0.1.0-beta5 'Got that holiday feeling'

This is a breaking release, it is NOT backward compatible with 0.1.0-beta4. State files generated by earlier versions must be removed before starting the beta5 daemon.

Breaking changes

• Persist zone fixes and improvements. (#804 by @ximon18)

Bug fixes

• Overhaul how re-signing timers are managed, preventing race conditions causing
  crashes when zones are removed. (#863 by @bal-e, reported in #730 by
  @jpmens)
• Prohibit removing a zone while it is being restored from disk.
  ([#886] by @bal-e)

Other changes

• Speedup zone restore by parallelizing sorting. (#872 by @ximon18)
• Make logging during zone restoration consistent. (#874 by @ximon18)
• Improve memory use of NSEC(3) in incremental signing. (#842 by
  @Philip-NLnetLabs)
• Log the reason when unable to restore zone state on startup. (#878 by
  @ximon18)
• Add metrics for the duration of the last loading and signing operations.
  (#876 by @tertsdiepraam)

Known issues

• Removing a zone whilst it is being signed causes a panic. (#888)
• Removing a zone does not cleanup its persisted state files. (#889)

Acknowledgements

Thanks to @bortzmeyer, @bzwitt, @gryphius and @jpmens for testing Cascade and
providing valuable feedback!

0.1.0-beta4 'Irish Goodbye'

Breaking changes

• Remove systemd socket binding to port 53 in supplied packages (#847 by
  @ximon18).

Bug fixes

• If the input zone contains DNSSEC records, they are removed during signing,
  but (changes to them) were still showing up in IXFR output from the signed
  zone; remove them from IXFRs (#835 by @bal-e, reported in #798 by
  @gryphius).

• Overhaul how signing operations are enqueued for concurrency control,
  preventing aborted signing operations from accumulating memory (#789 by
  @bal-e, reported in #675 by @Philip-NLnetLabs)

Other changes

• Extend cascade tsig remove error to report the users of the key. (#719 by
  @ximon18)
• Reduce the memory use of RRSIGs during incremental signing. (#824 by
  @Philip-NLnetLabs)

Documentation improvements

• Update note about compatibility with NetHSM. (#621 by @jans23)
• Document the cascade info command (#838 by @ximon18)
• Add a CONTRIBUTING.md (#850 by @tertsdiepraam)

Known issues

• Cascade can crash due to a race condition when removing a zone. (#730,
  reported by @jpmens)

Acknowledgements

Thanks to @jpmens, @gryphius, and @jans23 for testing Cascade and providing
valuable feedback and contributions!

0.1.0-beta3 'Villa Volta'

Feedback welcome at https://community.nlnetlabs.nl/, bug reports can be raised at https://github.com/NLnetLabs/cascade/issues.

Breaking changes

• Return some proper JSON for the health API endpoint. (#810 by @tertsdiepraam)

New

• Add all policy info to the policy show command. (#738 by @tertsdiepraam)
• Print a message in list commands when no items can be shown. (#807 by @tertsdiepraam)
• Add CASCADE_DAEMON env var for the CLI. (#817 by @tertsdiepraam)
• Support importing keys by private key path as well as public key path. (#820 by @ximon18)
• Add basic info command to get daemon version. (#815 by @tertsdiepraam)

Bug fixes

• Prevent a crash when re-signing fails. (#821 by @bal-e)

Documentation improvements

• Add the word client to --version. (#814 by @tertsdiepraam)
• Document incremental signing. (#639 by @bal-e)
• More incremental signing docs. (#829 by @bal-e)

Known issues

• Restoring with a rejected signed zone in the history causes loss of the published zone. (#825)

Acknowledgements

Thanks to @davidgroves, @jpmens, @gryphius, and @marcgweg for testing Cascade and providing valuable feedback!

0.1.0-beta2 'Donde comen dos, comen tres'

This is a breaking release, it is NOT backward compatible with 0.1.0-beta1.
State files generated by earlier versions must be removed before starting the
beta2 daemon. Policy files will also need updating.

Feedback welcome at https://community.nlnetlabs.nl/, bug reports can be
raised at https://github.com/NLnetLabs/cascade/issues.

Breaking changes

• Rename policy field server.outbound.accept-xfr-from to
  server.outbound.provide-xfr-to (#722 by @ximon18).

New

• Add an extra decimal digit to formatted numbers like "4KB" in
  cascade zone status output (#794 by @tertsdiepraam)

Bug fixes

• Ignore re-signing without a published signed instance (#795 by @bal-e)
• Account for TTL-only changes in incremental re-signing (#803 by
  @Philip-NLnetLabs)

Documentation improvements

• Fixes and improvements to the "Zone Transfers" page. (#704 by @jpmens)
• required=true no longer seems to exist, hence remove its mention from
  comment. (#708 by @jpmens)
• Corrections to the "Key Management" documentation page. (#711 by @jpmens)
• Note in CLI help that the source to zone add can include a TSIG key name.
  (#714 by @ximon18)
• Fix position of colon ':' character in tsig add subcommand docs. (#716 by
  @ximon18)
• Add inline table example to policy template. (#720 by @jpmens)

Acknowledgements

Thanks to @jpmens and @gryphius for testing Cascade and providing valuable
feedback and contributions to the documentation.

0.1.0-beta1 'Slàinte mhath'

This is a breaking release, it is NOT backward compatible with 0.1.0-alpha5. State files generated by earlier versions must be removed before starting the beta1 daemon. Configuration files that use settings that are removed in this release will also need updating.

Since alpha5 there have been major internal architectural changes, rewrites to most of the code and changes in the format of the Cascade runtime state files. The architecture from an end user perspective is however mostly unchanged, with the exception of the output of cascade zone status and that the review hook functionality has been improved and extended.

These changes were made to ensure that Cascade zone pipelines are always in a single deterministic state, achieved by switching from an event producer-consumer model to a state machine based model, which resolves the inconsistent state issues observed with the alpha series of releases. Storage of zone record data has also been restructured to decrease memory usage. Note that incremental signing has not yet been tuned and thus improvements in memory consuption are expected in future releases.

Read on for a (non-exhaustive) summary of what has changed.

Feedback welcome at https://community.nlnetlabs.nl/, bug reports can be raised at https://github.com/NLnetLabs/cascade/issues.

Breaking changes

• Alpha series state files are not readable by this release. State files will therefore need to be deleted before running Cascade.
• Cascade now requires dnst version 0.2.0 or higher, the cascade specific cascade-dnst used by the alpha series lacks functionality required by this beta release. Users must upgrade to the latest dnst release and ensure that the dnst-binary-path config file setting points to the updated dnst binary.

New

• Add initial prometheus metrics (#405 by @mozzieongit)
• Incremental signing. (#536 by @Philip-NLnetLabs)
• Persist and restore zones. (#550 by @ximon18)
• Upstream and dnst keyset TSIG support. (#564 by @ximon18)
• TSIG downstream support and XFR in access control. (#587 by @ximon18)
• Add IXFR out support. (#605 by @ximon18)
• Add maintenance mode. (#610 by @tertsdiepraam)
• Soft halt. (#616 by @tertsdiepraam)
• Add signature-refresh-interval and key-roll-time. (#623 by @Philip-NLnetLabs)
• Add auto-remove-delay policy option. (#634 by @Philip-NLnetLabs)
• Send current SOA as unsecure hint in the ANSWER section with a NOTIFY.
  (#670 by @ximon18)

Bug fixes

• Also promote zone to signable when review is approved. (#398 by @ximon18)
• Support using BIND as a secondary nameserver. (#444 by @ximon18)
• Trigger global state save on zone add. (#496 by @mozzieongit)
• Also include CDS and CDNSKEY RRsets. (#566 by @Philip-NLnetLabs)
• Switch to exit_signalled from daemonbase to also handle SIGTERM. (#597 by @Philip-NLnetLabs)
• Ignore NOTIFY if the zone was sourced from a file. (#644 by @ximon18)

Other changes

• Added integration test framework (#370 by @mozzieongit).
  • Added tests using the new integration test framework.
• An entirely rewritten zone loader. (#402 by @tertsdiepram and @bal-e)
• Add prometheus metrics. (#405 by @mozzieongit)
• Trigger global state save on zone add. (#461 by @tertsdiepram)
• Remove hello world HTTP / response. (#559 by @ximon18)
• Require at least version 0.2.0 of dnst. (by @Philip-NLnetLabs)
• Config: Remove notify-listeners config option and renumber the default port numbers to close the resulting gap. (#518 by @tertsdiepraam)
• Logging: Enable axum tracing. (#475 by @ximon18)
• Logging: Log HTTP server listen addresses and mention remote control and metrics. (#489 by @mozzieongit)
• CLI: Add git commit hash to version string. (#468 by @mozzieongit)
• CLI: Mark options at the root as global so they can be specified after subcommands. (#368 by @tertsdiepram)
• CLI: Prefix cascaded --help output with a one line description of the application. (#409 by @ximon18)
• CLI: Reduce client timeout to 30 seconds. (#491 by @mozzieongit)
• CLI: Use 'tracing_subscriber' for logging. (by @bal-e)
• CLI: Improve CLI error messages on HTTP/TCP errors. (by @mozzieongit)
• CLI: Report back what changes were made to logging and require at least one option set. (#503 by @mozzieongit)
• CLI: Improve zone added CLI response based on user feedback. (#521 by @ximon18)
• CLI: Improve CLI HTTP error messages. (#490 by @mozzieongit)
• CLI: Add a CLI command to get the DS/DNSKEY/CDS RRset for a zone. (#539 by @mozzieongit)
• CLI: Status rework. (#567 by @tertsdiepraam)
• CLI: Add last error to zone status. (#600 by @tertsdiepraam)
• CLI: Report progress of zonefile loading. (#602 by @tertsdiepraam)
• CLI: Show TSIG key of source in output of CLI command zone status. (#615 by @ximon18)
• CLI: Improve zone history for incremental signing. (#660 by @Philip-NLnetLabs)
• Domain: Fix KeyPair for ED448. (#domain-608 by @Philip-NLnetLabs)
• Domain: Implement support for the RP record type. (#domain-620 by @mozzieongit)

Documentation improvements

• Add --bin dnst to keyset build from source docs. (by @mozzieongit)
• "Integrating with a SmartCard-HSM" page. (#191, #246 and #361 by @jpmens)
• "Integrating with a Nitrokey NetHSM" page. (#365 by @jpmens)
• Use a more appropriate log-target example file path. (#411 by @ximon18)
• Document stdout/err redirect to /dev/null on daemonize. (by @mozzieongit)
• Update docs. (#691 by @Philip-NLnetLabs)
• Maintenance mode docs. (#695 by @tertsdiepraam)

Building / Packaging

• Removed dependencies on 'async-trait', 'jiff' and 'syslog'. (by @bal-e)
• README.md was installed by the RPM package but not by the DEB package. (#428 by @ximon18)
• Add http1 feature to axum to fix cargo install build. (#473 by @tertsdiepraam)
• Implement panic hook to log panic message and backtrace to configured log target. (by @mozzieongit)

Policy changes

• New key-manager.auto-remove-delay.
• New key-manager.publication-nameservers.
• New key-manager.signature-refresh-interval.
• New key-manager.key-roll-time.
• loader.review.required replaced by loader.review.mode.
• loader.review.cmd-hook renamed to loader.review.hook.
• New loader.review.on-reject.
• signer.review.required replaced by signer.review.mode.
• signer.review.cmd-hook renamed to signer.review.hook.
• New signer.review.on-reject.
• New server.outbound.accept-xfr-from.

CLI changes

• New keyset get subcommand.
• New tsig subcommand.
• New zone override subcommand.
• New zone reset subcommand.
• New zone maintenance subcommand.

Acknowledgements

Our continued thanks to @jpmens, @bortzmeyer, @gryphius and also to @alarig, @ldc77shirt, @leoliang1987, @puzzle-it-nu and @Tachi107 for trying out Cascade.

0.1.0-alpha5 'Colline de la Croix'

Welcome to another release of Cascade, our new DNSSEC signer.

Check out the launch release notes to learn more about Cascade.

This release fixes some long-standing issues, relating to configuration files and DNSSEC rollover policies.

Our continued thanks to @jpmens, @bortzmeyer, and @gryphius for trying out Cascade.

Breaking changes

• cascade config reload has been removed. Configuration can only be reloaded
  by restarting Cascade. The command was never fully supported, since changes
  to many configuration settings would be ignored. (#330 by @bal-e)

New

• cascade debug change-logging can be used to change how Cascade logs
  information at runtime, which is a useful debugging aid. This functionality
  was previously provided by cascade config reload. (#330 by @bal-e)

• cascade status keys now prints information about DNSSEC keys and rollovers,
  across all known zones. It will prioritize keys with the soonest rollover
  actions. (#288 by @tertsdiepraam)

Bug fixes

• Changes to the [key-manager] section in zone policy will now propagate those
  changes into existing zones for that policy. (#355 by @Philip-NLnetLabs)

• The threads spawned by Cascade are now named cascade-worker instead of
  generic names like tokio-worker. (#356 by @tertsdiepraam)

Documentation improvements

• Note incompatibility with NitroKey v2.0.0 PKCS#11 module (#357 by @ximon18)

• Note file access limitations for review scripts (#358 by @tertsdiepraam)

0.1.0-alpha4 'Mont-Royal'

Welcome to another release of Cascade, our new DNSSEC signer.

Check out the launch release notes to learn more about Cascade.

This release makes some small quality-of-life changes, primarily thanks to @tertsdiepraam.

Our continued thanks to @jpmens, @bortzmeyer, and @gryphius for trying out Cascade.

New

• The stdout/stderr of review scripts is now logged (#281 by @tertsdiepraam)
• Cascade now logs its version number on startup (#286 by @tertsdiepraam)
• Cascade outputs more colorful logs (#287 by @tertsdiepraam)

Bug fixes

• Zone parsing errors now cause a soft-halt instead of a hard-halt (#280 by @tertsdiepraam)
• Signing statistics now present accurate values related to NSEC(3) (#271 by @bal-e)

Other changes

• Use tracing-subscriber for logging (#287 by @tertsdiepraam)

Documentation improvements

• Document Cascade's dependency on OpenSSL (#277 by @AlexanderBand)

0.1.0-alpha3 'Rue des Cascades'

Welcome to another release of Cascade, our new DNSSEC signer.

Check out the launch release notes to learn more about Cascade.

This release primarily expands on the documentation, but also fixes a few important bugs.

Many thanks go to @jpmens and @bortzmeyer for trying out the alpha release of Cascade, reporting issues, and even submitting PRs.

Breaking changes

• Cascade now loads configuration files when it (re)starts, instead of waiting
  for an explicit cascade config reload command. (#258 by @bal-e)

Bug fixes

• The Cascade CLI only produces color output on terminals, while respecting
  relevant environment variables. Previously it would unconditionally output
  color, even when called from a script or in a pipeline. (#256 by
  @tertsdiepraam)

• Errors from cascade keyset will no longer halt the pipeline (#265 by
  @tertsdiepraam)

• Resolve systemd startup failure (#233 by @ximon18)

Documentation improvements

• General refinement (#239, #240, #241, #257, #263, #264 by
  @AlexanderBand)
• Expand HSM documentation (#236, #246, #259 by @jpmens)
• Add man page for kmip2pkcs11 (#260 by @mozzieongit)

0.1.0-alpha2 'Cascader la vertu'

Welcome to another release of Cascade. our new DNSSEC signer.

Check out the launch release notes to learn more about Cascade.

This release fixes a number of bugs and adds a few usability improvements, plus we've continued to expand on the documentation. Keep watching, more to come!

Many thanks go to @jpmens and @bortzmeyer for trying out the alpha release of Cascade and extensively reporting the issues they found.

New

• Added a cascade health CLI subcommand by @ximon18 ([#208])
• Added a cascade status CLI subcommand by @ximon18 ([#211])
• Add CASCADE_SERVER_IP and CASCADE_SERVER_PORT environment variables for
  review hooks by @mozzieongit ([#213])

Bug fixes

• Resume the pipeline when a new zone is loaded by @bal-e and @ximon18 ([#153])
• Fix confusing error message when dnst is missing by @mozzieongit ([#158])
• Fix panic when started via systemd due to "No such device or address" by
  @mozzieongit ([#163])
• Set default CLASS for loaded zone files to IN by @mozzieongit ([#164])
• Fix home directory for useradd cascade in packages by @mozzieongit ([#171])
• Crashes when server not specified by @mozzieongit ([#172])
• "The TTL of the RRSIG exceeds the value of its Original TTL field" by
  @ximon18 ([#174])
• Fix error on startup "Could not load the state file: invalid type: map,
  expected a string" by @mozzieongit ([#184], [#189])
• Ensure dnst keyset warnings are logged and included in zone history
  by @ximon18 ([#207])
• Fix "Cannot acquire the queue semaphore" causing signing to be cancelled
  by @ximon18 ([#209])

Other changes

• Introduce stdout/stderr log targets to replace using File to log to stdout by
  @mozzieongit ([#176])
• Check for compatible dnst on startup by @mozzieongit ([#180])
• Use MultiThreadedSorter for faster sorting before signing by @ximon18
  ([#219])
• Pre-create /etc/cascade/policies when installing via DEB/RPM package ([#233])
• Set homepage and documentation properties in Cargo.toml by @maertsen
  (98d988d)

Documentation improvements

• Add documentation about integrating with a SmartCard-HSM by @jpmens ([#191])
• Make it clear that state is human-readable but not writable by @mozzieongit
  and @maertsen ([#188])
• Explicitly mention the need for config reload in the config file format man
  page by @mozzieongit ([#181])
• Use proposed/testing names where appropriate by @ximon18 ([#170])
• Fix the "unit-time" policy setting documentation by @jpmens ([#167])
• Remove non-existing variable in example review script comment by @jpmens
  ([#196])
• Add an intro to DNSSEC and a Glossary by @AlexanderBand ([#206])
• Don't fail to show signing statistics for a finished signing operation when
  a signing operation was subsequently aborted by @ximon18 ([#210])
• Improve documentation about review hooks by @mozzieongit ([#216])
• Simplify review script example mention need for faster sorting before
  signing by @mozzieongit ([#218])
• Add key management documentation by @Philip-NLnetLabs ([#225])
• Add approve/reject to cascade-zone man page by @ximon18 ([#227])
• Note steps required to upgare an alpha version of Cascade by @ximon18 ([#230])
• Document that some policy options also require a restart by @mozzieongit
  (6cdc126)
• Remove a broken link by @ximon18 (bbae66a)

0.1.0-alpha 'Globen'

We are pleased to announce the first release of Cascade, version 0.1.0-alpha ‘Globen’.

Cascade is a purpose-built, standalone DNSSEC signer, shaped by the real-world demands of TLD operators. Written from the ground up in Rust forsafety, stability and speed, Cascade will be the next generation DNSSEC signing solution. For 15 years OpenDNSSEC served the DNSSEC community as a trusted DNSSEC signer. With the end-of-life announcement of OpenDNSSEC the future begins here with Cascade, a DNSSEC signer updated for a new era of DNSSEC signing.

As an alpha release please do not use this in production. Our goal with this release is to enable operators to try out Cascade and to gather feedback. With a first production ready version expected in the first half of 2026, your feedback is key and will shape the development of Cascade as we steam ahead.

From the start we are offering packages for installation on major operating systems and documentation to guide you. Cascade is a work-in-progress but is already capable of signing to match your workflow including automatic or manual key rollovers, built-in approval gates that let you run your own scripts to prevent a bad zone escaping into the wild, and with support for both on-disk and HSM signing keys.

And of course as with all our products we will offer paid support contracts for Cascade whether to help you migrate or be there if you need us.

Read all about the vision behind Cascade in our earlier blog post, and get started today with our packages and documentation. If the documentation doesn't answer your question or give you the guidance you need, keep checking back, Cascade is being actively developed and documented. Even better, let us know what we're missing by opening a GH issue or sending an email to cascade@nlnetlabs.nl and we'll get right on it.

To try out Cascade right now follow the installation instructions in the manual.

Related links:

• Cascade launch announcement
• Cascade documentation
• Cascade packages
• Support services