A patch release with a security fix for forward mode, fewer false DNSSEC failures in strict mode, and a fix for a 0.23.0 regression in recursive mode.
🔒 Security
- Forward mode now sends upstreams a random query ID instead of passing the client's through, closing a one-packet cache-poisoning path (#397)
- rustls bumped to 0.23.45 for RUSTSEC-2026-0285 (#396)
🧭 Resolution
- Recursive mode resolves names like
multi.surbl.orgagain, fixing a 0.23.0 regression where replies naming the root were rejected (#387, reported in #386) - A cached SERVFAIL now lives for seconds instead of
min_ttl, so one upstream hiccup no longer blackholes a domain for a minute (#388, #376) - NXDOMAIN takes its TTL from the authority SOA, per RFC 2308 (#389)
🚦 New limit on concurrent lookups
max_concurrent_resolutions (default 512, 0 disables) caps cache misses running at once across UDP, TCP, DoT and DoH. Cached, local and coalesced answers are never counted. Over the cap, UDP is dropped silently and stream transports get SERVFAIL. (#364)
If you run numa for many clients, watch queries.refused and resolutions in /stats after upgrading.
🔏 DNSSEC
- Strict mode no longer SERVFAILs zones such as
isc.organd.ai: RSA keys under 2048 bits verify, RSASHA512 and ECDSA P-384 are supported, and unsupported algorithms are treated as Insecure (#390, #393) - Denial-of-existence proofs are authenticated (#393)
- DS queries go to the parent side of the zone cut, and signed RRsets are ordered by RDATA when rebuilt (#391, #392)
⚙️ Operations
- numa exits cleanly on SIGTERM and SIGINT, so
docker stopworks (#368) numa lan|block|dnssec on|offedits the config the running daemon loaded, not anuma.tomlin the current directory. Thanks @hcars (#371)- ODoH errors now say whether the relay or the target failed, and the target config fetch is bounded by the query budget (#369, #377)
- The ODoH relay answers unknown paths and a trailing slash on
/relaywith a usable response instead of an empty 404 (#369, #365)
Also notable
- Chinese README, first contribution from @Lkhsss (#268)
- Recipe for local DNS records and split DNS (#370)
- Docker image builds again from a tag (#363)
- Benchmark tooling fixes and a tag-baseline script (#361, #379)
All changes
What's Changed
- fix(bench): unbreak the comparison modes, add tag-baseline tooling by @razvandimescu in #361
- fix(docker): copy build.rs into the builder image by @razvandimescu in #363
- fix(serve): handle SIGTERM and SIGINT so containers can stop numa by @razvandimescu in #368
- docs(recipes): add local DNS records and split DNS recipe by @razvandimescu in #370
- Fix Linux path resolution by @hcars in #371
- chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #374
- chore(deps): bump the minor-and-patch group with 11 updates by @dependabot[bot] in #373
- chore(deps): bump rust from 1.97-alpine to 1.98-alpine in the minor-and-patch group by @dependabot[bot] in #372
- fix(odoh): bound the target config fetch by the query budget by @razvandimescu in #377
- fix(bench): use real key material in dnssec verify benches by @razvandimescu in #379
- test(relay): cover a real forward end to end by @razvandimescu in #380
- fix(odoh): name the hop that produced a failed ODoH status by @razvandimescu in #369
- Adding README in Chinese by @Lkhsss in #268
- feat(admission): cap concurrent cache-miss resolutions across transports by @razvandimescu in #364
- fix(wire): parse the root name as "." so root UDP replies match their query by @razvandimescu in #387
- fix(cache): cap a cached resolution failure at seconds, not min_ttl by @razvandimescu in #388
- fix(dnssec): verify RSA keys below 2048 bits, add RSASHA512 and ECDSA P-384 by @razvandimescu in #390
- chore(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285 by @razvandimescu in #396
- fix(forward): send upstream a random TXID, not the client's by @razvandimescu in #397
- fix(dnssec): order RRsets by RDATA alone when rebuilding signed data by @razvandimescu in #391
- fix(recursive): send DS queries to the parent side of the zone cut by @razvandimescu in #392
- fix(dnssec): treat unsupported algorithms as Insecure and authenticate denial proofs by @razvandimescu in #393
- fix(cache): take the negative TTL from the authority SOA by @razvandimescu in #389
New Contributors
Full Changelog: v0.23.0...v0.23.1