- update to 4.4.3:
Improvements
Use a short-lived NSEC3 hashes cache for denial validation.
References: #9856, pull request 10221
Bug Fixes
More fail-safe handling of Newly Discovered Domain files.
Handle policy (if needed) after postresolve.
Return current rcode instead of 0 if there are no CNAME records to follow.
Lookup DS entries before CNAME entries.
Handle failure to start the web server more gracefully.
Test that we correctly cap the answer’s TTL in expanded wildcard cases.
Fix the gathering of denial proof for wildcard-expanded answers.
Make sure we take the right minimum for the packet cache TTL data in the SERVFAIL case.
For details see,
https://doc.powerdns.com/recursor/changelog/4.4.html#change-4.4.3