BIND DNS suite with updated DNSSEC and DNS64
# pkg install bind920installs 9.20.30 from latest; from quarterly (2026Q4) 9.20.30# cd /usr/ports/dns/bind920 && make install clean# make -C /usr/ports/dns/bind920 config # change options first
BIND requires configuration of rndc, including a "secret" key. The easiest, and most secure way to configure rndc is to run 'rndc-confgen -a' to generate the proper conf file, with a new random key, and appropriate file permissions. The /usr/local/etc/rc.d/named script will do that for you. If using syslog to log the BIND9 activity, and using a chroot'ed installation, you will need to tell syslog to install a log socket in the BIND9 chroot by running: # sysrc altlog_proglist+=named And then restarting syslogd with: service syslogd restart
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 9.20.30 | 9.20.29 | – |
| FreeBSD 15 | 9.20.30 | 9.20.29 | – |
| FreeBSD 14 | 9.20.30 | 9.20.29 | 9.20.30 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 9.20.30 | 9.20.29 | – |
| FreeBSD 14 | 9.20.30 | 9.20.29 | 9.20.30 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 9.20.30.CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736
dns/bind920: update to 9.20.30 Changes: https://downloads.isc.org/isc/bind9/9.20.30/doc/arm/html/notes.html#notes-for-bind-9-20-30 Security: CVE-2026-19630 CVE-2026-94300 CVE-2026-96888 CVE-2026-9731307723360fc
databases/lmdb: allow to install both 0.x and 1.x together
LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.
Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc
A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.
Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.
Approved by: mat (portmgr)
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D6074185ba298b7e*: pet portfmt0768760099
dns/bind920: update to 9.20.29 Changes: https://downloads.isc.org/isc/bind9/9.20.29/doc/arm/html/notes.html#notes-for-bind-9-20-28 Security: CVE-2026-19668 CVE-2026-19033 CVE-2026-77119 CVE-2026-19941 CVE-2026-19666 CVE-2026-19667 CVE-2026-19662 CVE-2026-75029 CVE-2026-77692 CVE-2026-81736 CVE-2026-76163 CVE-2026-78301 CVE-2026-80274 CVE-2026-81563076689704f
dns/bind9*: building with heimdal is broken on 15+0760935063
dns/bind920: update to 9.20.27 Changes: https://downloads.isc.org/isc/bind9/9.20.27/doc/arm/html/notes.html#notes-for-bind-9-20-2707609280d7
dns/bind920: update to 9.20.26 Changes: https://downloads.isc.org/isc/bind9/9.20.26/doc/arm/html/notes.html#notes-for-bind-9-20-26 Security: CVE-2026-10723 CVE-2026-10822 CVE-2026-11331 CVE-2026-11605 CVE-2026-11622 CVE-2026-11721 CVE-2026-12617 CVE-2026-13204 CVE-2026-133210758206082
databases/lmdb0: Add port for LMDB 0.9.x legacy ABI LMDB 1.0 introduced an incompatible on-disk format change and subtle API breakage: applications that compiled cleanly against 1.0 headers could fail silently at run time. Known affected ports include dns/knot3, mail/bogofilter, and mail/postfix; the postfix issue has been confirmed upstream. Linux distributions such as Arch Linux have observed the same breakage. Samba can also be affected in certain configurations. Because the regression is not detectable in an -exp build run -- the postfix failure only manifests at run time, and bogofilter was caught only because post-build self-tests happen to exercise this path -- we cannot rely on package builds to validate the 1.0 upgrade. This commit introduces databases/lmdb0 as a holding port for the 0.9.35 release, pinned to the 0.x branch with PORTSCOUT=limit:^0. and mutually conflicting with databases/lmdb, which retains 1.0. The two packages cannot be installed simultaneously, but having lmdb0 available means: * Ports known to require the 0.9 ABI can declare an explicit dependency on databases/lmdb0 until they are validated against 1.0. * Users with existing databases in the 0.9 format can still access the mdb_dump and mdb_load utilities to migrate data before upgrading. * The package conflict prevents accidental mixing. All 50 direct dependents of databases/lmdb are redirected to databases/lmdb0 for now with a PORTREVISION bump, effectively restoring the tree to the state prior to the LMDB 1.0 update. Once all dependent ports are validated against LMDB 1.0, they will be moved back to databases/lmdb and databases/lmdb0 will be removed. PR: ports/2965305f9d389f29
dns/bind920: update to 9.20.24 Changes: https://downloads.isc.org/isc/bind9/9.20.24/doc/arm/html/notes.html#notes-for-bind-9-20-2407524920aa
dns/bind920: update to 9.20.23 Changes: https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html#notes-for-bind-9-20-23 Security: CVE-2026-3592, CVE-2026-3039, CVE-2026-5946, CVE-2026-5950, CVE-2026-5947, CVE-2026-35930747667068
dns/bind920: update to 9.20.22 Changes: https://downloads.isc.org/isc/bind9/9.20.22/doc/arm/html/changelog.html0739875049
dns/bind920: update to 9.20.21 Changes: https://downloads.isc.org/isc/bind9/9.20.21/doc/arm/html/notes.html#notes-for-bind-9-20-21 Security: CVE-2026-1519, CVE-2026-3104, CVE-2026-3119, CVE-2026-35910739234032
dns/bind920: update to 9.20.20 Changes: https://downloads.isc.org/isc/bind9/9.20.20/doc/arm/html/notes.html#notes-for-bind-9-20-20073679605a
dns/bind920: update to 9.20.1907360510eb
dns/bind9*: enable base GSSAPI on 15+ FreeBSD 15+ have MIT kerberos in the base system, and it fixes the problems BIND9 was having with Heimdal. PR: 2917800732837048
dns/bind9*: nsupdate works on 15+ with MIT kerberos from base FreeBSD 15+ have MIT kerberos in the base system, and it fixes the problems BIND9 was having with Heimdal. PR: 29177607328360c1
dns/bind920: update to 9.20.18 Changes: https://downloads.isc.org/isc/bind9/9.20.18/doc/arm/html/notes.html#notes-for-bind-9-20-18 Security: CVE-2025-138780732709037
dns/bind9*: move my regen-patches target from Makefile.local073270708d
dns/bind920: update to 9.20.17 Changes: https://downloads.isc.org/isc/bind9/9.20.17/doc/arm/html/notes.html#notes-for-bind-9-20-17072958401c
dns/bind920: update to 9.20.16 Changes: https://downloads.isc.org/isc/bind9/9.20.16/doc/arm/html/notes.html#notes-for-bind-9-20-160726211094
dns/bind*: strip shared libraries PR: 29059507237670aa
dns/bind920: update to 9.20.15 Update probable EOL according to ISC website Changes: https://downloads.isc.org/isc/bind9/9.20.15/doc/arm/html/notes.html07226300fe
dns/bind920: update to 9.20.13 Changes: https://downloads.isc.org/isc/bind9/9.20.13/doc/arm/html/notes.html#notes-for-bind-9-20-130718729092
dns/bind920: update to 9.20.12 Changes: https://downloads.isc.org/isc/bind9/9.20.12/doc/arm/html/notes.html#notes-for-bind-9-20-120716688062
dns/bind920: update to 9.20.11 Security: CVE-2025-407770713092ae6
*/*: Bump PORTREVISION for devel/protobuf-c update libprotobuf-c.so once again has version info. Force a rebuild of its consumers. PR: 282060 MFH: 2025Q3 Sponsored by: <If the change was sponsored by an organization.>f0ba732a81
libxml2: chase libxml soversion bump3068854dd0
dns/bind9*: fixup option description Reported by: John W. O'Brien071054522a
dns/bind9*: move xml statistics in an option PR: 2756800710534916
dns/bind9*: pet portfmt and portclippy0710533b66
dns/bind920: update to 9.20.100710355e0d
dns/bind920: update to 9.20.9 Changes: https://downloads.isc.org/isc/bind9/9.20.9/doc/arm/html/notes.html#notes-for-bind-9-20-9 Security: CVE-2025-4077507067607aa
dns/bind920: upgrade to 9.20.8 Changes: https://downloads.isc.org/isc/bind9/9.20.8/doc/arm/html/notes.html#notes-for-bind-9-20-80702694600
dns/bind920: update to 9.20.7 Changes: https://downloads.isc.org/isc/bind9/9.20.7/doc/arm/html/notes.html0700366454
dns/bind920: update to 9.20.6 Changes: https://downloads.isc.org/isc/bind9/9.20.6/doc/arm/html/notes.html069708526c
dns/bind920: upgrade to 9.20.5 Security: CVE-2024-11187, CVE-2024-1270506938960fb
*/*: Use Gnome helper for defining libxml2 dependency Replace LIB_DEPENDS with USES= gnome, USE_GNOME= libxml2 Approved by: portmgr (blanket)3b3700f8f0
dns/bind920: update to 9.20.4 Changes: https://downloads.isc.org/isc/bind9/9.20.4/doc/arm/html/notes.html0688679ca8
dns/bind920: update to 9.20.2 Changes: https://downloads.isc.org/isc/bind9/9.20.2/doc/arm/html/notes.html06790657ec
dns/bind9*: fix WITH_DEBUG build
The READLINE_CFLAGS="-L${LOCALBASE}/lib" env came with bind 9.18 with no
explanation. With 9.20 it actually breaks the developer build:
cc: error: argument unused during compilation: '-L/usr/local/lib' [-Werror,-Wunused-command-line-argument]
The --enable-symtable configure option is no longer supported by bind and
just produces a warning.
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D4654032b3642216dns/bind920: Update to 9.20.1 Changes: https://downloads.isc.org/isc/bind9/9.20.1/doc/arm/html/notes.html#notes-for-bind-9-20-1067485812e
dns/bind920: add BIND9 9.20 Changes: https://downloads.isc.org/isc/bind9/9.20.0/doc/arm/html/notes.html#notes-for-bind-9-20-00672207477