Today we are releasing version 4.0.5 of the PowerDNS Recursor. The most important change is the addition of the KSK-2017, the new root key for DNSSEC, that will be used to sign the root starting October 11th 2017 (read more about the keyroll). If you do DNSSEC validation, upgrading is mandatory to continue to validate DNSSEC after October 11th 2017! Also on the DNSSEC front, Kees Monshouwer added support for validating ed25519 (algorithm 15) signatures when linked against libsodium. Packages supplied by us have this support enabled.

The RPZ module has also seen a steady number of improvements, like support for RPZ wildcard target names and several stability and performance improvements.

The full changelog looks like this:

Additions and Enhancements

Bug fixes

Tarball (sig) is available on the downloads website. Packages for Debian Jessie and Stretch, CentOS 6 and 7 and Ubuntu 14.04, 16.04, 16.10 and 17.04 are uploaded to our repositories.