# Notes for BIND 9.14.5

- A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added. [GL #605]

  If you are running multiple DNS Servers (different versions of BIND 9 or DNS server from multiple vendors) responding from the same IP address (anycast or load-balancing scenarios), you'll have to make sure that all the servers are configured with the same DNS Cookie algorithm and same Server Secret for the best performance.

- DS records included in DNS referral messages can now be validated and cached immediately, reducing the number of queries needed for a DNSSEC validation. [GL #964]

- Cache database statistics counters could report invalid values when stale answers were enabled, because of a bug in counter maintenance when cache data becomes stale. The statistics counters have been corrected to report the number of RRsets for each RR type that are active, stale but still potentially served, or stale and marked for deletion. [GL #602]

- Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause unexpected results; this has been fixed. [GL #1106]

- `named-checkconf` now checks DNS64 prefixes to ensure bits 64-71 are zero. [GL #1159]

- `named-checkconf` could crash during configuration if configured to use "geoip continent" ACLs with legacy GeoIP. [GL #1163]

- `named-checkconf` now correctly reports a missing `dnstap-output` option when `dnstap` is set. [GL #1136]

- Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #1133]