named will now log a warning if a static key is configured for the root zone. [GL #6] When static and managed DNSSEC keys were both configured for the same name, or when a static key was used to configure a trust anchor for the root zone and dnssec-validation was set to the default value of auto, automatic RFC 5011 key rollovers would be disabled. This combination of settings was never intended to work, but there was no check for it in the parser. This has been corrected, and it is now a fatal configuration error. [GL #868] DS and CDS records are now generated with SHA-256 digests only, instead of both SHA-1 and SHA-256. This affects the default output of dnssec-dsfromkey, the dsset files generated by dnssec-signzone, the DS records added to a zone by dnssec-signzone based on keyset files, the CDS records added to a zone by named and dnssec-signzone based on "sync" timing parameters in key files, and the checks performed by dnssec-checkds. JSON-C is now the only supported library for enabling JSON support for BIND statistics. The configure option has been renamed from --with-libjson to --with-json-c. Use PKG_CONFIG_PATH to specify a custom path to the json-c library as the new configure option does not take the library installation path as an optional argument. A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and made default. Old non-default HMAC-SHA based DNS Cookie algorithms have been removed, and only the default AES algorithm is being kept for legacy reasons. This change doesn't have any operational impact in most common scenarios. [GL #605] If you are running multiple DNS Servers (different versions of BIND 9 or DNS server from multiple vendors) responding from the same IP address (anycast or load-balancing scenarios), you'll have to make sure that all the servers are configured with the same DNS Cookie algorithm and same Server Secret for the best performance. The information from the dnssec-signzone and dnssec-verify commands is now printed to standard output. The standard error output is only used to print warnings and errors, and in case the user requests the signed zone to be printed to standard output with -f - option. A new configuration option -q has been added to silence all output on standard output except for the name of the signed zone. DS records included in DNS referral messages can now be validated and cached immediately, reducing the number of queries needed for a DNSSEC validation. [GL #964]