Dashboard HTML pages are no longer cached, preventing stale content from being served after upgrades.
The IP allow/block plugins now support CIDR ranges in addition to single addresses and prefix matching.
Forwarding rules now support $RESOLVCONF:<file> to pick up upstream resolvers from a resolv.conf-style file, complementing the existing $DHCP syntax.
Recursive cloaking rules are now rejected at load time instead of being detected only when a matching query arrives.
Servers that hit a transient high RTT could previously stay penalized forever and never come back into rotation; their RTT estimate now decays so they can recover.
Servers are no longer penalized for slow responses when the response is actually being served from the stale cache.
HTTP/3 probing now consults a negative cache before retrying, avoiding repeated probes against servers known not to support it.
The HTTP transport now handles Alt-Svc: clear properly and reuses HTTP connections more aggressively.
The cache TTL is now an explicit, configurable parameter rather than being derived implicitly.
Log entries now include the relay name when a query was sent through an anonymized DNS or ODoH relay.
A new tls_prefer_rsa option has been added to prefer RSA cipher suites during the TLS handshake, useful on systems without hardware AES.
The tls_cipher_suite option is now a no-op. Modern TLS stacks no longer expose cipher suite selection in a meaningful way, and the option had become misleading.
The -resolve command now reports incomplete DNSSEC support instead of silently treating partial signatures as a success.
ODoH: the 401 key-refresh path has been hardened against panics, races and bad server state, refreshes are now coalesced, and the blocking sleep on refresh has been removed.
A log size of 0 no longer means "unlimited"; it now correctly disables rotation by size.
- jsdelivr is now offered as an alternative source URL for resolver lists, providing more redundancy when the primary mirrors are unreachable.
The miekg/dns library has been updated to the v2 series.
