Port details

dns/bind9-devel 9.21.27

BIND DNS suite with updated DNSSEC and DNS64

unaddressed

VuXML only

fixed

open problem reports

Port info

Maintainer: mat@FreeBSD.org
Packages: latest: 9.21.27
Upstream: up to date
Last update: 2026-10-21 to 9.21.27 · 07723370c8
Quarterly: 2026Q4: 9.21.27 · last MFH 2026-10-21 077013700a
Formerly: dns/bind913 until 2019-05-16
WWW: https://www.isc.org/bind/
Links: cgit · VuXML · Report wrong data

Install

Package

# pkg install bind9-devel

installs 9.21.27 from latest; from quarterly (2026Q4) 9.21.27

Port

# cd /usr/ports/dns/bind9-devel && make install clean

# make -C /usr/ports/dns/bind9-devel config  # change options first

Size

9.5 MiB download · 27 MiB installed

Depends on

databases/lmdb0 0.9.36_1, devel/fstrm 0.6.1_1, devel/json-c 0.19_1, devel/libedit 3.1.20260512,1, devel/libuv 1.52.1, devel/protobuf-c 1.5.2, dns/bind-tools 9.20.30, dns/libidn2 2.3.8, sysutils/liburcu 0.15.7, textproc/libxml2 2.15.4, www/libnghttp2 1.70.0

License

MPL20

Options

6 of 13 on in the package: DNSTAP DOCS GSSAPI_BASE IDN STATS_JSON STATS_XML

Show the 7 options that are off

GEOIP GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE OVERRIDECACHE QUERYTRACE START_LATE

pkg-message

Shown after installing

BIND requires configuration of rndc, including a "secret"
key.  The easiest, and most secure way to configure rndc is
to run 'rndc-confgen -a' to generate the proper conf file,
with a new random key, and appropriate file permissions.

The /usr/local/etc/rc.d/named script will do that for you.

If using syslog to log the BIND9 activity, and using a
chroot'ed installation, you will need to tell syslog to install
a log socket in the BIND9 chroot by running:

  # sysrc altlog_proglist+=named

And then restarting syslogd with: service syslogd restart

Shown after upgrading

The BIND9 port was changed to respect upstream's change
concerning master and slave that were replaced by primary and
secondary, all the references in the sample files were updated
to reflect that.

Shown always

+------------------------------------------------------------+
|THIS IS A DEVELOPMENT VERSION OF BIND, IT WILL EAT YOUR DATA|
+------------------------------------------------------------+

Packages by version and architecture

latest

FreeBSD version	amd64	aarch64	i386
FreeBSD 16	9.21.27	9.21.26	–
FreeBSD 15	9.21.27	9.21.26	–
FreeBSD 14	9.21.27	9.21.26	9.21.27

quarterly (2026Q4)

FreeBSD version	amd64	aarch64	i386
FreeBSD 15	9.21.27	9.21.26	–
FreeBSD 14	9.21.27	9.21.26	9.21.27

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 9.21.27.

Fixed (11)

Show 11 fixed

VuXML entries whose affected range the packaged version has left.

DNSSEC validators -- denial-of-service/CPU exhaustion from KeyTrap and NSEC3 vulnerabilitiesentered 2024-02-13

CVE-2023-50387, CVE-2023-50868

BIND -- multiple vulnerabilitiesentered 2017-04-13

CVE-2017-3136, CVE-2017-3137, CVE-2017-3138

BIND -- multiple vulnerabilitiesentered 2017-01-12

CVE-2016-9131, CVE-2016-9147, CVE-2016-9444, CVE-2016-9778

BIND -- Remote Denial of Service vulnerabilityentered 2016-11-02

CVE-2016-8864

BIND -- Remote Denial of Service vulnerabilityentered 2016-09-28

CVE-2016-2776

BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfersentered 2016-08-10

CVE-2016-6170, CVE-2016-6171, CVE-2016-6172, CVE-2016-6173

bind -- denial of service vulnerabilityentered 2016-08-06

CVE-2016-2775

bind -- denial of service vulnerabilityentered 2016-03-28

CVE-2016-1285

bind -- denial of service vulnerabilityentered 2016-03-28

CVE-2016-1286

bind -- denial of service vulnerabilityentered 2016-03-28

CVE-2016-2088

bind -- multiple vulnerabilitiesentered 2015-12-16

CVE-2015-3193, CVE-2015-8000, CVE-2015-8461

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (403)

2016-09-30 14:44Mathieu Arnold (mat)

So, on 9, it is failing to build it with jobs.

It builds .a before all the .o that are supposed to go in the .a are
built.  Imagine what happens after that...

Reported by:	Craig Leres
Sponsored by:	Absolight

67b0d71465

2016-09-28 14:55Mathieu Arnold (mat)

Update to latest commit.

MFH:		2016Q3
Security:	CVE-2016-2776
Sponsored by:	Absolight

7b562b7a32

2016-09-28 14:55Mathieu Arnold (mat)

Remove MAKE_JOBS_UNSAFE for BIND9.

It was added in 2009 in r232247 without the reason it was failing, I've
tried with -J 2-10, and can't have one of the BIND9 port fail.
Feel free to add it back, but please, add the reason why it fails.

Sponsored by:	Absolight

6a863d85b8

2016-09-13 11:04Mathieu Arnold (mat)

Update to latest commit.

Sponsored by:	Absolight

a1b501236b

2016-09-05 15:51Mathieu Arnold (mat)

Update to latest commit.

Sponsored by:	Absolight

9d464156cb

2016-08-31 14:06Mathieu Arnold (mat)

The START_LATE option is not needed by bind-tools.

Sponsored by:	Absolight

be9a739028

2016-08-31 13:59Mathieu Arnold (mat)

The NEWSTATS and RRL options were removed in BIND9 9.10, so remove them from here, also, make the upstream default options default for real.

While there, put back the BIND_TOOLS knobs in bind9-devel.

Sponsored by:	Absolight

6234750e3f

2016-08-30 12:55Mathieu Arnold (mat)

Update to latest commit.

Sponsored by:	Absolight

8353a87772

2016-08-29 14:54Mathieu Arnold (mat)

Update to latest commit.

Sponsored by:	Absolight

2d64b0d3be

2016-08-22 14:20Mathieu Arnold (mat)

Update to latest commit.

add LMDB as a default option, its footprint is really small, and it
speeds up zones operations dramatically.

Sponsored by:	Absolight

171a8f9631

2016-08-15 15:54Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

26f8e43d88

2016-08-08 14:29Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

545ec4e090

2016-08-08 14:29Mathieu Arnold (mat)

Convert to USES=ssl.

Sponsored by:	Absolight

8301c5d5e3

2016-08-03 15:28Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

52bf80c022

2016-07-25 17:16Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

bf0d990d8e

2016-07-19 13:30Mathieu Arnold (mat)

BIND9 update, 9.9.9-P2, 9.10.4-P2, 9.11.0b2 and latest 9.12 snapshot.

MFH:		2016Q3
Security:	CVE-2016-2775
Changes:	https://lists.isc.org/pipermail/bind-announce/2016-July/000996.html
Changes:	https://lists.isc.org/pipermail/bind-announce/2016-July/000997.html
Changes:	https://lists.isc.org/pipermail/bind-announce/2016-July/000998.html
Changes:	https://lists.isc.org/pipermail/bind-announce/2016-July/000999.html
Sponsored by:	Absolight

f8b6156bc5

2016-07-04 12:01Mathieu Arnold (mat)

Update to latest snapshot.

Catch up on license changes.

Sponsored by:	Absolight

ff97da4988

2016-07-04 11:47Mathieu Arnold (mat)

Introduce BIND9 9.11.0b1. (beta1)

BIND 9.11 brings many changes to BIND, including a new license
(the Mozilla Public License 2.0 -- you can read about it here:
https://www.isc.org/blogs/bind9-adopts-the-mpl-2-0-license-with-bind-9-11-0/)
and many new features, including:

-  Catalog zones, a new way to provision zones on slave servers
-  dyndb api, a fast new api enabling BIND to serve zones stored
   in a database (Developed by Petr Spacek of RedHat)
-  RNDC showzone, view-only mode and other improvements
-  dnstap query and response logging (Robert Edmonds is the author
   of dnstap, see www.dnstap.info)
-  EDNS Client-subnet (authoritative server functions)
-  DNSSEC key manager, a new utility (Thanks to Sebastián Castro
   for helping with development.)
-  Automatic CDS/CDSKEY generation
-  Negative Trust Anchors for DNSSEC validators
-  IPv6 bias to encourage use of IPv6 DNS servers
-  Minimal response to “any” queries (Thanks to Tony Finch for
   the contribution)
-  DNS Cookies are now enabled by default, using the standardized code point

Changes:	https://lists.isc.org/pipermail/bind-announce/2016-June/000994.html
Sponsored by:	Absolight

022e70ccdc

2016-06-27 14:15Mathieu Arnold (mat)

Update to latest commit.

Sponsored by:	Absolight

ff40c7415d

2016-06-20 14:20Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

67bef9914f

2016-06-16 15:23Mathieu Arnold (mat)

Fix usage of WITH_OPENSSL_BASE, WITH_OPENSSL_PORT and OPENSSL_PORT.

WITH_OPENSSL_* can't be set after bsd.port.pre.mk.
Fold all other usage into using SSL_DEFAULT == foo

PR:		210149
Submitted by:	mat
Exp-run by:	antoine
Sponsored by:	The FreeBSD Foundation, Absolight
Differential Revision:	https://reviews.freebsd.org/D6577

5b55a8a53e

2016-06-14 17:15Mathieu Arnold (mat)

Update to latest commit.

Sponsored by:	Absolight

6cd6da01c6

2016-06-06 13:19Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

0ded294599

2016-05-30 12:02Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

588aaa2092

2016-05-25 15:28Mathieu Arnold (mat)

Add --with-dlopen=yes to the default options to allow using third parties dlz drivers.

While there:
- enable the DLZ_FILESYSTEM option by default
- convert to USES=mysql and USES=bdb

Requested by:	borius i ua
Sponsored by:	Absolight

8a1f0e9c1f

2016-05-23 22:35Dmitry Marakasov (amdmi3)

Remove NLS, DOCS, EXAMPLES and IPV6 from OPTIONS_DEFAULT, they are enabled by default anyway and don't need to be listed

Approved by:	portmgr blanket

c86e9d9724

2016-05-23 14:50Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

4b62ca4fd6

2016-05-17 14:34Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

3433d69d0f

2016-05-09 12:12Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

5c29fa2165

2016-05-02 15:17Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

7e0a3f915a

2016-04-29 12:51Mathieu Arnold (mat)

Fix-ish the build WITH=PYTHON

Pointy hat to:	mat (for testing a snapshot and commiting another.)
Sponsored by:	Absolight

3eca65be05

2016-04-29 12:05Mathieu Arnold (mat)

Update to latest snapshot.

While there, update the root hints file.

Sponsored by:	Absolight

371e34a3a5

2016-04-11 12:24Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

d80f87073a

2016-04-06 15:53Mathieu Arnold (mat)

Stop bringing in OpenSSL from ports, it builds fine with the base one on 9, and WITH_OPENSSL_PORT does not belong in a port's Makefile anyway.

Not bumping PORTREVISION because:
- if you are building with poudriere, it will detect that a dependency
  has changed and rebuild it.
- if you are building from ports, you will have OpenSSL from ports
  installed, and it will choose to use it.

Sponsored by:	Absolight

4668b601fb

2016-04-01 16:00Mathieu Arnold (mat)

Remove ${PORTSDIR}/ from dependencies, categories d, e, f, and g.

With hat:	portmgr
Sponsored by:	Absolight

4e1b79a0a6

2016-03-28 14:05Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

caf74018a1

2016-03-21 15:03Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

d0d07140c1

2016-03-14 15:24Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

691bf3a384

2016-03-09 22:16Mathieu Arnold (mat)

Update to 9.9.8-P4, 9.10.3-P4 and latest snapshot.

MFH:		2016Q1 (obviously)
Security:	CVE-2016-1285
Security:	CVE-2016-1286
Security:	CVE-2016-2088
Sponsored by:	Absolight

f6d0673391

2016-02-15 16:54Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

fb7767b969

2016-02-09 14:15Mathieu Arnold (mat)

Update to latest commit.

Sponsored by:	Absolight

b2d092a813

2016-02-01 17:00Mathieu Arnold (mat)

Mmm, some unintended change crept in, fix that.

Sponsored by:	Absolight

ffacf7b688

2016-02-01 13:43Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

5a2b52f29c

2016-01-25 13:03Mathieu Arnold (mat)

Update to latest snapshot.

Sponsored by:	Absolight

46c8f38e47

2016-01-19 22:13Mathieu Arnold (mat)

Update bind99 to 9.9.8-P3, bind910 to 9.10.3-P3 and bind9-devel to latest snapshot.

MFH:		2016Q1
Security:	CVE-2015-8704
Security:	CVE-2015-8705
Sponsored by:	Absolight

965159c123

2015-12-30 01:20Mathieu Arnold (mat)

Add the commit hash to the version.

Sponsored by:	Absolight

8c6491422d

2015-12-28 15:14Mathieu Arnold (mat)

Update to 7321d8d.

Sponsored by:	Absolight

60903cdb82

2015-12-21 23:53Mathieu Arnold (mat)

Remove that line, it should not have been there.

Sponsored by:	Absolight

123e2d3d03

2015-12-21 15:18Mathieu Arnold (mat)

Update to 20151219 snapshot.

- While there, update the named.root

Sponsored by:	Absolight

c9d6c84458

2015-12-16 01:45Mathieu Arnold (mat)

Update BIND9 to the latest patch releases, 9.9.8-P2, 9.10.3-P2, and snapshot.

MFH:		2015Q4
Changes:	https://kb.isc.org/article/AA-01326/81/BIND-9.9.8-P2-Release-Notes.html
Changes:	https://kb.isc.org/article/AA-01328/81/BIND-9.10.3-P2-Release-Notes.html
Security:	CVE-2015-3193
Security:	CVE-2015-8000
Security:	CVE-2015-8461
Sponsored by:	Absolight

ade4e0672d

devel/libmsiecf 1 unaddressed · 6.8	Oct 26
net/ndpi 1 unaddressed · 6.9	Oct 26
audio/speex 1 unaddressed · 8.3	Oct 26
devel/libphdi 1 unaddressed · 6.9	Oct 26
audio/furnace 2 unaddressed · 6.9	Oct 26
sysutils/libfvde 2 unaddressed · 6.8	Oct 26
audio/gbsplay 3 unaddressed · 6.8	Oct 26
archivers/snappy-java 4 unaddressed · 8.7	Oct 26
www/py-tornado 3 unaddressed · 5.3	Oct 26
sysutils/consul 4 CVEs · 8.8 fixed 2.1.0	Oct 26
comms/libimobiledevice +1 related 5 unaddressed · 6.9	Oct 26
devel/libgsf 1 unaddressed · 5.3	Oct 26
www/p5-Plack 1 unaddressed · –	Oct 25
www/p5-Starman 4 unaddressed · –	Oct 25
www/p5-Web-Simple 1 unaddressed · –	Oct 24

ImageMagick6	Oct 26
ImageMagick6-nox11	Oct 26
ImageMagick7	Oct 26
ImageMagick7-nox11	Oct 26
node	Oct 24
node22	Oct 24
node24	Oct 24
node26	Oct 24
traefik	Oct 24
ca_root_nss	Oct 23
gitlab-ce	Oct 23
gitlab-ee	Oct 23
mailpit	Oct 23
vifm	Oct 23
brotli	Oct 22
chromium	Oct 22
jackson-core	Oct 22
jackson-databind	Oct 22
jackson-databind	Oct 22
keycloak	Oct 22
linux-chrome	Oct 22
ungoogled-chromium	Oct 22
FreeBSD	Oct 21
p5-DBI	Oct 21
php82	Oct 21