hickory-net

This point release for the 0.26 release series brings in several bug fixes, and no user-facing changes. Two security reports are addressed:
RUSTSEC-2026-0120 and RUSTSEC-2026-0119.

What's Changed

• net: avoid infinite loop in NSEC3 processing by @djc in #3597
• Limit work expended on name compression (backport) by @divergentdave in #3615

Full Changelog: v0.26.0...v0.26.1

13 months after the release of 0.25.0, we finally have a bigger feature release of Hickory DNS, the suite of DNS libraries and authoritative/recursive name servers written in pure Rust. A lot of work has gone into this release, so we wanted to take a moment to release this before we continue work on deploying the Hickory DNS recursive resolver at Let's Encrypt (and did you see that Hickory is being used in some of Google's Pixel devices?). Because of the ongoing work, we expect that 0.27.0 might happen quite a bit sooner than in 13 months from now.

These release notes describe a number of high-level improvements as well as API changes that are likely to break a larger fraction of our downstream users. Feedback (both on these notes and the release itself) is always welcome in our issue tracker or via our Discord server.

Most of the following notes are broken up by specific components: the server binary and our library crates. However, for this release we've made several changes to the structure of our crates itself:

• Network protocol support has moved out of the hickory-proto crate, into a new hickory-net crate (#3394); this allows the hickory-proto crate to cleanly focus on message encoding and decoding.
• The hickory-client crate has been subsumed into hickory-net, in the client module (#3366). No future releases of the hickory-client crate are expected.
• The hickory-recursor crate has been merged into hickory-resolver (#3370), guarded by a recursor feature which must be enabled explicitly. The recursor implementation was already tightly coupled to the resolver internals, so keeping it separate didn't really make sense.

Additionally, substantial cross-crate changes have been made to improve our error handling:

• More error handling simplification
• proto: split NetError out of ProtoError
• proto: clean up ProtoError
• Be more strict about decode errors
• resolver: remove unnecessary ResolveError wrapper
• Avoid large errors

hickory-dns (the server binary)

• We've added a number of ways to optimize performance via low-level networking configuration:
  • Use SO_REUSEADDR for tcp sockets
  • Allow configuring UDP socket buffer sizes
  • Add SO_REUSEPORT support with configurable UDP socket count
  • More TCP tuning options
• We further extended and reworked our metrics:
  • Additional recursive resolver metrics
  • Minor metrics tidying
  • Initial histogram metrics support
• Miscellaneous changes:
  • Implement RFC 5001 NSID for authoritative server
  • Add server SSLKEYLOGFILE support
  • Add systemd readiness + watchdog support
  • prometheus: enable gzip compression on metrics endpoint
  • Add support for jemalloc + profiling

hickory-server (the library API)

• The Authority trait was renamed to ZoneHandler and simplified to better reflect its usage:
  • Rename Authority to ZoneHandler
  • Simplify ZoneHandler interface
  • Use concrete type for authority lookups
  • Untangle authorities
• Miscellaneous changes:
  • Support host format in blocklist stores
  • Authenticated AXFR policy, TSIG response signing
  • Add metrics for zone lookups, DNS classes and record types

hickory-resolver

We made many improvements to improve correctness and efficiency of both the recursive resolver and the "stub" resolver. In addition, we want to highlight the following changes:

• We substantially changed the high-level resolver and configuration API:
  • Refactor name server configuration
  • Enable validation when trust anchors are configured
  • Introduce ServerGroup type to replace NameServerGroupConfig
  • Configure by name server
  • Tweak high-level API
  • Hide validate option if DNSSEC support is not available
  • Default trust_negative_responses to true
  • Use a single list of servers
  • Make ResolverConfig fields public
  • Simplify ConnectionProvider interface
  • Abstract NS conn/conn config policy
  • Make connection pool track servers
• We improved handling of the system default resolution settings:
  • Trust negative responses from system resolvers by default
  • Retrieve system configuration through system API on Apple platforms
  • Get Android's DNS servers
• We improved the efficiency of the resolver internals:
  • Increase default cache size to 8k
• Miscellaneous changes:
  • Implement RFC 9539 opportunistic encryption
  • Add Ipv6AndIpv4 strategy
  • Add recursor metrics
  • Allow disabling H3 grease, as needed for Cloudflare

hickory-net

We made substantial improvements to DNSSEC validation and our handling of potentially spoofing messages.

• Miscellaneous changes:
  • Stop ignoring response decoding failures for UDP requests
  • Do not resolve private/reserved addresses on public zones
  • Simplify runtime

hickory-proto

• We have made the fields for several core types directly public:
  • Simplify low-level message API
  • Make Record fields public
  • Simplify RData API
  • Change field and method names for Authority section of messages
  • Simplify signing
• We now enable EDNS by default in outgoing messages, increasing the max payload length:
  • Default to enabling EDNS, increase max payload length
  • Make EDNS payload length configurable
• We removed SIG(0) authentication in favor of the more popular TSIG alternative:
  • Remove SIG(0) message authentication
• Miscellaneous changes:
  • Reject QR=0 responses as invalid
  • Reject zero-length data for non-update messages
  • Add support for SMIMEA records
  • Add support for dynamic headers in DoH requests

Details

For more details, review the detailed release notes for our pre-releases:

• Beta 4
• Beta 3
• Beta 2
• Beta 1
• Alpha 1

and these final PRs merged after beta 4:

• proto: reject zero-length data for non-update messages by @djc in #3577
• server: deduplicate response encoding by @djc in #3555
• Disable dig retries when testing cache behavior by @divergentdave in #3590
• Conformance: print communication errors from dig by @divergentdave in #3591

Thanks

Finally, we want to thank everyone who contributed to this release: @bryanlarsen, @billf, @hargut, @ibigbug, @xi0, @steffengy, @james7132, @Thomasdezeeuw, @Kriskras99, @mispp, @conradludgate, @nabijaczleweli, @musicinmybrain, @msrd0, @jmwample, @LAGonauta, @tisonkun, @provokateurin, @lemon-sh, @thomas-zahner, @jpds, @lpraneis, @zachsmith1, @jackboykin, @ZnqbuZ, @Jeidnx, @kn0sys, @matheus23, @benesch, @roblabla and of course our maintainers @cpu, @divergentdave, @marcus0x62 and @djc.

What's Changed

• bin: add SO_REUSEPORT support with configurable UDP socket count by @cpu in #3549
• resolver: move helper function below caller by @djc in #3564
• proto: make Record fields public by @djc in #3557
• proto: simplify text parsing by @djc in #3546
• resolver: reduce log verbosity by @djc in #3572
• Add systemd readiness+watchdog support by @jpds in #3576
• More TCP tuning options, splitting up the confusing CHANNEL_BUFFER_SIZE constant by @cpu in #3578
• prometheus: enable gzip compression on metrics endpoint by @jpds in #3579
• net: refactor in preparation for storing proofs per record set by @djc in #3574
• Upgrade rustls-platform-verifier to 0.7 by @djc in #3581
• chore: Bump verison to beta.4 and ensure pinned verison deps by @matheus23 in #3583
• bin: add support for jemalloc + profiling by @djc in #3585

What's Changed

• resolver: Fix positive_min_ttl not clamping stored record TTLs by @jpds in #3550
• resolver: Clamp TTLs on first response, not just cached responses by @jpds in #3551
• resolver: increase default cache size to 8k by @djc in #3554

What's Changed

• proto: default to enabling EDNS, increase max payload length by @djc in #3498
• add a method that returns number of entries in blocklist zonehandler by @mispp in #3497
• Fix docs.rs doc build by @roblabla in #3500
• net: stop ignoring response decoding failures for UDP requests by @djc in #3499
• bin: use SO_REUSEADDR for tcp sockets by @cpu in #3509
• Be more strict about decode errors by @djc in #3505
• Make EDNS payload length configurable by @divergentdave in #3504
• bin: allow configuring UDP socket buffer sizes by @cpu in #3507
• build(deps): bump rusqlite from 0.38.0 to 0.39.0 by @dependabot[bot] in #3513
• Improve error for recursor zones with invalid roots configuration by @cpu in #3506
• improve access control configuration by @cpu in #3508
• reject QR=0 responses as invalid by @cpu in #3510
• resolver: fix err propagation from NS hostname resolution by @cpu in #3517
• proto: fix access_control IPv6 deny-only bypass by @cpu in #3521
• Fix units of cache hit duration histogram by @divergentdave in #3523
• fix(resolver): try remaining servers on timeout and penalize failed server SRTT by @jpds in #3520
• resolver: fix sort comparator panic with QueryStatistics ordering by @jpds in #3525
• resolver: fix cascading panic when SharedLookup inner future panics by @jpds in #3524
• resolver: shuffle name server list at pool startup by @jpds in #3530
• resolver: record SRTT for servers cancelled during parallel races by @jpds in #3531
• resolver: enforce end-to-end timeout budget in NameServerPool by @jpds in #3527
• resolver: add cache metrics by @benesch in #3522
• net: don't error on UDP responses with the wrong ID by @djc in #3526
• Simplify low-level message API by @djc in #3511
• net: use async for h3 Cloudflare test by @djc in #3539
• recursor: add criterion benchmarks for cold and warm resolution by @jpds in #3512
• net/xfer: fixup DnsExchange rustdoc by @cpu in #3540
• recursor micro-optimizations by @cpu in #3541
• proto: optimize Name hashing and label comparison by @cpu in #3544
• Simplify RData API by @msrd0 in #3542

What's Changed

• Fix AdGuard IP address in test by @divergentdave in #3028
• Add to MessageResponse documentation by @divergentdave in #3031
• resolver: clean up Windows-only warnings by @djc in #3032
• resolver: use a single list of servers by @djc in #3027
• resolver: simplify ConnectionProvider interface by @djc in #3033
• support host format in blocklist store by @mispp in #3035
• Replace DnsLru with a response cache by @divergentdave in #3043
• Allow disabling H3 grease, as needed for cloudflare by @steffengy in #3040
• resolver: introduce ServerGroup type to replace NameServerGroupConfig by @djc in #3029
• preserve_rdata fuzzer improvements by @divergentdave in #3047
• util: fix some issues with recurse by @djc in #3046
• client: remove orphaned constants by @djc in #3050
• server: blocklist tweaks by @djc in #3044
• resolver: response cache tweaks by @djc in #3051
• resolver: configure by name server by @djc in #3052
• server: remove deprecated ZoneType enum variants by @cpu in #3061
• server/authority: simplify Catalog::update req verify by @cpu in #3062
• fix some clippy::uninlined_format_args findings by @cpu in #3063
• resolver: tweak high-level API by @djc in #3059
• ci: change log level to TRACE by @djc in #3065
• server/authority: remove LookupError::is_refused() by @cpu in #3066
• hickory-dns bin & server crate comment tidying by @cpu in #3071
• hickory-dns: implement RFC 5001 NSID for auth. server by @cpu in #3070
• MSRV related follow-ups from NSID support by @cpu in #3080
• server: untangle authorities by @djc in #3074
• server: clean up Request construction by @djc in #3073
• server: clean up InMemoryAuthority::lookup() a bit by @djc in #3078
• #3060 preparation work by @cpu in #3081
• DNSSEC validation: find zone cut with NS queries by @divergentdave in #3075
• server: extract protocol-specific code by @djc in #3079
• Authenticated AXFR policy, TSIG response signing by @cpu in #3060
• resolver: make MAX_TTL public by @Kriskras99 in #3088
• proto: do not attempt recursive DS lookup in verify_default_rrset by @marcus0x62 in #3092
• resolver: hide validate option if DNSSEC support is not available by @djc in #3091
• resolver: default trust_negative_responses to true by @djc in #3085
• server: use concrete type for authority lookups by @djc in #3086
• resolver: trust negative responses from system resolvers by default by @djc in #3095
• fuzz: ignore NotAllRecordsWritten errors by @djc in #3099
• util: accept zone only where needed by @djc in #3098
• Update socket2 to v0.6 by @Thomasdezeeuw in #3100
• Customize Duration serde format in ResolverOpts by @divergentdave in #3101
• Add metrics for zone lookups, DNS classes and record types by @hargut in #3030
• Add negative tests for NSEC validation by @divergentdave in #3103
• Use retain() instead of calling remove() in a loop by @divergentdave in #3105
• Change field and method names for Authority section of messages by @divergentdave in #3106
• Add accessor to AuthLookup by @divergentdave in #3108
• resolver: make ResolverConfig fields public by @djc in #3112
• Bump h2 dependency by @jmwample in #3115
• Fix various feature-dependent unused code warnings by @divergentdave in #3104
• Plumb recursive response message by @divergentdave in #3109
• Remove 'EDNS section' from documentation by @divergentdave in #3114
• Fix client integration tests by @divergentdave in #3118
• proto: improve DNSSEC interfaces by @djc in #3113
• Rename build info metric, revise metric descriptions by @divergentdave in #3122
• Fix documentation of DNS_TEST_SUBJECT by @divergentdave in #3124
• Recursor: add regression test for NS queries by @divergentdave in #3127
• Add test of DNSSEC validation with missing SOA RR by @divergentdave in #3129
• resolver: improve logging for name server connection failure by @djc in #3133
• Add recursor metrics by @divergentdave in #3123
• Remove deprecated API by @djc in #3132
• fix(test): use __dnssec feature in resolver test by @billf in #3126
• resolver: use cloudflare.com instead of example.com for DNSSEC test by @djc in #3138
• Log records in flaky tests by @divergentdave in #3135
• Ignore RRSIGs that claim NSEC/NSEC3 wildcards by @divergentdave in #3130
• Improve DNSSEC APIs by @djc in #3131
• FutureExt::now_or_never() -> JoinSet::try_join_next() by @cpu in #3136
• Add extended-dns-error.com tests with no DNSSEC validation by @divergentdave in #3144
• Simplify and replace future combinators by @divergentdave in #3134
• Update dependencies by @djc in #3145
• Add wildcard no data tests by @divergentdave in #3147
• ProtoErrorKind cleanup by @divergentdave in #3148
• util: tidy logging, add trace level support, fix library logging by @cpu in #3152
• Upgrade rustls-platform-verifier to 0.6 by @djc in #3150
• Move error response codes to other error variants by @divergentdave in #3149
• Fix validation of negative responses from insecure zones by @divergentdave in #3141
• Store validated responses in a separate cache by @divergentdave in #3155
• Result handling cleanup by @divergentdave in #3161
• Add recursor conformance tests with CNAMEs by @divergentdave in #3154
• server: change TsigKeyConfig::key_file type to be PathBuf by @djc in #3162
• Add cpu as a code owner by @djc in #3163
• Recursor: better handling of cached referral responses by @divergentdave in #3156
• conformance: update dns-test README for explore.rs by @cpu in #3168
• dns-test: generalize hickory dnssec feature by @cpu in #3167
• Blocklist client logging by @marcus0x62 in #3164
• Add integration tests based on RFC 4592 by @divergentdave in #3170
• Additional tests of NSEC and wildcard validation by @divergentdave in #3172
• dns-test: add support for powerdns recursor/forwarder/authoritative servers by @cpu in #3166
• Blocklist metrics by @marcus0x62 in #3176
• fix nightly unused_parens warns, tidy retry_dns_handle.rs by @cpu in #3181
• dns-test: add DoT support to authoritative DNS servers by @cpu in #3177
• Remove unused files by @divergentdave in #3183
• Fix CNAME chasing by @divergentdave in #3179
• RetryDnsHandle tweaks by @djc in #3185
• resolver: remove needless lifetime by @kn0sys in #3186
• Add separate Authority method for AXFR by @divergentdave in #3178
• Simplify objects in build_forwarded_response() by @divergentdave in #3187
• add server SSLKEYLOGFILE support, extend dns-test TShark features by @cpu in #3184
• dns-test: use CertifiedIssuer to simplify Pki by @djc in #3197
• Send minimal responses to queries with QTYPE=ANY by @divergentdave in #3182
• Tidy up server crate SSL_KEYLOG_FILE configuration by @cpu in #3199
• dns-test: TShark tweaks by @djc in #3201
• Make DnsHandle require the std feature by @divergentdave in #3200
• Remove unnecessary #[cfg] attributes by @divergentdave in #3205
• Fix NSEC validation by @divergentdave in #3175
• NSEC verification tweaks by @djc in #3208
• udp client: compare req and res IP in canonical before rejecting the response by @ibigbug in #3207
• Add associated type to DnsHandle for runtime by @divergentdave in #3206
• Improved response filtering by @marcus0x62 in #3217
• Reduce number of workspaces by @djc in #3220
• Intermediate access to the current time via traits by @divergentdave in #3158
• Clean up conditional compilation by @divergentdave in #3224
• Strict check for SOA RR at zone apex by @divergentdave in #3223
• Pass NotAuth error through catalog by @divergentdave in #3222
• Small ResolverOpts tidying by @cpu in #3225
• Change response code for AXFR in SqliteAuthority by @divergentdave in #3235
• Fix commented-out tests by @divergentdave in #3236
• server: simplify time handling by @djc in #3234
• conformance: drop conformance tests against ring from CI by @djc in #3237
• Parallel conformance by @djc in #3238
• Use stable rust in cargo-workspaces fallback build by @divergentdave in

Note truncated.