hickory-resolver

Releases

1. ▸▾0.25.018 Mar 2025Breaking

   This is not an exhaustive list of changes, but here are some of the most impactful breaking changes in this release:

   0.25.0 represents a large release for the Hickory DNS project. Over 14 months since 0.24.0, we've added two new maintainers, divergentdave and marcus0x62, and have addressed many limitations. A team from Ferrous Systems shored up our support for DNSSEC, and we addressed a number of findings from our first security audit.

   Breaking changes

   This is not an exhaustive list of changes, but here are some of the most impactful breaking changes in this release:

   • Configuration for the Hickory DNS server crate has been reworked substantially to be more robust and secure. Most of the code related to the server binary has been moved out of the hickory-server library and into the hickory-dns binary crate.
   • Support for TLS using native-tls or OpenSSL has been removed. We now only provide first-party support for rustls (0.23, for DNS over TLS, HTTP/2, QUIC and HTTP/3). We support ring or aws-lc-rs for cryptographic operations both for DNSSEC and TLS. The dns-over-rustls,dns-over-native-tls, dns-over-openssl, dns-over-https-rustls, dns-over-https, dns-over-quic and dns-over-h3 features have been removed in favor of a set of {tls,https,quic,h3}-{aws-lc-rs,ring} features across our library crates.
   • The synchronous API in the resolver and client crates, which previously provided a thin partial wrapper over the asynchronous API, has been removed. Downstream users will have to migrate to the asynchronous API.
   • Support for the async-std runtime has been removed following the deprecation of the async-std crate by upstream (see their README). The async-std-resolver crate will no longer be updated.
   • The DNSSEC API was reworked to extend coverage to the recursor, add support for NSEC3, and make the API more ergonomic and harder to misuse.
   • Moved the RuntimeProvider API into the proto crate and use it consistently across the project.
   • Name values are now rooted by default in many places, and more consistently maintain their fqdn status.
   • Error types are now exposed directly in the crate roots.
   • Top-level TLS configuration in the resolver crate has moved to the ResolverOpts type. Specific NameServerConfigs should implicitly set up the ALPN protocol appropriate for the DNS protocol.
   • The ResolverOptions fields authentic_data and shuffle_dns_servers were removed. The former field didn't do anything; and should be covered by new DNSSEC API. shuffle_dns_servers functionality has been subsumed into the server_ordering_strategy field.
   • The use of rustls-native-certs via the native-certs feature was replaced with rustls-platform-verifier.
   • The tokio-runtime feature was renamed to tokio.
   • The serde-config feature was renamed to serde.
   • Serializations (and what the new release can deserialize) has changed; data serialized by 0.24 may not deserialize correctly on 0.25, and vice versa.

   Please don't hesitate to file an issue or ask on our Discord server if you have issues upgrading.

   Detailed changes since alpha.5

   • update logo to better for Github by @bluejekyll in #2063
   • add blog post to release notes for Hickory by @bluejekyll in #2064
   • update h3 and h3-quinn by @zh-jq in #2077
   • update to use ring 0.17 by @zh-jq in #2076
   • Bump rustix from 0.37.23 to 0.37.26 by @dependabot in #2078
   • Marcbrevoort cyberhive patch 1 by @bluejekyll in #2088
   • Fix initial vec capacity in NameServerConfigGroup::from_ips_clear by @silverlyra in #2092
   • Add getters for resolver config and options by @hoxxep in #2093
   • Remove generic Error from DnsHandle by @bluejekyll in #2094
   • update test certs for 2023 by @bluejekyll in #2100
   • Support getting and setting the EDNS Z flags by @mattias-p in #2111
   • get(0) to first() and zerocopy package updates to fix clippy and cargo audit errors. by @marcus0x62 in #2121
   • Increase source port entropy in UDP client by @marcus0x62 in #2116
   • Validate response query section by @marcus0x62 in #2118
   • Gate tests on required features by @alexanderkjall in #2114
   • Recursor: make nameserver and record cache sizes configurable by @marcus0x62 in #2117
   • when comparing IP addresses for UDP, only check IP and Port by @bluejekyll in #2124
   • Bailiwick checking for the recursor by @marcus0x62 in #2119
   • Fixup lookup docs by @bluejekyll in #2123
   • Bump actions/cache from 3 to 4 by @dependabot in #2129
   • Update dependencies by @djc in #2112
   • Fix a typo in crate description by @wiktor-k in #2132
   • Only DNSKEY zone keys are allowed to match DS RR by @justahero in #2131
   • Use cargo environment variables for path to executable. by @sjbronner in #2130
   • Add option to specify a restricted set of networks capable of accessing the Hickory DNS server by @bluejekyll in #2126
   • Bump baptiste0928/cargo-install from 2 to 3 by @dependabot in #2135
   • Bump codecov/codecov-action from 3 to 4 by @dependabot in #2136
   • Cleanliness for 1.76 by @bluejekyll in #2143
   • update version for http/h2/h3 by @zh-jq in #2138
   • add getter/setter methods to ClientSubnet by @leshow in #2146
   • fix(proto): fix internal representation of OPT by @esensar in #2151
   • Better DNSSEC proofs by @bluejekyll in #2084
   • feat: add setter methods for Message struct to improve configurability by @situ2001 in #2147
   • Forward hickory-dns's root cert features to hickory-resolver by @hch12907 in #2153
   • Fix formatting issue in crates/proto/src/op/message.rs by @marcus0x62 in #2165
   • Update mio to 0.8.11 to fix RUSTSEC-2024-0019 by @marcus0x62 in #2166
   • Handle shutdown sockets by @dlon in #2171
   • Bump extractions/setup-just from 1 to 2 by @dependabot in #2164
   • Bump http from 1.0.0 to 1.1.0 by @dependabot in #2170
   • Clippy 1.77 + dependency updates by @djc in #2174
   • Update semver-compatible dependencies by @djc in #2177
   • Make hickory_proto::quic::QuicClientStream Clonable by @0xffffharry in #2176
   • error: wrap io::Error in Arc for clone by @cpu in #2181
   • resolver: err for dns-over-rustls w/o roots by @cpu in #2179
   • ignore portions of the README in Oranda site generation by @bluejekyll in #2180
   • SVCB/HTTPS RFC updates, ECH config tweaks by @cpu in #2183
   • Merge 0.24.1 by @bluejekyll in #2185
   • fix(test): update ip of example.com by @situ2001 in #2187
   • update rustls 0.21.11 to fix audit by @bluejekyll in #2189
   • Bump parking_lot from 0.12.1 to 0.12.2 by @dependabot in #2202
   • doc: fix misc typos in md files by @divagant-martian in #2198
   • address new clippy lint assigning-clones by @divagant-martian in #2205
   • Make hickory_proto::h3::H3ClientStream Clonable by @0xffffharry in #2182
   • recursor: respect DO bit in incoming queries by @japaric in #2196
   • recursor: tweaks for security awareness by @djc in #2208
   • Retry tcp on udp io errors by @bluejekyll in #2215
   • recursor: send DS queries to the parent zone by @japaric in #2203
   • Adds deref call in assertion for hickory-client README example by @akappel in #2173
   • cargo: Enable LTO on release build by @jpds in #2141
   • add RFC2931 SIG(0) as supported by @bluejekyll in #2216
   • Remove broken mtls code to fix CI by @djc in #2218
   • ci: pin nightly version by @japaric in #2224
   • import DNSSEC conformance test suite repository by @japaric in #2222
   • Add just recipes to clean leftover containers and networks by @pvdrz in #2232
   • refactor the Resource data structure by @japaric in #2231
   • dns-test: make NameServer's FQDN more stable by @japaric in #2235
   • Apply clippy suggestions for Rust 1.79 by @djc in #2240
   • prepare 0.25-alpha by @bluejekyll in #2242
   • Expose query path for DoH by @Skyxim in #2226
   • DnsLru: cache RRSIG records together with the record they cover by @japaric in #2239
   • Add conformance tests for NSEC3 by @pvdrz in #2238
   • docs: add content from 2183 to changelog by @cpu in #2243
   • fix: make just to compile bind by @sabify in #2248
   • add conformance to CODEOWNERS by @japaric in #2259
   • just: document conformance-* tasks by @japaric in #2266
   • recursor: strip dnssec records on cache hit by @japaric in #2245
   • dns-test: do not run docker network create in parallel by @japaric in #2265
   • DnssecDnsHandle: check RRSIG validity as per RFC4035 by @japaric in #2213
   • NextRandomUdpSocket: fall back to port 0 if no port was found by @Luap99 in #2260
   • CI: also run hickory unit tests when only /conformance changes by @japaric in #2269
   • just: warn when the index is dirty and DNS_TEST_SUBJECT=hickory by @japaric in #2267
   • Recursor::resolve: reject queries with relative domain names by @japaric in #2246
   • add a trust anchor file parser by @japaric in #2257
   • dns-test: use non-deprecated algorithm (RSASHA256) by @japaric in #2258
   • dns-test: make unit tests use the checked out version of this repo by @japaric in #2268
   • Assert status for every NSEC3 test by @pvdrz in #2254
   • improved server binary, added config validation and control over protocols by @sabify in #2247
   • Fix typo by @casonadams in #2272
   • add DNSSEC validation to the recursive resolver by @japaric in #2253
   • test caching of DNSSEC validation and of DNSSEC records by @japaric in #2244
   • Add test to check cache hit with DO bit by @justahero in #2280
   • Refactor start method in Resolver by @justahero in #2281
   • answer with SERVFAIL when DNSSEC validation fails by @japaric in #2286
   • DnssecDnsHandle: do not recurse infinitely when query DS . fails by @japaric in #2271
   • recursor: put tokio::test behind cfg attribute by @japaric in #2291
   • test that DO=1 does not change the outcome of DNSSEC validation by @japaric in #2287
   • test caching of chain of trust link by @japaric in #2289
   • Test invalid signature timestamps in DNSSEC validation by @justahero in #2298
   • DnssecDnsHandle: also update the RRSIG's proof by @japaric in #2293
   • validating recursor: return answer from cache by @japaric in #2297
   • test that answer section is empty on failed DNSSEC validation by @japaric in #2302
   • Adjust timestamps to pass unbound validation result by @justahero in #2303
   • Add method to capture expected number of packets by @justahero in #2278
   • server: empty the answer section when DNSSEC validation fails by @japaric in #2304
   • recursor: fix DNSSEC validation of NS somedomain.com. by @japaric in #2300
   • dns-test: cache target directory across docker build invocations by @japaric in #2305
   • Update bytes to 1.6.1 by @marcus0x62 in #2310
   • Add support for PTR query by @mokeyish in #2308
   • add regression test for #2306 by @japaric in #2309
   • avoid moving self in read_hosts_conf（reading from multiple files） by @mokeyish in #2314
   • Adjust TTL of RRSIG + RR during validation by @justahero in #2311
   • Update OpenSSL to fix security issue by @justahero in #2316
   • Bump MSRV to 1.70 by @djc in #2322
   • Allow to modify a RRSIG record before signing by @justahero in

   Note truncated.