Newer changes


This is the development branch of MaraDNS.


This is the stable branch of MaraDNS.
Note: MaraDNS has always used random query IDs and source port randomization generated using a cryptographically strong random number generator and was never vulnerable to the "new" DNS spoofing attack.



This is the previous stable branch of MaraDNS; only critical bug fixes are applied to this branch.
Note: MaraDNS has always used random query IDs and source port randomization generated using a cryptographically strong random number generator and was never vulnerable to the "new" DNS spoofing attack.



This is a development release of MaraDNS.


This is a stable release of MaraDNS.


This is a stable (soon to be "previous stable") release of MaraDNS. This will also be the last MaraDNS release to include RPM files, but 1.3 releases always have an up-to-date .spec file.


This is a development release of MaraDNS.


This is a beta testing release of MaraDNS.


This is a development release of MaraDNS.


This is a beta testing release of MaraDNS.


This is a development release of MaraDNS, and a new branch of MaraDNS

(1.3.07 changes are limited to bugfixes, new SQA tests, and documentation changes, and Mr. Sarton is making a lot of positive contributions improving IPV6 performance that I can't add to the 1.3.07 branch)



This is a beta testing release of MaraDNS.


This is a legacy release of MaraDNS.


This is a stable release of MaraDNS.


This is a beta testing release of MaraDNS.


This is a stable bugfix-only release of MaraDNS. All of these bug fixes are backports of bugs fixed in the 1.3 branch.


This is a beta testing release of MaraDNS.


This is a beta testing release of MaraDNS.


This is a beta testing release of MaraDNS.


This is a testing release of MaraDNS.


This is a testing release of MaraDNS.


This is a stable release of MaraDNS.


This is a testing release of MaraDNS.



This is a legacy release of MaraDNS



This is a stable release of MaraDNS



This is a testing release of MaraDNS.



This is a testing release of MaraDNS.



This is a testing release of MaraDNS.



This is a stable release of MaraDNS.



This is a stable release of MaraDNS.



This is a stable release of MaraDNS.



This is a testing release of MaraDNS.















Backport of MaraDNS 1.2.09 fix to legacy 1.0 branch













This is an update for the 1.0 legacy branch of MaraDNS (2006.04.07)


Unless there is demand from MaraDNS' users, this will be the last release for the legacy 1.2.03 branch of MaraDNS. (2006.04.07)







maradns-1.2.06: This is a testing (possibly unstable) release of MaraDNS.





This is a testing (possibly unstable) release of MaraDNS.





This is a testing (potentially unstable) release of MaraDNS.






maradns-1.2.02: This is a beta-test potentially unstable release, since the changes are significant enough to warrant full testing before declaring this as stable as previous 1.2 releases of MaraDNS.



Older changes


This is a bugfix release for the legacy 1.0 branch of MaraDNS. (2005.12.31)


This is the new stable release of MaraDNS, which is an update of the 1.0 branch. The 1.0 branch will be maintained for standard bugfixes until December 21, 2007; critical security fixes, should they occur, will be applied to the 1.0 branch until December 21, 2010.

Here are the changes from 1.1.91:



This is the second release candidate for MaraDNS 1.2.

Here are the changes from 1.1.90:



This is the first release candidate of MaraDNS 1.2. Should no one report any problems with this release, this will be released, unchanged, as MaraDNS 1.2.00 on December 21.

Here are the changes from 1.1.61:









































This release is the last 1.1.x release which adds new features to MaraDNS. Until MaraDNS 1.2.00 is release, the only changes will be documentation updates and bugfixes.







Hotfix: RR rotation now works again.


Two patches by Albert Lee that improve Mara's stability.


















This release improves how MaraDNS' recursive resolver parses packets so that Mara can interoperate better with some stub resolvers that don't bother looking past the header of a DNS packet.



This release forward-ports the improvments for MaraDNS 1.0.27 and MaraDNS 1.0.28 in to the 1.1 branch. (2005.05.06)


The reason why MaraDNS' recursive resolver has been freezing up is because of a bug in the Linux kernel that the kernel developers are not interested in resolving. I would like to thank Albert Lee for providing a patch which resolves this issue.











Changes from 1.0.25: (2005.03.25)


Changes from 1.1.30: (2005.03.25)


Changes from 1.1.29: (2005.03.16)


Changes from 1.0.24: (2005.03.16)


Changes from 1.1.28: (2005.03.05)


Changes from 1.1.27: (2005.02.26)


Changes from 1.1.26: (2005.02.24)


Changes from 1.1.25: (2005.02.23)


Changes from 1.1.24: (2005.02.20)


Changes from 1.1.23: (2005.02.19)


Changes from 1.1.22: (2005.02.16)


Changes from 1.0.23: (2005.02.15)


Note: This revison changes the format of csv2 zone files from 1.1.21; this will be the last incompatible change to csv2 zone files done. All future changes will be backwards compatible with csv2 zone files. (2004.06.30)




(Release 1.1.19 skipped because that was an accidental release I did last October) (2004.06.03)


This is a merge of the features present in MaraDNS 1.0.23 but not in 1.1.17 in to the 1.1.xx branch. Additionally, I have some ideas for a new zone file format in doc/en/misc (more like, I have a full definition of a finite state machine complete with psudo-code for processing of everything in this new proposed zone file format). Compiles, but I don't know if this runs.



Changes from 1.0.22: (2004.05.28)


Changes from 1.0.21: (2004.05.25)


This is MaraDNS 1.0.20 with a patch that solves an error one user reported with the parsing of zone files.



This is MaraDNS 1.0.18 with a patch to allow to resolve again. This is the "no frills, just stay stable" branch of MaraDNS.



This is simply a new release which indicates my decision to completely rewrite the recursive portion of MaraDNS. The old recursive code is removed; I hope to have time to work on the new recursive code soon.



This is a test release which addresses a number of issues people on the list have brought up: (2003.08.03)


Recursive queries now work again; fixed a place which was using a 32-bit value to get a timestamp, when the code in question should have used a josa_timestamp (64-bit) value.

Additionally, it is now possible to use this program as a non-root user again.



Cleaned up and fixed a bug in the MaraDNS startup script. Now, the only prorcesses that will be killed will be bona fide MaraDNS processes.



Strnlen seems to not be a portable call after all (the BSDs don't have it); this version has a special js_strnlen call to make up for this.



This is MaraDNS 1.0.15 declared "stable" (well, as stable as 1.0.13). The only change from 1.0.15 is more debugging information in case an unreproducable bug which one user reported pops up again.



This is MaraDNS 1.0.14 with a good deal more stress testing done to the recursive resolver. There does not appear to be any obvious memory leaks; nor are there any stability issues with this release of MaraDNS. That said, I am, at present, marking the release "beta" until there is more field testing of the release.



This is not a production release of MaraDNS. This is a beta-test release of MaraDNS which has the ptr-over-cname fix from the 1.1.xx branch backported to the 1.0.xx branch. In addition, the code has been modified to no longer use strlen().

Use this code at your own risk. While I have stress-tested this code for stability, this code has not been field tested yet.

That said, it does fix the long-standing bug with correctly resolving PTR records which are CNAME referrals. I want to see some people help me beta-test this, so that I can make a more general release of this bugfix available.



This release of MaraDNS is dedicated to the seven brave astronauts who died this morning on the Columbia space shuttle: These people died expanding the boundaries of humanity's next frontier; may their deaths not be in vain and may humanity eventually conquer space.

This is MaraDNS 1.0.12 with a one-line bugfix for a bug the last release of MaraDNS introduced. This only matters for people who have zonefiles with no records in them (besides the SOA and NS records for the domain head).



D Richard Felker III, who knows more about the arcane mysteries of UNIX pipes than myself, showed me how to get duende to catch the stuff sent to standard error also.

Duende's manual page has been proffread and updated.



I have given up, for now, on trying to catch both stdout and stderr.


The daemonizing helper has been renamed 'duende' (Spanish for 'daemon', consistant with the Spanish theme MaraDNS has, it is said like 'dwen-deh'), and now sets up a second child process which syslog()s all of maradns' various messages. Also added new timestamp format with no timestamp whatsoever to eliminate redundant timestamp when using duende helper.



MaraDNS now has a daemonizing helper which makes MaraDNS a daemon, then stays around. If either the daemonizing helper or MaraDNS (even MaraDNS 1.0.xx) gets a HUP signal, MaraDNS is restarted. If either process gets a TERM or an INT signal, both processes exit. If MaraDNS exits for any other reason besides a HUP signal, the daemonizer restarts MaraDNS.



MaraDNS now has her own timestamp code which should get rid of any Y2038 problems; on systems with 32-bit time_t, the problems are pushed forward to 2112 (and can be pushed forward indefinitely by changing only two magic constants and recompiling). Note: This means the code only works on systems with an int64_t; are there any significant Unix systems deployed which people may wish to use Mara on without int64 support at this point?



MaraDNS has support for DNS record resurrection; this means that she can now use expired records if no DNS server can be contacted for a given host name



MaraDNS with the following seven patches applied: (2003.01.15)


MaraDNS is now able to bind to multiple IP addresses. In addition, I have set up a signal handler so that MaraDNS can exit with a return code of 8 when she gets a HUP signal.

The way MaraDNS binds to multiple IP addresses is by having a socket for each IP address, and a select() call which determines which socket someone connected to. Since the select() has a timeout, I was able to set up the HUP signal handler to only change a global variable.

Proper HUP signal handling will be handled by a daemonizer wrapper, which I will write next.



Some improvments to DNS-over-TCP: (2003.01.10)


It is now possible to use zoneserver to forward TCP DNS queries to a UDP DNS server; this gives MaraDNS full TCP DNS support.



Not extensively tested, but following CNAMEs to PTR records now works.



This release changes the decompressor so that it works with packets which some zoneservers with large zone files generate.

There is also some minor revisions to the documentation.



This release fixes a bug with the RP definition so that the decompressor can accept a DNS packet with this RR type. In other words, this release resolves the problem Danny saw.

In addition, I have done some documentation clean-up, fixing the problems that Christian saw in the documentation; the most significant change is that the root servers for various root server networks have been updated.



This release backports the 1.1.06 improvments to the 1.0.xx branch of MaraDNS.



This realease updates the FAQ, some other information, and has some minor cleanups performed to the code.



This release has the same decompression patch which the 1.0.08 release has. In addition, this release has the test_zoneserver and test_getzone tools, just in case anyone ever sees problems with getzone again.



The release fixes the problems which getzone which Marc Schneiders and Nikos Mavroyanopoulos reported. I would like to thank both people for reporting these problems.

The problems were caused by the fact that the new decompression code did not expect the kind of packets which zoneserver generate; I have patched the new decompression code.



This release incorporates TTL aging, and Jonathan's code which makes this run as a Win9x service (note: BSD copyrighted code with the obnoxious advertising clause; we may have to do something about that before this becomes stable code)



I would like to thank Scott Cooper for working hard to find the cause of a bothersome crash which people have been reporting for about a month. This release, hopefully, fixes the crashing problem once and for all.

In addition, I have put back all of the improvments to the authoritative half which MaraDNS between 0.9.06 and 1.0.05 had; this version undoes the reverting I did for 1.0.06 (which I only did because problems started popping up two days before a two-week vacation I had in México).



Johan is seeing stability problems with MaraDNS' authoritative half which MaraDNS 0.9.06 does not have; this patch essentially reverts the authoritative half to what MaraDNS 0.9.06 had.

This hopefully fixes the stability problems; I am alas in a position to properly test this.



Simple one-line change which allows MaraDNS to compile on Cygwin. Calling this release a "stable" release.



The following improvments over MaraDNS 1.1.01: (2002.07.18)


MaraDNS 1.0.03 with the following patches: (2002.07.14)


The first (real) release of the new development tree. This is MaraDNS 1.0.02 with a new license (simple BSD-style license which will hopefully attract developers scared off by the "Public Domain opens you up to lawsuits" FUD) and a newly rewritten compression engine.



Franky's second release. This contains the following improvements: (2002.07.12)


This is a release of my own. This 1.0.01 with the following changes: (2002.06.30)


This is Franky's first release. Mainly, some more minor memory leaks plugged.

The only changes I made were some touch ups to the documentation, and added a copy of Franky's GPG key signed with the MaraDNS signing key.



Now that 1.0.00 is released, I am deprecating the 0.5.xx branch. The only updates to this branch will be to fix bugs worth disclosing on Bugtraq. In other words, security bugs.

If anyone wants to maintain this branch of MaraDNS, let me know.

This release back ports some cleanup I did with dns/Queries.c which also applies to the 0.5.xx branch.


maradns-1.0.00: (released as close to 2002's solstice as possible)

It's here. Happy solstice everyone!

MaraDNS 0.9.92 with the following patches:


maradns-0.9.92: (1.0 release candidate 2)

MaraDNS 0.9.91 with the following patches:


maradns-0.9.91: (1.0 release candidate 1)

MaraDNS 0.9.39 with the following patches:



MaraDNS 0.9.38 with the following patches:



Added code to check the pthread locking status and to exit if it doesn't return a sucessful exit code.

Removed timestamp format which allows us to see the PID; this was only needed for debugging purposes.

Added comment in the MaraDNS source explaining why 200 is a reasonable maximum number of threads; that is about how many simutanious threads the underlying pthread library can handle.



This is MaraDNS 0.9.36 with the following patches:

Also: Minor doc change (to document the new timestamp format); updated RPM spec, changelog, and download page



The new decompression code now works. Enabling it so people can test it.



Improved RPM spec files

The new decompression code is finished, but is not fully debugged yet (so it is disabled for this release).

Code cleanups which should resolve the infinite loops Franky is seeing



Yet another debug release; numerous small bug fixes and cleanups. MaraDNS now builds correctly when the locale of outputted messages is set to Spanish or German again. A bug where MaraDNS would crash in a certain very unusual case has been fixed.



Another debug release; numerous small bug fixes. The most notable is the plugging of what appears to be the last memory leak in the recursive code; hopefully all I have to do for 1.0.00 at this point is the new decompression code and the release candidates.



Another debug release; the code which keeps track of unallocated memory has been redone. Now memory leak tracking causes a minimum of slowdown when running MaraDNS; and the code works again.

In addition, some minor touchups have been done to the code.



Begin work on new decompression code (still using old decompression code until new code is complete)

Fixing open socket leaks in recursive code, and case-sensitivity issues in the askmara code.



Another bug fix release: Fixed bug where RRs with obscenely long TTLs would "wrap around" and end up having a negative TTL (causing the record to be promptly erased from the cache). Now the maximum TTL is two years long.

Added a little more in the way of debugging messages to try to get to the bottom of the temporary freeze-ups that Franky is seeing.



Bug fix release: Fix bug where hosts that were in bailiwick were, at times, rejected as being out of bailiwick.



Added new level of verbosity, 4, which records every time we add or remove a record from the cache



timestamp_type feature added; it is now easy for people to add new timestamp types; this seems to be a popular request ever since MaraDNS had added timestamps.



Backport of fixes to compression code to the 0.5.xx branch.



Hot fix: The compression code was completely broken in MaraDNS 0.9.25 because I accidently made an integer which needs to be signed unsigned. Fixed.



Bug fix: I finally have gotten to the bottom of the compression problems MaraDNS was having with; this release fixes the problems, hopefully once and for all.

I also have a document which describes some of the function calls the new decompression code will have.



Bug fixes:

I have begun work on the new decompressor; however no changes have been made to the actual compression code yet. However, there are now documents that specify how the new decompression will work and header files which the new decompression code will use.



Bug fix: The mara.startup script now points to the same file location as the default install.location. Note that the startup script needs to be changed if moving the install location.

Updated spec and patch file to build RPM for the current MaraDNS build; it has been too long since the last RPM release.

Trivia: Cinco de Mayo celebrates a battle that Mexico won in 1862 in Puebla, Mexico (I visited the site of the battle several times when I was down there; it is a beautiful eucalyptus forest, having a beautiful fountain and planetarium) against the French. As it turned out, the French won the war, but Mexico won that one battle, which has been celebrated since then. Also, with the exception of Puebla, Cinco de Mayo is not a big holiday in Mexico; only in the US.

(2002.05.05; Cinco de Mayo)


Created list of issues to be resolved before the 1.0 release of MaraDNS; once these are done, I will start a 0.99.x branch; which I will publically announce.

Added kludge to work around unreproducable problems where the compressor can not always compress a DNS packet

Added link to glassary entries in the tutorial every time the tutorial intoduces a new term.



Fixed bug where the minimum TTL for CNAME entires could not be separately set.

Added stub resolver which generates unix timestamps as bogus A records; used for testing.

Added FAQ entry about MaraDNS' time stamp format.



Changed udperror so that it will tell us from where udperror was called; this will hopefully help me fix the problems MaraDNS is having.

Added time stamp to some logged requests and added source IP logging.

Added the ability for a remote query to get MaraDNS' internal timestamp; this is only enabled at obscenely high levels of debug_msg_level, since it is a security risk (there are attacks which are more effective if we know the target's clock value).

Minimum TTL and Minimum TTL for CNAME records is now user-customizable.



Added download.html to web pages which are converted here; this allows the pages which change most frequently on to be changed offline.

Added FAQ Q&A about a problem that someone was having; hopefully the next user with the problem will be able to use this information.

Added incomplete ej2dbk converter which converts from ej to docbook. This is incomplete; after MaraDNS 1.0 I will add code which closes open tags and what not so the generated docbook is 100% legal.



Fixed a bug in askmara where non-ASCII characters were not properly replaced by escape sequences.

Updated EJ documentation tools so that they can now generate webpages in the same format as the web pages on



Added a minor new feature (since it was trivial to add, and since it is a feature which greatly expands the functionality that MaraDNS has): upstream_servers. This allows MaraDNS to be used to contact other recursive servers when run in recursive mode.

Further bugfixing and revision of the debug.hostname tool; it now will not get stuck in endless loops trying to resolve a given hostname.



Converted encoding of all files in the MaraDNS source tree from ISO 8859-1 to UTF-8 (with the exception of one file in the utf8 directory which is supposed to be ISO 8859-1 data). Fixed EJ tools so that they can work on a current (as of early 2002; RedHat 7.2) Linux system using the UTF-8 encoding without undue hassle.

Fixed bug in debug.hostname where it would not resolve host names in certain circumstances.



Added '-n' option to askmara so askmara can send the same kinds of DNS queries that recursive DNS servers send out (DNS queries that do not ask for recursion)

Fixed bug where 'make install' would overwrite /etc/rc.d/init.d/maradns

Changed maxprocs limit to 200 and made it so exceeding maxprocs does not cause MaraDNS to stop; instead maxprocs is reset to 200.



Rewrote debug.hostname tool; this will allow me to set up the testbed to find the more obscure MaraDNS bugs.



Fixed bug where debug_msg_level could only be changed if recursion was enabled.

Changed stress testing simulation to simulate network lag in processing DNS replies.

Made maxprocs have a hard limit of 100; making maxprocs have a value of 400 results in MaraDNS hanging on Linux systems.



Cleanups performed so that all files to be audited to be compiled with -Wall enabled without generating any warnings.

Fixed ej2txt so that it no longer generates utf-8 quotes.



Fixed bug where CNAME records obtained from the cache would not work with stub resolvers, since the code changed the question in the question section of the reply.

'make debug' now works again.



Fixed bug of case where there is a CNAME record, and something happened when trying to get an A record for the CNAME record. Previously, MaraDNS would think the CNAME record had no A record until the CNAME record was purged from the cache. Now, MaraDNS is smart enough to store CNAME records with an A record of "a 'no such host' reply was found when we looked for an A record"; and CNAME records without any corresponding A record only stay in the cache for 30 seconds.

If data is already in the cache for a given record, and the data has not expired, then there is no need to spawn a thread to process the record; now MaraDNS no longer does this. This should result in greater stability and less memory usage, since many operating systems do threads poorly.

askmara now can have a user-defined timeout

compile flags changed from -g to -O2



Added data_structures.ej document, which describes the internal data structures that MaraDNS uses.

Updated the mararc man page to describe the new debug_msg_level variable

Added files needed to make MaraDNS RPM files in the build/ directory.



Fixed another bug in the ej2man script; it now correctly zaps blockquotes inside ul.../ul lists.

Made changelog an ej-compatible document; this allows the changelog to be an ASCII text file instead of an HTML file which a lot of UNIX-heads will prefer.

Verified that MaraDNS 0.9.07 compiles on Darwin (a.k.a. Mac OS X) "out of the box"; this means that MaraDNS now compiles "out of the box" on Solaris; Linux; and Darwin. It also should compile on Cygwin; alas I do not have a working cygwin setup to verify this on. Between these four OSes, we cover all of the major flavors of UNIX: Linux is a little of everything; Solaris is a "System V" UNIX; Darwin is a BSD UNIX clone; and Cygwin is a pure POSIX implementation.



Added new runtime parameter which can be seen when debug messages are enabled: The number of elements in the DNS cache.

Added Makefile template which is a generate Makefile for systems which do not have flock() support; make this Makefile the default Makefile (instead of the Linux Makefile).



Fixed bug in maradns startup script where the script would not correctly restart the MaraDNS processes.

New mararc parameter added: debug_msg_level; this sets the level of information we can get about a running MaraDNS process by sending special DNS queries to MaraDNS.



Revamping of the build process; placing most build-related files in a directory named "build"; MaraDNS now compiles and installs cleanly on Solaris; MaraDNS now has a system startup script which MaraDNS invokes at system startup time.



Another documentation fix. Added new EJ tag: DTWIDTH

This version now compiles on Solaris; and should compile on Darwin.



Integrated Christian's spelling corrections and German translations in to the MaraDNS documentation.

Minor bugfixes with the ej2man script.



Document reorganization: MaraDNS now uses a new document format, EJ (which I created myself for MaraDNS documentation usage), which can be converted in to HTML documents, text documents, or in to man page sources. By having a stramlined documentation format, MaraDNS' documentation will be easier to manage, and easier to translate.

Since the ej format allows other files to be embedded in documents, this eliminates having to revise multiple versions of the same document



Backporting of compression security patch to the MaraDNS 0.5.xx branch.



Fixed security problem with the compression code which I found when performing an audit on the code. Other cleanup of the compression code.

Updated the French documentation.

Added some more information to the MaraDNS tutorial.

Added (currently untested) Darwin (a.k.a. MacOS X) support.



Plugged some memory leaks in the recursive code.

Added Thomas Seyrat's French translation of the documentation

Completed the tutorial

Fixed bug where the zoneserver needed the mararc file specified to start.

Updated documentation



OK, so I was wrong about the first post-0.8.99 release being MaraDNS 0.9.00.

This is simply MaraDNS 0.8.99 with a 2-line patch which fixes a problem where MaraDNS 0.8.99 would crash.



Since I found a some security problems when working on the MaraDNS-0.9.00 release, I am making this release available which appears to addresses the security problems.

Changes since 0.8.35:

I have changed the version number to maradns-0.8.99 to reflect the fact that the next release will almost certaintly be MaraDNS 0.9.00.



Made the stress tests in sqa/testbed more extensive; they now crash recursive MaraDNS versions up to and including 0.8.33.

Found and plugged some memory leaks that MaraDNS had.

Verified that MaraDNS can handle the stress tests--MaraDNS was able to handle 80.000 queries without crashing, and without growing after 10.000 or so queries were processed.



Found and removed another crash-inducing bug.

Modified askmara so that it generates somewhat csv1-compatible output. Also modified the debug.hostname tool so that it can handle the new askmara output.



Yipee! No, I'm not talking about the fact that the evil Taliban are no longer in control of Kabul. I am talking about the fact that I found and removed another crasher bug in MaraDNS.

I hope that this is the last crasher bug. Time to cross my fingers.



This is the third beta test candidate for the recursive MaraDNS, since people are reporting serious stability problems with MaraDNS 0.8.30 and MaraDNS 0.8.31. While I am unable to reporduce the problems offline, I was able to reproduce the problem online (but only intermittently), and found some iffy-looking code which may be the root of the problem.

This program passes all offline stress tests.

Also added an entry to the FAQ which answers an unrelated question posted to the mailing list, and added the changelog to the list of files placed in the MaraDNS doc directory when a 'make install' is performed.



This is the second beta test candidate for the recursive MaraDNS, since I found some bugs after releasing MaraDNS 0.8.30. See the release notes for MaraDNS 0.8.30 for more on the beta starus of MaraDNS.

Looking through the source code of the revamped hash structure, I found a routine which was not revamped. This would cause a bug in the case of having two or more zone files which happen to hash to the same value--only one of the zone files would load. Fixed. I also deleted some routines which were based on the old hash structure.

I have modified MaraDNS so the csv1 hash no longer needs to be initialized, since the csv1 hash does nothing but waste memory in recursive-only MaraDNS configurations.

I have added another parameter: timeout_seconds, which is how long to wait for a remote DNS server to reply. This is mainly useful for slow networks which need more than two seconds to get a reply from a DNS server. Note that the larger this is, the slower MaraDNS answers queries when a DNS server doesn't respond to DNS requests.

In addition, I have begun work on the tutorial, which currently describes how to use MaraDNS in recursive mode, and gives an overview of DNS.



This is a beta test candidate for the recursive version of MaraDNS. Which means that the only changes I will make between now and the first beta release are essential bug fixes (e.g. bugs not mentioned in the man page), and a basic DNS tutorial, since I have received two emails of the form "I don't know how to do this DNS stuff, and could use some help".

The bad news is that, because of the excess of greedy lawyers in the US, I have added the legal disclaimer to all of the man pages for MaraDNS, and, in addition, the legal disclaimer appears when MaraDNS is started.

The good news is that it is possible to have MaraDNS not show the legal disclaimer when opening up; MaraDNS tells you how to do this when showing the disclaimer.

The better news is that I have done a major revamping of the MaraHash structure. This structure is a structure that can both handle records being added, and being removed from the hash. MaraDNS, as far as I can tell from my offline tests, is now a great deal more stable as a result.

In addition, I found another memory leak in the recursive code, which I have plugged.

I have also performed some more documentation touch-ups.



OK, this is a "band-aid" release of MaraDNS. As I was debugging the problem with MaraDNS crashing with the new custodian, I discovered that the hash code is fundamentally broken. Hence, I need to a major revamp to the hash code. In short, the hash needs to have each hash spot point to a linked list of elements.

In the meantime, I performed a band-aid fix to the hash that, while not fixing the problem, makes the problem slightly less bothersome. This is an interim release until I can really fix the problem this weekend.

Updated the FAQ to reflect the slightly changed procedure for joinging the MaraDNS mailing list ("subscribe" now has to be in the subject line when one wants to join the list).



I fixed a bug in the fila-handling code where chains of records were not being correctly put at the top of the list.

I am still receiving reports that MaraDNS freezes up after running for a while. I am unable to reproduce this problem. I have carefully checked the recursive code for potential deadlocks, finding none.

I suspect that there is a certain query which causes thie problem. Theirfore, I have added the ability for MaraDNS to log all queries she receives in human-readable format if verbose_level is three or higher.

While this results in some really huge logs, this will hopefully allow me to pin down exactly which query causes MaraDNS to lock up, allowing me to see where MaraDNS locks up, allowing me to resolve the issue.



I have added a lot of code which creates a circular linked list. This circular linked list is used by the custodian to erase elements from the cache which have not been recently accessed.

The psudo-random number generator has been renamed to 'rng', and modified to be a hash-only primitive. MaraDNS no longer has any code which can be directly used for cryptographic purposes. Of course, the compression function of the hash/prng is invertable, and can be used as a stream cipher, but such is the case for all secure hash functions and secure PRNGs.

Added a list of features I will not add to the 1.x release of MaraDNS to the MaraDNS man page.

The default max_glueless_level is now 10, because some real-world hosts need a max_glueless_level this high.



I have updated the 0QuickStart file to be current with the present state of MaraDNS.

The Linux makefile now supports "make debug", useful for making a build with verbose debugging output.

Now that I have some decent *roff documentation, I have done some improvments to the formatting of the man pages. Not only do the man pages look a little more attractive on the tty terminal, the man pages also look good when made postscript man pages (troff -man -Tps foo.1 >

In addition, since the -man macros are not documented anywhere on the internet, I have somewhat deciphered the macro set, and written up some documentation describing all of the -man macros. (2001.10.15)


I have done an audit and an overhaul of how MaraDNS calls locks in the recursive code. Hopefully, this will resolve the issues with MaraDNS freezing after running for a few days.

In addition, the recursive resolver now is better able to handle instances where a NS record points to a list of IPs.

More documentation updates. The man page for maradns now has a guide on how to set up a firewall to allow maradns packets through, and a list of known issues where MaraDNS breaks the DNS spec.

The crypto-emasculated version of MaraDNS no longer binds the source port of outgoing UDP queries. This is because the underlying OS may generate secure source port numbers when the source port is not specified in the application.



I have created a tool, called debug.hostname in the tools directory, which gives a very verbose trace trying to look up a given hostname. This will hopefully help me to debug and fix problematical hostnames.

I have also created a tool, called faq2man which converts the HTML faq in to a format suitable for embedding in to a man page. This makes the FAQ section of the MaraDNS man page more attractive

I have made the maximum glueless level user-configurable, since it looks like some hosts do not resolve with the old hard-wired default of 4. I have also made the maximum number of queries performed total in a recursive lookup user-configurable

I have added more helpful error messages which tell the user what to fix in their mararc file if MaraDNS can not initialize the DNS cache or the random number seed. The init_cache() and init_crypto() failed error messages should not be visible any more.

Documentation update: There is now a man page description of the mararc file. The CREDITS and FAQ files have been updated, in addition to almost all man pages. For example, I have gotten rid of the two or three pages of ugly troff syntax that Perl's pod2man program generates in the Man pages which had this.

make run without ./configure now works again.

Since MaraDNS used to act in a different manner than Python 1.5.2 with respect to multiple declations of the same index of the same dictionary variable, I have changed MaraDNS so that she exits with a fatal error should this occur, showing the user the line with the problem.

Made the error message which pops up when a csv1 zone file pointer is incorrectly formatted more helpful.

There was a minor security weakness with the PRNG which would pop up if the seed was a fixed file, two copies of MaraDNS used the same seed file, and the two files were started at the same time. This has been fixed. The seed is now exclusive-ored with the process ID before generating numbers.

More trimming of unused routines in the AES code. The AES code now only supports encryption with a 128-bit key and block size in ECB mode--the only way we use AES in MaraDNS.

For people who can not legally have any kind of cryptography in their code (French citizens, etc.), there is now a script in the tools directory, remove.aes which removes all crypto code. Note that, while the main MaraDNS suite will still compile after running this, some programs in the tools/misc, test and sqa directories will no longer compile. make still works, of course. Note that removing this code does make MaraDNS more suspectable to a spoofing attack.



Star records which point to CNAMEs are now completely supported.

Christophe Colle pointed out that the reason MaraDNS was leaking memory when making threads on Solaris was because MaraDNS was not using pthread_attr_destroy. Hopefully, adding this will make MaraDNS not leak on Solaris.

Improvment to the "make install" process: The default configuration looks for local man pages in /usr/local/share/man if /usr/local/man doesn't exist. This is to get around some Linux distributions which don't have /usr/local/man

Minor security tweak to the routine that generates the 16-bit secure psudo-random number.

The AES hasher now correctly generates a 128-version of the hash specified in Bram Cohen's proposed AES hash standard. Thanks to Bram for providing test vectors for the 256-version of the hash.

maradns --version now also includes the build system and date



Two bugs have been fixed: A bug where a UDP error message normally did not have the correct query ID, and a bug where, in certain cases, MaraDNS would return a UDP error instead of a SOA "not there" reply.

Also, the documentation has been updated. (2001.09.25)


Document reorganization: I am starting to move the formats of the data files to separate man pages. This will make each man page smaller and more convenient to use.

Improved CNAME support: MaraDNS now has partial support for star records that point to a CNAME.

Less code in the aes directory: I now have a program which generates the AES tables during the build process, since the code to generate those tables is a good deal smaller than the tables themselves. There is no slowdown, since it is a one-time calculation done during the build process.

maradns --version (and zoneserver --version) now do the right thing: Print out the version number and exit

The installer now removes the zoneserver and the maradns server before installing the new ones to get around the "text file busy" problem.

There was a subtle bug with returning "not there" SOA replies and case insensitivity. This bug has now been fixed. This bugfix also needs to be folded back in to the 0.5.xx branch.

It is now possible to change the class of the query with the getzone client if possible. Next: Document this new feature. (2001.09.24)


First, the bad news.

There is a known issue with MaraDNS having memory leaks when used as a recursive nameserver on the Solaris operating system. This problem does not exist in Linux. Since I do not have ready access to a Solaris box to develop on, I can not resolve this issue. Until a Solaris developer steps up to bat and fixes this for me, I am forced to disable recursive DNS serving under Solaris.

I should have ready access to a Solaris again in December, when I return to the United States. I have CDs of Solaris eight up there, in addition to friends with Solaris boxes.

Now, the good news.

I have updated the example mararc files to be consistant with the documentation. In particular, I now have two "out of the box" working mararc files. One for authoritative name serving, and another for recursive nameserving.

I have also updated the installer script to return an error if the directories to put the MaraDNS files in do not exist. In addition, MaraDNS will install all of the MaraDNS documentation in the directory specified by the variable DOCS in install.locations.

Finally, I have updated the FAQ, the man pages, the mararc.format documentation, and am working on making separate man pages which describe csv1 zone files and the mararc file. (2001.09.20)


When doing some tests with the AES engine in MaraDNS, I found that I inadvertently created a minor security problem w.r.t. ASCII nulls in the AES key. Basically, an "out of the box" MaraDNS configuration had a 1 in 16 chance of the aes key not having a full 128 bits of entropy.

I also corrected a minor fault in the aes128 hasher (it did not previously fully follow the spec, since it counted bytes, not bits), a minor fault with the top-level Makefile (which did not clean up tools/misc with a make clean), and did some minor manpage clean-up. (2001.09.18)


Updated the CREDITS file. If you have contributed to MaraDNS in any way, no matter how small, and are not in this file, please let me know so I can credit you.

Removed references to routines in the aes/ directory which MaraDNS and aes128 do not use. The aes code is now encrypt-only.

Added a test, based on Brian Gladman's AES reference code, which verified that the AES routines are working correctly.

Some cleanup, corrections, and revisions of the man pages. I figured out how to turn off hyphenation and justifaction for man pages, and have hence disabled these in all of the MaraDNS man pages.

Streamlining of the build process: ./configure; make; make install now does "the right thing". In addition, make uninstall also automagically does the right thing.

Important: make install now, by default, installs files in /usr/local/sbin, /usr/local/bin, and man pages in /usr/local/man. If one has previous installs of MaraDNS in other locations, please change the script to the desired location of the MaraDNS files. (2001.09.17)


Added code which keeps track of allocated memory, allowing me to hunt down and eliminate memory leaks. Found four memory leaks in the recursive code:



Incorperated a modified form of Franky's patch which adds the max_tcp_procs kvar to the program. Added some non-DNS releated tools to the "tools" directory. Clean up of the documentation. (2001.08.28)


More regression testing: Added test where it sends an answer to a server. If the server replies, this is considered an error condition. Cleaned up the recursive code (got rid of some XXX to dos): Mainly, MaraDNS sends an error if she can not spawn a thread. Documentation reorganized. (2001.08.16)


Made an 'asktest' program which will be used for regression testing. (2001.08.15)


Added support for a counter that counts the children in the Zone server. (2001.08.13)


Askmara doesn't display debug messages which can mess up terminals to the end user any more.

When an element in the cache is overwritten, the new data is now added to the cache.

New feature: MaraDNS can now blacklist spammer-friendly DNS servers.



Fixed bug in udperror which caused it to spit back the wrong query ID.

Added code to use a counter to count the number of threads. If we have more than maxprocs threads going on at the same time, we refuse to launch a thread.

Cached data now will go through round-robin rotates.

MaraDNS now compiles again when the locale is set to Spanish (though I still need more Spanish translations. Maybe when I am in México, I can get help down there) (2001.08.11)


Backported some bug fixes with zone file handling back to the "stable" authoritative-only branch of MaraDNS. (2001.08.10)


Improved handling of CNAME records in the cache. BSD-dependent routines (which are currently unused in MaraDNS) are not compiled if we are compiling on a Solaris box. (2001.08.08)


I have redone the makefile in the rijndael directory, some some makes (notably, the one NetBSD has) did not like the original Makefile. Marked some unreproducable bugs as unreproducable. (2001.08.07)


After much work (handling lame delegations better and fixing a bug in substring_issame_case), I have managed to get the host name to resolve.

Completely unreleated to MaraDNS, I have added a SirCam filter to the tools directory. (2001.08.03)


More bug swatting:



Fixed the zoneserver so it too only answers questions. Fixed two bugs in the getzone client: One where it would handle MX records incorrectly, another where it would hand the root zone incorrectly (this bug was actually in the Queries.c file). (2001.07.27)


We now check to make sure we only answer questions. (2001.07.18)


Added support for multiple root name servers. Also changed the example mararc file to have the root servers for eight different top level domain registries listed. (2001.07.16)


Back porting bug fixes to the authoritative-only branch of MaraDNS. (2001.07.15)


MaraDNS now sucessfully compiles on Solaris. Thanks to Franky Van Liedekerke for providing the pointers on how to do this, and to Danny for access to a Solaris machine to compile MaraDNS on. (2001.07.14)


Solaris support added, but does not fully work, added disclaimer, improved code which drops group privileges. (2001.07.13)


Another bug fix: If a zone did not have a record of a given type at the "top" of the zone, MaraDNS would attempt to perform recursion instead of returning a SOA record in the authority section. Fixed. Also needs to be fixed in the 0.5.xx branch. Thanks to D Richard Felker III for finding the bug. (2001.07.10)


Touch up bug fix: MaraDNS failed to close open file descripters when reading zone files. Fixed. Also needs to be fixed in the 0.5.xx series. Thanks to Boris Manojlovic for finding the bug. (2001.07.09)


Fixed a couple of long-standing bugs found while debugging the recursive version of MaraDNS:



This is the first alpha release of the recursive nameserver. I fixed a bug in the compression code, and fixed another bug which was causing problems with glueless name server entries. (2001.07.08)

maradns-0.7.22: now successfully resolves; fixed bug where the custodian could potentially erase the root name server entry, making MaraDNS non-functional as a root nameserver until restarted. (2001.07.07)


Type ANY queries now work for recursive queries. Finally. (2001.07.06)


Another late night double feature MaraDNS show. There was a really nasty bug which Jaakko pointed out to me. I found the culprit, and fixed the bug. (2001.07.04)


Begun work on some of the infastructure changes needed to make MaraDNS sucessfully resolve recursive ANY queries. Added maradns_gid support. Other pieces of code cleanup, primarily better handling of RR_ANY when acting as an authoritative nameserver (should I fold these changes in to a 0.5.26 release eventually?). (2001.07.04)


Re-arranging of the engine that returns an answer from the cache. We check the cache expire of a "host not here" reply. Updated the documentation so that it is the 0.5.25 documentation with the recursive stuff added as needed. (2001.07.01)


We now choose a random DNS server to query when we are looking for an answer. (2001.07.01)


Updated documentation to include information on how to set up a recursive nameserver. Fixed bug where multiple levels of CNAME indirection were not being properly followed. It is now possible to go to or (both cases of multiple levels of CNAME indirection). (2001.06.30)


I have added support for negative caching: If a given host name does not exist, the program sends a "not here" to the stub resolver. I also fixed a bug which was causing out-of-bailiwock queries to not work. (Having to do with the case-sensitivity issue). Next: Getting to work, caching ANY replies. (2001.06.28)


MaraDNS now works as a recursive nameserver again. The root nameserver is now user-configurable. CNAME returns queries in a form that a stub resolver can now understand. (2001.06.25)


After much tinkering with the code, I have managed to make it so that a CNAME record in the cache returns the corresponding A record (note: only one A record!) along with the CNAME record. This should allow hosts like to work when this is used as a stub resolver. (2001.06.24)


More work done on plugging memory leaks. Working on code that will determine the ip for a given CNAME record, since stub resolvers are not smart enough to do a second A query themselves when they see a CNAME record. Also some minor cleanups that Franky Van Liedekerke suggested. (2001.06.22)


Finished work on the custodian. Now, I need to make sure the custodian works. Also fixed CNAME support so it now works, plugged a couple more memory leaks, and revised the offline testbed to have a CNAME record. (2001.06.21)


Bigfixes: I have plugged some memory leaks, and added code which will (hopefully) allow recursive queries to cname records to work. I have also done some more work on the "custodian" code. (2001.06.21)


Bugfix release: MaraDNS now closes the sockets that she opens when performing recursive queries. This stops the open sockets from piling up. Also, I have begun work on the "custodian" code: Code the reduces the number of elements in the cache when the user-defined cache runs low on space. (2001.06.20)


I have made the RNG truly random, and I have added code to the resolution algorithm which allows it to perform recursive queries when the only authoritative records are NS delegation records. Also, updates to the todo list. Changed cc to gcc in all the makefiles to make MaraDNS more Solaris-friendly. (2001.06.20)


I have added ACLs which limit who is allowed to make recursive queries. I have also begun work on making the random number seed truly random. (2001.06.19)


I have updated the non-recursive code to use code from MaraDNS 0.5.25, which adds a number of features from there (round robin rotation, etc.) I have alos made a list of things which need to be done before I can make this a beta candidate for a 1.0 release. In addition, the code now makes sure that the query ID we receive is the same one we sent out. I have also started work on a CREDITS file, updated the FAQ, and added a couple of interesting (if not MaraDNS-specific) Perl scripts to the archive. (2001.06.17)


The DNS server now has a psudo-random number generator which uses the Rijndael algorithm. This PRNG randomizes both the query ID and (I believe) the source port of any and all DNS queries. This PNRG now needs to become secure (by setting up either a random or a user-defined Rijndael key) (2001.06.16)


There were some bugs in the RR expire code. I have found those bugs, fixed them, and now cache expirery should work. (2001.06.12)


This release has implemented the ability to expire records from the cache. All Name server records have a fixed expire of 1 day (this can be changed by changing one #define in recursive.c), but all other records have an expire time based on the TTL of the record. I have not yet tested DNS RR expire. (2001.06.11)


Milestone: This is the first release of MaraDNS that works as a recursive nameserver with the real root nameservers. Fix: Changing only the case of the first nameserver, add negative caching, then start adding security (good RNG for the query ID and source port, recursive ACL), then start making the root servers customizable (including being able to have different TLDs have different root servers). (2001.06.11)


Beginning work on making MaraDNS both case-insensitive and able to preserve case. (2001.06.06)


Albert Prats kindly provided Spanish translations for various text files. To get MaraDNS to compile in Spanish instead of English, type in ./ before compiling MaraDNS.

MaraDNS now can handle gluelessness. I am bumping up the minor version number to reflect that MaraDNS now has recursive nameserving capabilities, albeit without some security features. Next: Work on cache flushing and security. (2001.06.03)


Now, if one of the IP nameservers is bad, we will try the next nameserver in the chain. Next: Add the code to handle out-of-bailiwick nameservers (2001.06.01)


Two big improvments: 1) The recursive resolver can now handle multiple A records (MaraDNS deliberately ignores NS and AR records. Note that it is a good idea to give out the corresponding A record for a CNAME record [To do]) 2) There is now code which makes a local copy of the chain of NS records in an authoritative-only section, which will allow me to make thread-safe code which will query other nameservers, should a given nameserver not function (e.g. Someone changed a computer's IP. In the three weeks it can take Network Solutions to update the records on the root nameservers, we still want to be able to reach the domain in question by using the other listed nameserver for the domain)


Not only did I get to spend some time with my family this memorial day weekend, I also was able to get Linux up and going on my new laptop. Took two installs, but everything except SSL in Konqueror now works. I also, now that the new laptop is (mostly) up and going, have gotten a chance to work on MaraDNS. This new laptop, since it has a working battery, should speed up MaraDNS development--I can now work on MaraDNS on the train. The latest version is able to go to a remote server and give us an incomplete answer (only one RR) based on what the remote server tells us. (2001.05.29)


Some minor bugfixes and tweaks: The nameserver will now query name servers until it is able to find an answer, then it will go in a loop. (2001.05.24)


A fairly significant milestone: This version of MaraDNS is able to read data from an authoritative nameserver, and, based on that data, determine the IP of a nameserver closer to the answer we are looking for. (2001.05.21)


Two minor bug fixes: The query will work, even if authoritative nameservers for the root are set up; MaraDNS now will run on systems which do not support the setrlimit system call, such as the GNU Hurd. (2001.05.21)


Three bug fixes: MaraDNS now works with RRs for the root namserver (MaraDNS, in fact, can now be a nameserver for the root), the askmara tool now has a timeout (and can ask questions about the root nameserver), and the output that MaraDNS generates is unbuffered. (2001.05.19)


I have added a lot more debugging stuff as I hunt down why it is RRs are not being added to the dns RR cache. I think I am pretty close to pinning it down, and hope tomorrow's release can add RRs to the big cache. (2001.05.18)


I added a simple interactive debugger which lets me see the state of the DNS cache hash table. Looks like the data from the server is not being added to the cache. Next: FInd out why not. (2001.05.17)


An unexpected event forcing me to go home late yesterday caused there not to be a release of MaraDNS yesterday.

Fixed bug where it was not correctly appending the class to the server that it was querying. Temporarily disabled the actual threading while development work on the recurseor continues. Next: Make sure that the cache is properly seeded from data from authoritative nameservers. (2001.05.17)


Fixed bug where it was choosing the wrong IP to query. Automated the process of setting up a testbed (which is completely self-contained), so I can debug this on a variety of machines. Next: Fix the timeout bug. (2001.05.15)


MaraDNS compiles again. Now, I need to go through all the code and iron out all of the bugs. Testbed of MaraDNS configuration files added. (2001.05.14)


More work on the recursive stuff done. (2001.05.13)


More work on the recursive stuff done. (2001.05.12)


Bugfix release: non-0 opcodes now correctly return a "NOT IMPLEMENTED" error message. Also, some minor cleanup in the documentation: star records (*, etc.) are now documented. (2001.05.10)


add_closer_jsddip, add_closer_js, and add_closer_jsip now have a third argument: Whether to overwrite or append to already existing data in the cache. Since the autoconf stuff doesn't work with the development branch, I got rid of it for now. Once this code gets stable, one of the Debian packagers can feel free to add the autoconf stuff again. (2001.05.10)


Added in_bailiwick and cmp_dnames functions to recursive.c (2001.05.09)


Feature enhancment: Added round-robin rotation of records and limits to the number of records that can be displayed for a given answer to MaraDNS. This will be the last feature enhancment for the 0.5.xx tree. All changes in the 0.5.xx tree will now be bug fixes. Now, back to work on the 0.6.xx series, starting off with integrating the 0.5.xx changes. (2001.05.07)


Feature enhancment: We now make sure that the same AR record does not show up twice in the AR section. Thanks to Phil Homewood for pointing out this problem. (2001.05.06)


Bugfix release: We now follow chains of records in the AR section. The authoritative bit for an "RR_ALL" request is now determined by the authoritative bit in the first RR found. Thanks to Phil Homewood for finding these bugs. (2001.05.06)


The askmara tool now uses select() to time out after three seconds. Added a lot of code to the recursive lookup. I now send a query to the remote server, and receive the reponse. Next: Code to process the response and add the data to the local cache. (2001.05.06)


The recursive code now sucessfully seeds a root nameserver in to the cache. Next: Code to query and get the response form that nameserver. (2001.05.05)


Heavy debugging of the recursive stuff going on. It is not fixed, but I wanted to post something, however miniscule, before going to bed. (2001.05.04)


Addded new feature: default_rrany_set, which is used to change the RRs returned when a RR_ANY query is sent to the MaraDNS server. Thanks to Phil Homewood who pointed out that this is sometimes needed. (2001.05.03)


recursive text documented updated to reflect changes I made on the train. Some other cleanup. (2001.05.02)


Wrote up document detailing the recursive algorithm that MaraDNS' recursive resolver will use. Integrated the 0.5.17 bugfixes in to the development tree. (2001.05.01)


Fixed bug in MaraDNS' handling of zone transfers where the response is a single big RR instead of multiple small RRs. Some other small bugfixes. (2001.04.30)


I have the general structure of how I want to do the recursive name serving in place. The devil, however, is in the details. (2001.04.28)


Fixes in MaraDNS-0.5.16 incorporated in to development branch. Slowly making progress on the recursive code. (2001.04.26)


Fixed bug in the zoneserver's handling of replies longer than 255 octets in length. Fixed problem in manpage and updated man page. Special thanks to Phil Homewood for finding problems the zone server was having. (2001.04.26)


Work on making MaraDNS recursive begins. (2001.04.26)


Fatal error messages caused by failed system calls now show the user the error message that the system gave, in addition to MaraDNS' error message. (2001.04.26)


Added "no_fingerprint" feature which minimizes the MaraDNS-specific features, making it more difficult to determine which DNS server one is running. (2001.04.23)


Manpage for maradns added. (2001.04.22)


Added better support for CNAME records: If the CNAME record points to an A record, and we have the A record "on file", MaraDNS will add the CNAME record to the ar section of the reply. Also added support for getting the version number for maradns via a '' TXT query. Set things up so we can both a autoconf-based and a non-autoconf-based build process, and we can switch between the two. Next: Branch off to development again, because I need to get the zone server multithreaded. (2001.04.22)


Tollef Fog Heen generously ran autoconf for MaraDNS. The build process now consists of './configure;make'". (2001.04.21)


Code cleanup: I added -Wall as an option in the libs, dns, and server directories. Cleanup of all the warnings that -Wall generated. Added /etc/mararc and /var/maradns/ to RPM file. (2001.04.20)


The server crashes were causes by pointers that were not correctly initialized to zero. The pointers causing the crash have been initialized, and hopefully this one will be crashproof. Next: Look for other incorrectly initialized variables. (2001.04.20)


Begin a "stable" brach for the only-authoritative non-threaded nameserver. Changed compiler option from -g to -O2. Made RPM of MaraDNS-0.5.08. (2001.04.19)


Plugged some memory leaks in the zoneserver which, while not currently a problem, could have been a problem if I had started coding threads before plugging the memory leaks. Some of the leaks were is the js_string library, so that code base is a lot cleaner now. Made the functions in ParseCsv1.c thread-safe. My friend Fatma generously supplied a German translation of the error strings in MaraDNS_en.h--we now have a MaraDNS_de.h which, while not perfect, will be appreciated by the Germans. (2001.04.18)


The zone server for MaraDNS can now be run from inetd. Due to the security implications of this (MaraDNS' IP-based ACLs stop working when run from inetd), this will be an undocumented feature. (2001.04.18)


Phil Homewood generously supplied a patch that makes this compile on FreeBSD. In addition, he fixed a bug in the Makefile in dns/Makefile which made it so bobbit.c compiles instead of using the Linux-specific object file (Which I didn't catch, since make clean didn't remove it and make didn't recreate it). I also fixed a bug in getzone.c which was introduced when I put the string literals in a language-specific file. (2001.04.17)


Added more support for dotted decimal IPs in NS, CNAME, and MX records. Added handles for code which will warn the user of the presence of these dotted-decimal IP records. Fixed bug where js_copy was not returning an appropriate value on success (2001.04.17)


If a "give me all records for a given hostname" query appears, MaraDNS will now look for a CNAME with the same hostname, returning only that if found (and she will only look for a CNAME if an A and MX were not found), and if A, MX, and CNAME records are not found, MaraDNS will see if the person entered a dotted decimal ip and respond appropriately. (2001.04.16)


Most of the text messages that MaraDNS' various utilities generate have been moved to separate files, which will make localization easier. (2001.04.16)

maradns-0.5.01: Bugfix: Since mail exchangers routinely ask for "all records" queries (to get both A and MX records), I have hacked MaraDNS to deliver A and MX records if a request for all records is received. I still need to code the case of a request for "all records" pointing to a CNAME, though. Also, I have added a benchmark tool which times a DNS server by sending 50,000 queries to the server in question as quickly as possible. (2001.04.13)

maradns-0.5.00: The UDP server no longer fork()s off processes to process queries. I performed a mild stress test, where MaraDNS was processing 81 queries a second for over an hour--MaraDNS performed beautifully--memory usage did not increase, and queries were fast during this test. I am making this release the stable branch. Next: Get string literals out of the code. (2001.04.12)

maradns-0.4.04: More bug fixes: Plugged potential memory leaks in js_buf_getline. Fixed bug where the last line of a csv1 file was not read. Fixed makefile so that it cleans files in new location of the zonefile stuff--it's now in a directory called "tuzona". Next: Go from a multi-process model to a single process model. (2001.04.12)

maradns-0.4.03: Bugfix: The zone server is now hacked up to give a plausable-looking answer to a SOA request on the TCP port. As a result, BIND 4 and BIND 8 will now transfer zones from the maradns zoneserver. (2001.04.12)

maradns-0.4.02: Bigfix: Hacked zoneserver so that it can work as a zone server in cases where the zone transfer client asks for the SOA record before downloading the zone. Also: Added the ability to verbosely log invalid queries sent to the DNS server, and to have a log level of 0 make MaraDNS give out no logs whatsoever. Next: Fix bug where the last line of a csv1 file is not parsed. (2001.04.12)

maradns-0.4.01: Bugfix: Fixed bug where SOA records were not properly loaded when we have multiple zones. (2001.04.11)

maradns-0.4.00: Stable branch: This is the stable branch of MaraDNS, which will only be updated with security fixes. Made zoneserver check the query type, and drop connection on anything besides AXFR and IXFR (Hack: The zone server treats an IXFR exactly like an AXFR). Also cleaned up the error handling in the zone and udp server code in preparation to make maradns multithreaded. (2001.04.11)

maradns-0.3.06: Security fix: The zone transfer client now checks for and disables any out-of-baliwick records it finds when performing a zone transfer. Feature enhancment: Maradns now has a working zone transfer server. (2001.04.10)

maradns-0.3.05: An entire parsing engine which processes ip-based ACLs has been created, complete with recursive aliases. Zoneserver now only needs the code that reads the client's request and send them the zone they ask for (as long as they have access). (2001.04.08)

maradns-0.3.04: TXT, A, and MX records are now "pretty printed" when downloaded from a foreign zone. All seven RR types supported by MaraDNS are now pretty printed. Fixed bug with the handling of "umbrella" NS records. Fixed bug with the handling of high serial numbers and extra-long TTL values. Next: the AXFR server. (2001.04.04)

maradns-0.3.03: The getzone program in tcp now generates working, albeit ugly (too many RR types are still marked 'U'), MaraDNS zone files based on the data from a zone transfer. Also found and fixed other bugs the popped up when stressing the various queries routines with a full Zone transfer. Unreleated to MaraDNS per se, MaraDNS now has a `real' web page. (Thanks, Leo!) (2001.04.04)

maradns-0.3.02: Added support for truncating headers. Began work on getzone zone transfer client. (2001.04.03)

maradns-0.3.01: Fixed bug where the MX preference changed on DNS compressing and DNS decompressing. (2001.04.01)

maradns-0.3.00: The DNS compression routines now work. Also set up the server to return "Not implemented" to the unimplemented requests for zone transfers and the unimplemented requests for all RRs attached to a hostname. (2001.04.01)

maradns-0.2.10: My theory is that they made DNS comprssion so difficult to implement out of fear that anyone would be crazy enough to write their own DNS server. Continued work on the compression routines. (2001.03.31)

maradns-0.2.09: Moved check for star records attached to CNAME or to NS RRs in the CSV1 parser, where it belongs. Added support for "notfound" reply. Next: RFC1035 compression (ugh). (2001.03.29)

maradns-0.2.08: Added support for ddip addresses (An IP query for '' gives the IP ''). Added almost full support for star records. Only these somewhat silly star record cases are not supported: Star records pointing to CNAMEs and to NSs records. Added code that warns the user if they try to add an unsupported star record type. Next: The code to give out a "notfound" reply. (2001.03.28)

maradns-0.2.07: Fixed bug in MaraDNS' handling of case folding. Added some support for star records. (2001.03.27)

maradns-0.2.06: A and CNAME queries are now case-insensitive. Changed the bs_process routine to have domain-labels converted to their lower-case format before octal processing is done (so we can still have 'A' in a domain label with '\101') Returns NS delegation if we asked for a host in a sub-delegated domain. (2001.03.27)

maradns-0.2.05: Cleaned up the makefile so that we don't have compiled binaries in any of the directories after a "make clean" is performed. Added support for CNAME and limited NS record support. (2001.03.26)

maradns-0.2.04: New security feature: Maxprocs, which is a mandatory way of limiting the resources MaraDNS uses. Added fix.perms tool. (2001.03.26)

maradns-0.2.03: I have made the directory structure a little cleaner. The only problem I have now is that multiple Makefiles have to be changed if I add a new object file. I also have improved the way MaraDNS cleans up after her children. (2001.03.26)

maradns-0.2.02: Now, MaraDNS correctly returns NS records and AN records for every query where it has NS and AN records in its local database. While I wait for the clows at NSI to figure out why we can't make and use and as name servers for both domains, I can test things with (2001.03.25)

maradns-0.2.01: Bugfix: SOA lines can now have percent escape sequences in them. (2001.03.25)

maradns-0.2.00: Incremented minor number in light of the fact MaraDNS now actually resolves, albeit in a very limited fashion. Added some QuickStart notes, and added the ability for uint16s and uint32s to be added directly to the end of a JS_STRING object. (2001.03.25)

maradns-0.1.40: MaraDNS now resolves hosts. It doesn't handle a lot of cases where the resolution is not an exact match (NS records for stuff below us, star records, etc.) nor does it give us NS or AN records, nor the IP for a Cname record (if applicable), but at least MaraDNS is finally resolving. To do: js_string function for adding uint16s and uin32s in a single fell swoop, and real name resolution. (2001.03.25)

maradns-0.1.39: At this point, MaraDNS binds to a port and listens to incoming data. Next: Actually process the data that she gets (2001.03.24)

maradns-0.1.38: Added the code that adds pointers to the corresponding A records for MX, NS, and CNAME records. (2001.03.23)

maradns-0.1.37: Placed the code that converts star records in a more sensible location. Added a new element in the rr answer which is a pointer to the query string (we need this so we can tell the resolver both the question and the answer with the NS records, and which IP addresses go with which answers in the AR records) (2001.03.21)

maradns-0.1.36: Now we convert star records (record which start off with a * label) to an EDNS-style format MaraDNS uses for its internal hash of RRs (2001.03.19)

maradns-0.1.35: Verified that records are placed in the bug hash correctly. Next: We can now start making this a working DNS server. Bind to the port, answering UDP queries using a simple forking model. (2001.03.18)

maradns-0.1.34: Added some more security features: It now chroot's and changes the uid if it is run as root. Also made a function that adds a RR to the end of a chain of RRs before the first NS RR. (2001.03.17)

maradns-0.1.33: Plugged up some memory leaks in MaraHash.c. Added a lot of code which starts populating the big hash with data. (2001.03.17)

maradns-0.1.32: More work on the the populate+bighash routine. Now, when a syntax error is encountered, MaraDNS makes a best-faith effort to continue processing zone files. (2001.03.16)

maradns-0.1.31: Additional work on that routine. Now, it correctly make sure that we add the NS records for the zone before the NS records, and also fixed some other bugs in this routine. Next: Make add_rr_to_bighash really check the authority of a record and and data to the big hash (2001.03.15)

maradns-0.1.30: Worked on the routine to fill up the "big hash" with the appropriate data. Now, I need to replace the "dummy" add_rr_to_bighash with a routine that adds the appropriate rr to the big hash (if appropriate). (2001.03.14)

maradns-0.1.29: Installed a new verison of Linux on my Laptop (Esware 2.0r2, a Spanish RedHat clone with the 2.4 kernel). Begun work on MaraDNS.c. Next: continue work on MaraDNS.c (2001.03.13)

maradns-0.1.28: Made all of the string literals in ParseMaraRc.c labels which point to entries in ParseMaraRc_en.h. Wrote and documented Perl script which automates this kind of work. I did the same with ParseCsv1.c (ParseCsv1_en.h). (2001.03.11)

maradns-0.1.27: Pasted in read/write/setup kvar code from the code that parsed the kiwirc file in the kiwi2 anti-spam package. Modified mararc code so that it can parse both simple strings and dictionaries (Assosciative arrays) Next: The code that populates the DNS lookup hash based on the data read from the mararc file. (2001.03.11)

maradns-0.1.26: Made the code that parses mararc lines a little more senisible. It's still hackish, but is somewhat pedantic about what kind of syntax it accepts, returning errors when wrong syntax is given to it. (2001.03.10)

maradns-0.1.25: Added support for % in csv1 file. Revised csv1.format document. Next: figure out a way to store "star records" in the hash table in such a way as to not step on the EDNS standards. And implement that method. (2001.03.09)

maradns-0.1.24: Added support for MX and "Unknown" (user-specified query type) data types. Added support for '\xxx'-style escape sequences, making it possible to have arbitrary data in the csv1 zone file. (2001.03.08)

maradns-0.1.23: Changed js_atoi to return unsigned integers. Added support for TXT and SOA records. Tested to make sure error correction looks good. Next: PTR shorthand, more efficient Makefile. (2001.03.07)

maradns-0.1.22: Split off some of the routines in other files to new .c files: ParseCsv1.c and Utf8.c. Created js_addbyte routine. Added csv1test and example_csv1 files to test the csv1 parsing routines. Created js_changebyte routine. ParseCsv1 routine now parses all data types except for the SOA datatype. Next: SOA datatype, shortcut for PTR datatype. (2001.03.07)

maradns-0.1.21: Wrote utf8test to test the ability to convert ISO 8859-1 strings to UTF-8 strings. Found minor bug in code, fixed, and now ISO 8859-1 strings are correctly copied. I had to set up X and recompile xterm to support all this. Cleaned up the comments in the js_notmatch_offset code (they were never cleaned up from the Kiwi days). Clean up of some code in Queries.c. Wrote about half of the line parsing code for parsing csv1 lines. csv1 format doc clean up. (2001.03.07)

maradns-0.1.20: I have decided that MaraDNS will use UTF-8 to support international characters in domain names. I have added the draft RFC for UTF8 domain names and a description of UTF8 in the docs. In terms of code, we now have code that converts ISO 8859-1 to UTF-8. In addition, I have written up a couple of documents describing the csv1 non-standard Zone file format, and how MaraDNS will resolve a domain name. (2001.03.06)

maradns-0.1.19: Added routines to handle getting all of the keys of a hash in series (in the semi-random order they are in the hash table). Corrected errors in parseline code, it now works with foo["bar"] = "baz" lines and no longer considers foo["bar"] = baz legal. foo["bar"] = 1 is still legal. (2001.03.04)

maradns-0.1.18: More ParseMaraRC hacking (this this is a real hack. A really bad hack. At least the elegant js_string lib stops it from being a security problem). It now has routines that can fill up an assosciative array based on user-specified keys and values. Next: Routine that reads the rc file, and, based on the data there, begins reading zone files. The zone files will then be read in turn, and then populate a hash. (2001.03.03)

maradns-0.1.17: More ParseMaraRC.c hacking. Now, it can parse 'foo = {}', 'foo["bar"] = "baz"', and 'foo = "bar"'. Next: Write the routine to read an entire maradnsrc (maybe we should just call this mararc) and fill up the hash table with the names of all of the zones. (2001.03.03)

maradns-0.1.16: Modified js_anq_chars handle just numerics. Made it correctly handle just alphabetics. Renamed 'ctest' to 'askmara'. Rewrote askmara.c to have all labels in another file (askmara_labels_en.h), to make translation easier. (2001.03.02)

maradns-0.1.15: Continuing the retooling of code from the KiwiSpam package to use assosciative arrays in ParseMaraRC.c. Yes, this whole parser is a hack instead of a proper parser. Right now, the single line parser groks foo["bar"] = baz. Next: get it to grok foo = {} (2001.03.01)

maradns-0.1.14: Beginning the retooling of code from the KiwiSpam package to use assosciative arrays in ParseMaraRC.c. This will be a fairly extensive code rewrite, considering the code I am modding is somewhat hacky itself. (2001.03.01)

maradns-0.1.13: Fixed bug where ctest resolver program did not print out SOA replies (2001.02.28)

maradns-0.1.12: Added support for TXT in ctest resolver code. Made ctest code more hardy--it validates all input and returns an error if there is a problem at any point. (2001.02.27)

maradns-0.1.11: Support for MX and SOA, and a number of other formats that may have compressed data in them now added to the decompression routine. ctest now can parse any RR that MaraDNS fully supports except TXT (A, NS, SOA, MX, CNAME, HINFO), and is now a rather verbose dig replacment. Got rid of the cruft variables in the decompression routine. Next: Have a routine to decode TXT data. (2001.02.27)

maradns-0.1.10: You know how to handle buggy code? Rewirte the code so that it is simpler and less buggy. A lot of the overhead I had was not needed to keep things secure. The docs on how MaraDNS handles decompression have been revised also. RFC1035 decompression now works, still need to add MX and SOA, and possibly support for other data types that get compressed (SRV, the obscure RFC1035 datatypes, etc.) Also, get rid of some of the cruft variables in the decompression code. (2001.02.26)

maradns-0.1.09: Had a good weekend. Got to see a friend of mine and his wife get baptised. Continued work on decompress_data. It is still buggy, but I am working out the bugs. (2001.02.26)

maradns-0.1.08: Added read_rr_h. Also began work on decompress_data (Ugh. rfc1035 compression is horrible.) (2001.02.22)

maradns-0.1.07: Fixed potential overflow in rtest (probably never exploitable) Discovered that DNS servers do not support QDCOUNT > 1 in DNS queries. Made notes in "doc" about this. (2001.02.21)

maradns-0.1.06: ctest now sends correctly formed DNS queries to a DNS server (2001.02.21)

maradns-0.1.05: Added hname_2rfc1035, which does the reverse of hname_translate. Beginning work on ctest, which is a test DNS client, to see what kind of replies we get from DNS servers. (2001.02.21)

maradns-0.1.04: Debugged routines in Query.c that convert a RFC1035 question in to a query. Added routine that converts a RFC1035 domain name (with class) in to a dotted-decimal hostname. (2001.02.20)

maradns-0.1.03: Began work on debugging routines in Query. Time to go to work (2001.02.20)

maradns-0.1.02: Wrote first (test-only) server that listens on port 53. Using this server to determine what kind of data resolvers ask for. (2001.02.20)

maradns-0.1.01: Added some more RFC1035 data to MaraDns.h (2001.02.20)

maradns-0.1.00: Begin work on handlers to handle various data types that RFC1035 has. (2001.02.20)

maradns-0.0.08: Added js_anq_chars, js_alpha_chars, and js_an_chars to JsStrCP object. (2001.02.19)

maradns-0.0.07: Good morning! Added mtuple_new, mtuple_put, and mtuple_get functions. Fixed bug where mhash_inc would allow a return value of 0. Fixed Makefile so make clean cleans up mtest binary. Added bounds testing to mhash_resize hashtable size. Time to eat breakfast. (2001.02.19)

maradns-0.0.06: Added mara_tuple support and verified that hash collisions are properly handled. Time to go to evening church recital. (2001.02.18)

maradns-0.0.05: Corrected mhash_resize to blank out the hash we resize to. Create mtest.c program to test the creation of hash elements. Time to get ready for church. (2001.02.18)

maradns-0.0.04: We now properly handle the case of trying to add an element already there (return an error), and have more error checking to make sure we don't crash because of corrupt hash data. Added an interactive test which lets the user interactively add, delete, and view hash elements. Time to go to bed (2001.02.18)

maradns-0.0.03: Some more work has been done. mhash_undef_js and mhash_resize functions written and compile. (2001.02.18)

maradns-0.0.02: MaraHash functions--assosciative array methods utilizing a hash--have been set up. This has the functions mhash_create, mhash_js, mhash_inc, mhash_put, mhash_get, mhash_undef, mhash_put_js, and mhash_get_js. Debugging done--these functions can perform basic get/put operatins with elements in an assosciative array. (2001.02.18)

maradns-0.0.01: First version of MaraDNS package. Added iso-8859-1 support to JsStr routines. Added js_qappend and js_qprepend functions there. In addition to js_qfgrep. All tested functions work and are without error. (2001.02.17)