After that queries requiring the KEY or DS records would share the cached values. The sharing point for DNSSEC RR data used to be when it entered the cache, having been validated. In the common case, where only default servers are declared, there is no effective change. The change is to make the limit per server-group, where a server group is the set of servers configured for a particular domain. Queries which are routed by domain to an upstream server which is not responding will build up and trigger the limit, which breaks DNS service for all other domains which could be handled by other servers.

This used to have a global limit, but that has a problem when using different servers for different upstream domains.

Revise resource handling for number of concurrent DNS queries.

Finally, some of the oldest and gnarliest code in dnsmasq has had a significant clean-up. This also applies to DNSSEC-generated queries. It also handles multiple upstream servers for a domain better using the same try/retry algorithms as non domain-specific servers. The change makes multiple addresses associated with a domain work address=//1.2.3.4 address=//5.6.7.8 This should be largely transparent, but it drastically improves performance and reduces memory foot-print when configuring large numbers domains of the form local=// or local=//# Lookup times now grow as log-to-base-2 of the number of domains, rather than greater than linearly, as before.

Major rewrite of the DNS server and domain handling code.

Only under very exceptional circumstances, does the bug manifest itself: see Even when this bug is triggered, all the right things happen, and answers are still returned.

It compounded this error by silently failing to store the process when it did run out of slots. The code checked that at least one free process table slot was available before listening on TCP sockets, but didn’t take into account that more than one TCP connection could arrive, so that check was not sufficient to ensure that there would be slots for all new processes.

Fix bug which caused dnsmasq to lose track of processes forked to handle TCP DNS connections under heavy load.

Handle DHCPREBIND requests in the DHCPv6 server code.

Update embedded dnsmasq DNS server to version 2.86.

As always, please read through the changelog before updating with pihole -up.Īfter a successful beta round, we are excited to announce that the next version(s) of Pi-hole are now available in the main branches! A great big “Thank You” to all those who not only tested the beta, but actively reported back with any issues they found, so that we could fix them before release.Īs a reminder, if you have been testing the beta – to switch back to this release simply run pihole checkout masterĪnd before anyone asks… New tag for docker image will arrive shortly, once it’s been tested! Highlights

Ftl free mac