PowerDNS recursor の4.0.4が公開になってました。
更新内容は多めです。
Bug fixes
commit 658d9e4: Check TSIG signature on IXFR (Security Advisory 2016-04)
commit 91acd82: Don’t parse spurious RRs in queries when we don’t need them (Security Advisory 2016-02)
commit 400e28d: Fix incorrect length check in DNSName when extracting qtype or qclass
commit 2168188: rec: Wait until after daemonizing to start the RPZ and protobuf threads
commit 3beb3b2: On (re-)priming, fetch the root NS records
commit cfeb109: rec: Fix src/dest inversion in the protobuf message for TCP queries
commit 46a6666: NSEC3 optout and Bogus insecure forward fixes
commit bb437d4: On RPZ customPolicy, follow the resulting CNAME
commit 6b5a8f3: DNSSEC: don’t go bogus on zero configured DSs
commit 1fa6e1b: Don’t crash on an empty query ring
commit bfb7e5d: Set the result to NoError before calling preresolveAdditions and Enhancements
commit 7c3398a: Add max-recursion-depth to limit the number of internal recursion
commit 3d59c6f: Fix building with ECDSA support disabled in libcrypto
commit 0170a3b: Add requestorId and some comments to the protobuf definition file
commit d8cd67b: Make the negcache forwarded zones aware
commit 46ccbd6: Cache records for zones that were delegated to from a forwarded zone
commit 5aa64e6, commit 5f4242e and commit 0f707cd: DNSSEC: Implement keysearch based on zone-cuts
commit ddf6fa5: rec: Add support for boost::context >= 1.61
commit bb6bd6e: Add getRecursorThreadId() to Lua, identifying the current thread
commit d8baf17: Handle CNAMEs at the apex of secure zones to other secure zones
たぶん公式レポジトリから導入するのが一番簡単だと思います。
