BIND 9.1 has shipped. Following my migration to BIND 9 last year, the upgrade to 9.1 is a smaller exercise but worth a short note.
What is new
Three main additions:
Better view support. BIND views — different responses to different clients — were available in 9.0 but were rough. The 9.1 implementation handles edge cases more cleanly. Operators running internal-versus-external split DNS can do so with less friction.
Improved logging. New log categories, finer control over which events are logged where, better integration with syslog. The default verbosity is well-tuned; extracting specific event types is easier.
Performance improvements. The query-handling path has been optimised in several places. The improvement is modest for typical loads, more substantial for very high-load resolvers.
No major architectural changes. 9.1 is a polish release on the 9.0 foundation.
What I have observed
Upgrade procedure: stop named, replace binary, restart. Configuration was unchanged.
Running for two weeks now without issue. Memory usage is slightly lower than 9.0 (about 50MB versus 60MB on my workload). Query performance is unchanged; the resolver had been comfortable on my hardware already.
The view configuration I was experimenting with is now production-ready. I run two views: one for clients on my LAN (which gets full recursion to anywhere), one for external sources (which only gets authoritative responses for zones I serve). The split substantially reduces the public attack surface.
What I am paying attention to
Two things.
Migration of legacy BIND 8 deployments. The Lion worm in March demonstrated the cost of running unpatched BIND 8. The fraction of the internet still on BIND 8 is shrinking but not fast enough. Each compromised BIND 8 host contributes to the substrate of compromised hosts available for further attacks.
The DNSSEC deployment question. BIND 9 supports DNSSEC cryptographic record signing. Almost nobody is using it. The deployment chicken-and-egg problem (resolvers will not validate until zones are signed; zones will not be signed until resolvers validate) continues. By 2003 I expect some specific incident to provide the push to actually deploy.
What I would change about my own setup
Nothing significant. BIND 9.1 is operating cleanly. The configuration is the same as 9.0. The migration was twenty minutes.
For friends running BIND 8: the migration to 9.1 is straightforward. Anyone still on BIND 8 should be planning the migration this quarter.
More as the year develops.