Release Notes for DNSCheck Lib v1.4.0
=====================================

* Minimum required Perl version is now 5.10.1.

* A couple of new tests:

 - That a minimal referral can fit in a 512-octet packet.
 - The responses come from the same IP address the question was sent to.
 - That NSEC or NSEC3 is used in signed zones.
 - That NSEC3 parameters are sane.
 - That RRSIG durations are sane.

* CZNIC contributed a Czech translation.

* Reserved IP ranges updated according to new RFCs.

* All tests that made SMTP connections have been removed.

* The CLI script has a --level flag to specify the lowest log level you want printed.

* A new, better algorithm to check nameserver AS distribution.

* Plus of course bug and stability fixes.

Release Notes for DNSCheck Lib v1.3.0
=====================================
Notable changes:

* The configuration file layout has changed completely!

  Instead of the old, complicated variant, default configuration, default 
  policy and language files are now installed in the proper place in the Perl 
  module tree. The user should never need to care exactly where that is. Local 
  changes to the configuration now lives in /etc/dnscheck/config.yaml and 
  /etc/dnscheck/policy.yaml

  You have to manually move and rename your old site_config.yaml and 
  site_policy.yaml, if you have them!


Release Notes for DNSCheck Lib v1.2.6
=====================================
Notable changes:

* Fixes one crash bug in v1.2.5

* Completely re-works unit tests, making them more reliable and more 
  comprehensive.


Release Notes for DNSCheck Lib v1.2.4
=====================================
Noteable changes:

* A real fix for issue #52, i.e. reverting the code to v1.2 in Delegation.pm... 


Release Notes for DNSCheck Lib v1.2.3
=====================================
Notable changes:

* Fix for issue #52 in Github, introduced in v1.2.2

* Fix of the "Check for IPv6 NS addresses only at parent or only at child." 



Release Notes for DNSCheck Lib v1.2.2
=====================================
Notable changes:

* Test for NS records pointing at CNAMEs.

* Test for discrepancy in IPv6 presence at parent and child.

* Multiple changes of default policy levels, mostly to do with the growing importance of DNSSEC.

* General fixes for bugs, stability issues and correctness.


Release Notes for DNSCheck Lib v1.2
===================================
Changes since version 1.2:
--------------------------

* Fix an XSS issue in the web GUI.

* Fix a bug in the delegation-testing code.


New features since version 1.1:
-------------------------------

* The dispatcher can now be started as root, and change to a specified user
  and group after it's done with opening files.
  
* The project has moved to Github. It can now be found at http://github.com/dotse/dnscheck


Bugfixes and changes to tests since version 1.1
-----------------------------------------------

* The NO_TCP and NO_UDP tests have been made more reliable.

* Some tests stop earlier if they can't run, avoiding some reports that don't
  make sense (like nameservers that don't respond at all being stated not to
  be recursive).
  
* The concept of "mandatory algorithms" for DNSSEC has been retired. Instead,
  there will be warnings if DNSKEY or DS records are found to be using
  cryptographic algorithms listed as unallocated, reserved or private by IANA.
  
* The DNSSEC tests now deal correctly with SHA-2 keys.
  
* Undelegated tests should work again.

* There are new and changed messages. If you're using the Web GUI, don't
  forget to reload the message table in the database.


Currently known issues
----------------------

* Several DNSSEC tests need improving and/or re-thinking.

* In some instances, the DNSCheck recursive resolver does not get the same
  result as, for example, BIND, due to ours being less forgiving. If we should
  change the current behavior has not been decided.
  
* Zones with nameservers that do not answer queries for DNSSEC-related records
  when the query packet does not have the DNSSEC flag set will get broken
  results from our DNSSEC tests.
  
* There is an outstanding issue where DNSCheck for at least one domain sends
  some queries to the wrong parent zone's servers.
