Mark us "Safe" from the PHP Vulnerability
By now anyone who follows Internet security, and plenty of people who don’t, have read about the two critical PHP2Shell vulnerabilities published and patched on October 21st.
Read post
A new configuration option, notify-cfg CDS, was added to BIND 9 in version 9.21.17. This enabled Generalized DNS Notifications for CDS and/or CDNSKEY RRset changes, as specified in RFC 9859. ISC GitLab reference #5611
Excerpt from IETF RFC 9859:
The original DNS notifications [RFC1996], which are here referred to as “NOTIFY(SOA)”, are sent from a primary server to a secondary server to minimize the latter’s convergence time to a new version of the zone. This mechanism successfully addresses a significant inefficiency in the original protocol.
Today, similar inefficiencies occur in new use cases, in particular delegation maintenance (DS and NS record updates). Just as in the NOTIFY(SOA) case, a new set of notification types will have a major positive benefit by allowing the DNS infrastructure to completely sidestep these inefficiencies. …
… the notification will speed up processing times by providing the recipient with a hint that a particular child zone has published new CDS, CDNSKEY, and/or CSYNC records.
Matthijs Mekking gave this talk at the DNSSEC Workshop at ICANN 85 introducing the feature: SLIDES, RECORDING.
