in nsd.conf, with
(Only the first 15 lines of the commit message are shown above )
dns/nsd: update 4.3.0 -> 4.3.1
BUG FIXES:
- Fix #70: error: 'fd_set' undeclared.
- Fix #71: error: 'for' loop initial declaration used outside C99
mode.
- Fix to move declarations out of for loops in event test too.
- Fix #76: cpuid typedef for Hurd, DragonflyBSD compile.
- Fix #75: configure test for sched_setaffinity, and use
cpuset_setaffinity otherwise. Also test for presence of sysconf.
- Fix #74: GNU Hurd fix cast from pointer to integer of different size.
- Fix for #74, #75: cpuset test for header contents and provide code.
- Fix #78: Fix SO_SETFIB error on FreeBSD.
- Merge PR #83 from noloader: Fix GNU HURD sched_setaffinity compile.
- Fix #80: NetBSD and implicit declaration of reallocarray.
(Only the first 15 lines of the commit message are shown above )
dns/nsd: upgrade 4.2.4 -> 4.3.0
This port incorporates also the proposed bug fix at bug #242367
Major changes:
This release adds cpu affinity. By pinning a server process to a
specific cpu, having a separate network card also for that cpu, and
an interface address also for that server process, the throughput is
increased. This increases performance of the nameserver.
Sparse TSIG signing support is removed, to comply with the latest tsig
standard update draft.
There is a feature to drop update queries, with opcode UPDATE,
(Only the first 15 lines of the commit message are shown above )
dns/nsd: Update to 4.1.20
This release fixes memory leaks when reading zonefiles
and processing zone transfers.
4.1.20
================
BUG FIXES:
- Fix memory leak in zone file read of unknown rr formatted RRs.
- Fix memory leak when rehashing nsec3 after axfr or zonefile read,
in the selectively allocated precompiled nsec3 hashes.
Also changed to DISTVERSION
Submitted by: jaap@NLnetLabs.nl (maintainer)
Approved by: tcberner (mentor, implicit)
dns/nsd: update 4.1.17 -> 4.1.18
This release has features for saving memory and faster notification.
With --enable-packed, 33% memory savings could be had, or something
along that size. Notification of secondary servers happens in parallel,
and has faster timeouts. More sockets are used for zone transfers.
This speeds up communication with a larger set of servers. Additionally
a bug is fixed for dual-loaded parent-and-child zone configured at the
same time, when one of the zones has not loaded properly.
FEATURES:
- xfr-inspect, it is not installed, it prints xfr files from /tmp
made with 'make xfr-inspect' in the source dir.
- retry timeout between sending notifies dropped from 15 to 3 sec.
- NSD sends 16 notifies simultaneously.
(Only the first 15 lines of the commit message are shown above )
dns/nsd: Update to 4.1.17
Features:
- zone parser parses type AVC (it has TXT format).
- Fix #1272: use writev to put tcp length field with data for outgoing
zone transfer requests.
Bugfixes:
- Fix potential null pointer in nsec3 adjustment tree.
- Fix text format of deletes for CDS and CDNSKEY, single 0 to represent
empty base64 or hex string.
PR: 220939
Submitted by: jaap@NLnetLabs.nl (maintainer)
dns/nsd: update 4.1.15 -> 4.1.16
features:
- zone parser can parse acronyms for algorithms ED25519 and ED448.
- Fix 1243: Option to make NSD emit really minimal responses,
minimal-responses: yes in nsd.conf.
bug fixes:
- Calculate new udb index after growing the array, fix from
Chaofeng Liu.
- Fix missing _t to _type conversion for disable-radix-tree option.
- Printout serial error with hint it may be too big.
- Fix 1228: OpenSSL include is not guarded with HAVE_SSL
- Patch for expire state in multi-master when masters includes
broken master, from Manabu Sonoda.
- minor manpage fix.
PR: 218873
Submitted by: jaap@NLnetLabs.nl (maintainer)
dns/nsd: Fix missing _t to _type conversion for disable-radix-tree option
- Noting NSD changelog, recent update renamed _t typedefs because POSIX
reserves them. The 4.1.15 update missed a few conversion.
- Unbreak RADIXTREE. No PORTREVISION change as port would not have built.
PR: 217640
Reported by: Max Kostikov <max@kostikov.co>
Submitted by: w.schwarzenfeld@utanet.at (the suggested diff)
jaap@NLnetLabs.nl (maintainer - the port patch)
Obtained from: nsd svn r4741
Update to version 4.1.13
SUMMARY:
Some features, such as multi master check option that does not upgrade
from the first master that answers, but picks the best one.
Additional section handling for type SRV. And bug fixes.
FEATURES:
- multi-master-check: yes can be used to check all masters for the
last version, using the higher version from the configured masters,
from Manabu Sonoda.
- Support RR type OPENPGPKEY from RFC 7929.
- Can config key algorithms with the digest name, eg. 'sha256'.
- configure --disable-radix-tree for about 15% lower memory usage.
- for type SRV add A/AAAA to the additional section (if possible),
(Only the first 15 lines of the commit message are shown above )
dns/nsd: update 4.1.10 -> 4.1.11
- Restore configurable IPV6 option. Upstream integrated fix for issue.
- FEATURES:
* When tcp is more than half full, use short timeout for tcp session.
* Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
* Fix #790: size-limit-xfr can stop NSD from downloading infinite zone transfer
data size, from Toshifumi Sakaguchi.
Fixes CVE-2016-6173 JVN#63359718 JPCERT#91251865.
- BUGFIXES:
* Fix build without IPv6, patch from Zdenek Kaspar.
* Fix #783: Trying to run a root server without having configured it silently
gives wrong answers.
* Fix #782: Serve DS record but parent zone has no NS record.
* Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.
PR: 211693
Submitted by: jaap@NLnetLabs.nl (maintainer)
Security: CVE-2016-6173
Security: https://vuxml.FreeBSD.org/freebsd/7d08e608-5e95-11e6-b334-002590263bf5.html
MFH: 2016Q3
dns/nsd: Remove IPv6 option, fixes build
Remove the IPv6 option that is causing builds to fail when it is
disabled. The issue does not affect package users, as it was a default
option.
The issue has been fixed upstream [1] and will be included/renabled
in the next version update.
While I'm here:
* Switch to USES=ssl
* Add --enable-ipv6 in CONNFIGURE_ARGS to ensure it's explicitly enabled
[1] https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=800
PR: 211303
Reported by: <vfx9as gmail com>
Approved by: maintainer <jaap NLnetLabs nl>
MFH: 2016Q3
- update to 4.1.9
BUG FIXES:
- Change the nsd.db file version because of nanosecond precision fix.
Approved by: jaap@NLnetLabs.nl (maintainer)
PR: 208043
MFH: 2016Q1
- update to 4.1.8
- add ability to build agains openssl or libressl from ports
- add MUNIN_PLUGIN_IMPLIES= BIND8_STATS
- use @sample macro in pkg-plist for nsd.conf
- s/exec/postexec/ pkg-plist
FEATURES:
- #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch
from Daisuke Higashi.
- #739: zonefile changes when mtime is small are detected on reload,
if filesystem supports precision mtime values.
- RR type CSYNC (RFC7477) syntax is supported.
BUG FIXES:
- take advantage of arc4random_uniform if available, patch from
Loganaden Velvindron.
- Fix flto check for OSX clang.
- Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux.
- Fix #736: segfault during zone transfer.
- Fix #744: Fix that NSD replies for configured but unloaded zone
with SERVFAIL, not REFUSED.
PR: 207951
Submitted by: jaap@NLnetLabs.nl (maintainer)
MFH: 2016Q1
Update to 4.1.6
Major Bug Bug Fixes:
- This release fixes segfault after start when many interfaces are in use.
- This version returns the EDNS bad version response with the AD flag
unset for improved conformance.
Minor Buf Fixes:
- Fix #701: Fix that AD=1 set in a BADVERS response.
- Fix typo in zonec.c inside error message.
- Fix #711: Document that debug-mode yes is used for staying
attached to the supervisor console.
- Document verbosity 3 prints more information.
- nsd-checkconf warns for master zones with no zonefile statement.
- Fix start failure when many file descriptors are in use.
- The servfail rcode is not printed with a space in the middle.
- print failed token for config syntax error or parse error.
PR: 204533
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Sponsored by: DK Hostmaster A/S
Upgrade from 4.1.3 to version to 4.1.5 (includes up 4.1.4)
FEATURES:
- RFC7553 RR Type URI support.
- removed hardcoded interface limit, --with-max-ips removed.
- Admitted axfrs are logged at verbosity 1. Refused at verbosity 2.
Major BUG FIXES:
- Fix NSID response for short edns sizes.
- Fix that for expired zones NSD performs an AXFR and accepts newer
and older serial numbers.
PR: 203231
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Sponsored by: DK Hostmaster A/S
update to 4.1.1
Major Features:
- RFC 7344: CDS and CDNSKEY (read record types).
- per zone statistics with --enable-zone-stats
- Disabled use of SSLv3 in nsd-control.
- Synthesize CNAMEs with same TTL as DNAME.
- nsd-checkconf -f prints out full name of pidfile (with dir). [1]
PR: 197291,
196449 [1]
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl>,
Adam Zaleski <adam@zaleski.org> [1]
- Update to 4.1.0
- Use nsd instead of bind user
This release has new features and bugfixes. In nsd.conf you can
configure database: "" this makes NSD not use the large mmapped nsd.db
file, but instead read and write the zonefiles in text format, which
saves about 50% of the memory usage. Also zonefile reading and
writing has been optimised to be faster, as well as processing time
for zone transfers. NSD writes the (changed) zonefiles every hour.
The new nsd-checkzone tool reports if a zonefile parses so you can check
it before reading it into the daemon.
A bug is fixed where NSD 4 causes rising load average and memory
consumption on Linux systems, which is caused by a bug in Linux that
slowly deteriorates system performance by repeated recursive forks.
Full release notes:
http://open.nlnetlabs.nl/pipermail/nsd-users/2014-September/002007.html
PR: 193332
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Sponsored by: DK Hostmaster A/S
Only use libevent2
Remove libevent as libevent2 is providing a good compatibility interface as well
as providing better performances.
Remove custom patches from libevent2 and install libevent2 the regular way
Mark ports abusing private fields of the libevent1 API as broken
Import a patch from fedora to have honeyd working with libevent2
Remove most of the patches necessary to find the custom installation we used to
have for libevent2
With hat: portmgr
- remove pre-patch delay
- remove PKG-INSTALL from post-install (not used with staging)
- move pkg-install and pkg-deinstall into pkg-plist
Approved by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer, per PM)
- Fix man installation after port was stagified [1]
- Convert LIB_DEPENDS to new format [1]
- Remove leading article from COMMENT
- Switch to options helpers
- Conditional installation of docs is not needed with stage
- Don't show pkg-message twice
PR: ports/186693 [1]
Submitted by: Denis Generalov <gd.workbox@gmail.com>
Approved by: maintainer
There was a wrong rc script in the port preventing the daemon to run.
Added STAGING support
Added LICENSE (NSD3CLAUSE) statement
Other small changes to make portlint more happy
PR: 186631
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
- Update to 4.0.1
- Cleanup rc script
FEATURES:
- recognizes ip-address and interface as synonyms for convenience.
- Support for EUI48 and EUI64 RR types enabled by default (RFC 7043).
- Support for CAA RRtype (RFC 6844).
- NSID can be set with "ascii_somestring" in ascii.
BUG FIXES:
- Fix xfrd when zone transfer TCP contains zero length packets.
- Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3,
because AXFRs overwrote nsec3 administration in the child zone.
- Fix that bad IXFR updates do not result in double SOA records,
and that an AXFR is started (attempted) when the zone state seems
(Only the first 15 lines of the commit message are shown above )
Please welcome NSD 4.0.0
For all new features, see
http://www.nlnetlabs.nl/svn/nsd/tags/NSD_4_0_0_REL/doc/NSD-4-features
This version replaces the nsdc control program with nsd-control.
This requires some manual setup with nsd-control-setup and editing
of the config files. nsd-control is incompatible with nsdc so when
that is used in scripts, these should be adapted.
NSD 3 is still supported as dns/nsd3.
PR: 183888
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl>
