<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><header style="margin: 0px 0px 10px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; widows: 1; background-color: rgb(255, 255, 255);" class=""><h1 style="margin: 0px 0px 20px; padding: 5px 0px 0px; border: 0px; outline: 0px; vertical-align: baseline; word-wrap: break-word; background-color: transparent;" class=""><span style="color: rgb(68, 68, 68); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 15px; letter-spacing: normal; line-height: 22px; font-weight: normal;" class="">(if your mail environment does not format this post correctly, please try: </span><font color="#444444" face="Helvetica Neue, Helvetica, Arial, sans-serif" class=""><span style="font-size: 15px; font-weight: normal; line-height: 22px;" class=""><a href="http://blog.powerdns.com/2016/07/11/welcome-to-powerdns-4-0-0" class="">http://blog.powerdns.com/2016/07/11/welcome-to-powerdns-4-0-0</a> )</span></font></h1><h1 style="color: rgb(0, 0, 0); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 48px; line-height: 50px; margin: 0px 0px 20px; padding: 5px 0px 0px; border: 0px; outline: 0px; vertical-align: baseline; letter-spacing: -2px; word-wrap: break-word; background-color: transparent;" class="">Welcome to PowerDNS 4.0.0!</h1></header><div class="content" style="margin: 0px; padding: 0px; border: 0px; outline: 0px; font-size: 15px; vertical-align: baseline; zoom: 1; color: rgb(68, 68, 68); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 22px; widows: 1; background-color: rgb(255, 255, 255); background-position: initial initial; background-repeat: initial initial;"><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Today a rather epic journey ends. In this post, we describe how 4.0.0 came to be, what we did, what we added, but also answer the big question: should I deploy PowerDNS 4? And enable DNSSEC validation? <strong style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Finally.. to celebrate, we’ll be handing out vouchers for FREE PowerDNS 4.0.0 Coffee (or tea) mugs! </strong></p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">But first, a round of thanks. PowerDNS Authoritative Server 4.0.0 and PowerDNS Recursor 4.0.0 are the biggest releases in our history. This would not have been possible without the help of a lot of people. <strong style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">The PowerDNS community continues to be the stuff of dreams</strong>.</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">We believe in being <a href="https://blog.open-xchange.com/2015/03/24/powerdns/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">an open company</a> and producing powerful technology as open source. We are extremely grateful to be part of such a wonderful community that enables us together to make the internet and our software even greater. Thanks to you, this is the most powerful version of PowerDNS ever, and one we feel can be relied upon to serve your needs!</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Secondly, we’d like to thank our supported users (customers) too. Through their efforts, we were able to cram even more features into PowerDNS 4.0.0 than originally anticipated. Specifically, RPZ, IXFR and DNSSEC validation have been fast-tracked and enabled by (sadly) anonymous but very large PowerDNS customers.</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Additionally, a shout out to Spamhaus, Farsight and ThreatSTOP who all made their wonderful RPZ feeds freely available for interoperability testing.</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Finally, we are grateful for your understanding. PowerDNS 4.0.0 was a major ‘<a href="https://blog.powerdns.com/2015/11/28/powerdns-spring-cleaning/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">spring cleaning</a>‘ operation that took 16 months. It is rare for software projects to be granted the time to revisit and cleanup old code. We trust it was worth the wait!</p><h4 style="margin: 0px 0px 20px; padding: 10px 0px 0px; border: 0px; outline: 0px; font-size: 13px; vertical-align: baseline; color: rgb(0, 0, 0); text-transform: uppercase; background: transparent;" class="">THE HISTORY</h4><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">In February 2015 we <a href="https://blog.powerdns.com/2015/02/23/powerdns-development-plans-4-x-dnssec-c-2011/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">announced our plans for the 4.x.x branch of PowerDNS</a>. Late May of that year, we <a href="https://blog.powerdns.com/2015/05/26/powerdns-needs-your-help-what-are-we-missing/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">asked for your help determining the roadmap for 4.x.x</a>, and we got a lot of feedback from that. Late June we published <a href="https://mailman.powerdns.com/pipermail/pdns-users/2015-June/011545.html" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">the outcome of that process</a>.</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">At the end of 2015 we launched the 4.0.0 <a href="https://blog.powerdns.com/2015/12/24/technical-preview-releases-of-authoritative-server-recursor-and-dnsdist/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Technology Preview releases</a> (including dnsdist), where we noted:</p><blockquote style="margin: 0px 0px 20px; padding: 0px 35px; border: 0px; outline: 0px; vertical-align: baseline; quotes: none; color: rgb(136, 136, 136); background-image: url(applewebdata://FD9CD94C-C7F3-454D-9966-7625358D5874/wp-content/themes/pub/blaskan/img/sprite.png); background-position: 0px -85px; background-repeat: no-repeat no-repeat;" class=""><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">A few months into the development, various users and customers suddenly chimed in on absolutely mandatory features we had somehow missed. Because of that, 4.x both under- and over-delivers.</p></blockquote><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">During the 4.0.0 release process, we have stayed in close touch with our users and customers. And although we would have liked to have stuck to our roadmap, inevitably, some absolutely mandatory requirements came up. We spent most of early 2016 working with large (future) deployments to ensure 4.0.0 delivered what they needed (and deployed!).</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">So what did we do? You can read the full details in the release notes (<a href="http://blog.powerdns.com/2016/07/11/powerdns-authori%E2%80%A6r-4-0-0-released/%20%E2%80%8E" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">auth link</a>, <a href="http://blog.powerdns.com/2016/07/11/powerdns-recursor-4-0-0-released/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">recursor link</a>), but here in short:</p><h4 style="margin: 0px 0px 20px; padding: 10px 0px 0px; border: 0px; outline: 0px; font-size: 13px; vertical-align: baseline; color: rgb(0, 0, 0); text-transform: uppercase; background: transparent;" class="">SPRING CLEANING</h4><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Over time, most software projects keep adding features, but sadly also a lot of complexity and “cruft”. For us, 4.0.0 was a “<a href="https://blog.powerdns.com/2015/11/28/powerdns-spring-cleaning/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">spring cleaning</a>” exercise. We removed a lot of ancient code, tons of workarounds, loads of no longer relevant optimisations, non-functional backends and otherwise outdated code. We switched to C++2011, which allowed us to benefit from its enhanced features to make our <a href="http://bert-hubert.blogspot.nl/2015/01/on-c2011-quality-of-implementation.html" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">code briefer and better</a>.</p><h4 style="margin: 0px 0px 20px; padding: 10px 0px 0px; border: 0px; outline: 0px; font-size: 13px; vertical-align: baseline; color: rgb(0, 0, 0); text-transform: uppercase; background: transparent;" class="">THINGS WE ADDED</h4><ul style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; list-style-position: inside; list-style-image: initial; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class=""><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Full DNSSEC in the PowerDNS Recursor (Authoritative had this since 3.x)</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">RPZ in Recursor, tested to work with Spamhaus, Farsight Security and ThreatSTOP.</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">IXFR slaving in Authoritative and Recursor (for RPZ)</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">ODBC (Microsoft SQL Server & Azure) and LDAP backends are fully supported again in Authoritative</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Vastly improved Lua modules in Recursor, including the ability to asynchronously query reputation servers or databases (!)</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">EDNS Client Subnet support in Recursor (Authoritative supported this in 3.x.x too)</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">GEOIP backend enhanced, for example to support countries but also direct subnets for source dependent answers</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">All caches can now be wiped for whole subtrees</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Powerful new metrics that point out performance and operational problems (fd usage, memory usage, network responsiveness, kernel dropped packets)</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">ALIAS records so you can “CNAME your domain”, including DNSSEC support (as used by <a href="http://search.whitehouse.gov" class="">search.whitehouse.gov</a>!)</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">New pdnsutil commands like ‘<a href="https://blog.powerdns.com/2016/02/02/powerdns-authoritative-the-new-old-way-to-manage-domains/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">pdnsutil edit-zone</a>‘, create-zone, add-record, replace-rrset</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Halved query load on most database backends</li></ul><h4 style="margin: 0px 0px 20px; padding: 10px 0px 0px; border: 0px; outline: 0px; font-size: 13px; vertical-align: baseline; color: rgb(0, 0, 0); text-transform: uppercase; background: transparent;" class="">SHOULD I DEPLOY POWERDNS 4.0.0?</h4><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Definitely. PowerDNS Authoritative Server 4.x.x and PowerDNS Recursor pre-releases are already widely deployed. All of us over at PowerDNS rely fully on the 4.0.0 version, and in fact find 3.x.x somewhat painful to use in comparison. We trust the code in 4.0.0 more.</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">In terms of performance, both Authoritative and Recursor look to offer higher peak performance than 3.x.x. We have performed extensive benchmarking on the Recursor, and reliably achieve 400kqps on “actual customer traffic”. For Authoritative, we note that 4.0.0 halves the database backend query load in many circumstances.</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Enabling DNSSEC processing in Recursor 4.0.0 (the default) means slightly higher CPU utilization than 3.x.x. Turning on validation roughly doubles the CPU load.</p><h4 style="margin: 0px 0px 20px; padding: 10px 0px 0px; border: 0px; outline: 0px; font-size: 13px; vertical-align: baseline; color: rgb(0, 0, 0); text-transform: uppercase; background: transparent;" class="">WHAT ABOUT DNSSEC VALIDATION?</h4><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">DNSSEC does not make DNS any easier. Many DNS and DNSSEC enabled domains are misconfigured. <strong style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Our trials indicate PowerDNS Recursor 4.0.0 will successfully validate all correctly configured domains</strong>(that we have tested). The bad news is that many domains, some important ones even, are not correctly configured.</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Our advice for now is:<a href="https://doc.powerdns.com/md/recursor/dnssec/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class=""> turn on DNSSEC validation</a> if you are prepared to spend time monitoring the log files for validation failures. And even as we improve our resilience against badly configured domains and work out issues, this advice will remain in place. DNSSEC validation, regardless of software used for it, requires monitoring. A useful option at this time is ‘<a href="https://doc.powerdns.com/md/recursor/dnssec/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">log-fail</a>‘, which will do the validation but only log the failures, and not block the answers.</p><h4 style="margin: 0px 0px 20px; padding: 10px 0px 0px; border: 0px; outline: 0px; font-size: 13px; vertical-align: baseline; color: rgb(0, 0, 0); text-transform: uppercase; background: transparent;" class="">ENOUGH OF THIS, HOW DO I GET MY HANDS ON THE GLORIOUS POWERDNS 4.0.0 RELEASE MUG?</h4><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">As a small token of our appreciation, we have teamed up with <a href="http://www.mugbug.co.uk/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">MugBug</a> to ship <strong style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">free PowerDNS 4.0.0 release mugs</strong> to anyone who was in any way part of the process. Uniquely, this giveaway extends <strong style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">to anyone deploying PowerDNS Authoritative Server</strong> 4.0.0 or PowerDNS Recursor 4.0.0 in the coming months!</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">So, apply for a free mug or even a set of mugs (if you are in an office), if you:</p><ul style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; list-style-position: inside; list-style-image: initial; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class=""><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Opened an issue relevant for PowerDNS 4.0.0 on GitHub</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Contributed code or a pull request that ended up in 4.0.0</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Supplied testing data (PCAPs) now or in the past</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Deployed PowerDNS 4.0.0 betas, release candidates, alphas or the technology preview</li><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Feel in any other way that you contributed to 4.0.0!</li></ul><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">If you are part of a team, feel free to apply for mugs for the whole team. There is no need to send us your address details (since MugBug will do the actual logistics), but we do need to know who you are and what you did to be part of the PowerDNS community! Please email to <strong style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class=""><a href="mailto:powerdns-4.0-contributors@powerdns.com" class="">powerdns-4.0-contributors@powerdns.com</a> </strong>with your details (which we absolutely promise not to use in any other way then to authorize MugBug to send you your mugs!).</p><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">We’ve allocated a generous budget for the free mug giveaway, but it is limited – but we expect to be able to ship hundreds of mugs.</p><h4 style="margin: 0px 0px 20px; padding: 10px 0px 0px; border: 0px; outline: 0px; font-size: 13px; vertical-align: baseline; color: rgb(0, 0, 0); text-transform: uppercase; background: transparent;" class="">FINALLY</h4><p style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Thank you for your interest in PowerDNS Authoritative Server 4.0.0 and Recursor 4.0.0! Other blog posts have the full details and download links for the <a href="http://blog.powerdns.com/2016/07/11/powerdns-authori%E2%80%A6r-4-0-0-released/%20%E2%80%8E" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Authoritative Server</a> and the <a href="http://blog.powerdns.com/2016/07/11/powerdns-recursor-4-0-0-released/" target="_blank" style="margin: 0px; padding: 0px; vertical-align: baseline; color: rgb(46, 110, 176); background-color: transparent; background-position: initial initial; background-repeat: initial initial;" class="">Recursor</a>.</p><div style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-color: transparent;" class=""> <br class="webkit-block-placeholder"></div></div></body></html>