Dear all.

NSD 4.15.4rc1 pre-release is available:

https://nlnetlabs.nl/downloads/nsd/nsd-4.15.4rc1.tar.gz

sha256 1fc546c134ef972ba690d9a38658317ca560cb7b610ff0df0876118b0da80eeb
pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.15.4rc1.tar.gz.asc

This is the maintainer's pre-release of NSD 4.15.4rc1.
This release has many bugfixes, updated support for RR types and SVCB parameters and a few new features.

The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026:

User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419  146A A144 323D EAAC DF45

The key is available from https://nlnetlabs.nl/signing-keys

Please review this pre-release carefully. If all is well, the actual release will follow Wednesday, the 21st of October 2026.

4.15.4 (in development)

FEATURES:

• A report-channel config option to return a Report-Channel EDNS option
  in responses
• A catalog-group-pattern option to limit the patterns from which
  catalog consumer member zones may be configured by using the group
  property.
  Thanks to Qifan Zhang, Palo Alto Networks, for the suggestion.
• Merge #515: The UNECE and ISO RR types

BUG FIXES:

• Fix makedist.sh to omit .cirrus.yml ci integration.
• Fix handling malformed SOA records with a short rdata content with
  incremental transfers. Thanks to Tristan Madani for the report.
• Fix #510: Missing NSEC3 records for next-closer in case of
  ENT, NSEC3 and opt-out.
• Merge #511: Fix to retry a catalog consumer zone over AXFR if IXFR
  failed to apply
• Fix to not wrap the rdlength variable for SVCB RRs with an rdlength
  larger than 65528 (and a short TargetName rdata field, like .).
  Thanks to Zanya tea915656@gmail.com for the report.
• Fix to not crash when more than one group property is parsed from a
  consumer catalog member zone, with only one of them valid.
  Thanks to Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan
  from Tsinghua University, for the report and suggested fix.
• Fix that when printing rdata, fixed sized writes will not overflow
  the buffer.
  Thanks to Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan
  from Tsinghua University, for the report and suggested fix.
• Fix to compare the dname variant of an AMTRELAY relay and IPSECKEY
  gateway RDATA field case insensitively when they are removed by way
  of IXFR.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
• Fix to deny CAA RRs from primaries with an empty tag.
  Thanks Qifan Zhang, Palo Alto Networks, for the report.
• Fix #523: systemd support is incomplete. Implements
  Type=notify-reload with systemctl reload nsd support.
• Fix #526 from jpmens: Fix typo in nsd.conf.5.in
• Merge #527: Eliminate excess error message in XoT transfer
  Thanks Ferran Tufan

simdzone 0.2.8rc1

FEATURES:

• The UNECE and ISO RR types

BUG FIXES:

• Fix the calculation of the rdata needed for rdata in RFC 3597 Unknown Type format.
  Thanks to Zanya tea915656@gmail.com for the report.
• Fix preventing size_t length to wrap below 0 when scanning an end-of-string backslash character, resulting in out-of-bounds read.
  Thanks to Zanya tea915656@gmail.com for the report.
• Fix to determine the correct rdata length for WKS RRs without bitmap.
  Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report.
• Fix to build simdzone also with NDEBUG by default, like NSD and only disable it when --enable-check ing is given to configure.
  Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report.
• Fix to let configure detect ar as it needs to match the --host arch
  Thanks Haelwenn (lanodan) Monnier
• Fix asm usage in strict ISO C builds
  Thanks Jared Mauch