1#@!#!123s

��JFIF�� 1#@!#!123s
: / usr / share / doc / opendkim /
Filename : RELEASE_NOTES
back
			OPENDKIM RELEASE NOTES

This listing shows the versions of the OpenDKIM package, the date of
release, and a summary of the changes in that release.

2.11.0		2018/11/??
	Add support for ED25519 keys.  GNUTLS support provided by
		Dilyan Palauzov.
	Add "header.s" and "header.a" in generated Authentication-Results
		header fields.
	Add _FFR_CONDITIONAL, experimental support for conditional DKIM
		signatures.
	Make odkim.internal_ip() available to all Lua hooks.  Problem noted
		by Iosif Fettich.
	Make bind code DNSSEC-aware.  Patch from Jack Bates.
	Fix dkimf_db_nextpunct() so it doesn't incorrectly identify an encoded
		hex digit as a value delimiter.
	Fix issue #8: The password file critical section isn't big enough.
		Patch from Dilyan Palauzov.
	Fix issue #9: Plug a few failure mode memory leaks.  Patch from
		Dilyan Palauzov.
	Fix issue #15: Don't automatically skip the body when one mode (sign
		or verify) doesn't need it, because the other one might.
		Patch from Dilyan Palauzov.
	Fix issue #28: RequiredHeaders should report and log the specific
		error and reject the message, as documented.  Patch from
		Dilyan Palauzov.
	Fix bug #234: Make "NoHeaderB" do something.  Reported by Joseph
		Coffland.
	Fix bug #235: Quote "header.b" values in case they contain a slash
		(which must be quoted).
	Fix bug #237: Fix processing of "SoftStart".
	CONFIG: Add compatibility with openssl-1.1.0.  Patch from
		Scott Kitterman.
	CONTRIB: Simplfy some logic in contrib/repute.  Patch from
		Dilyan Palauzov.
	LIBOPENDKIM: Feature request #190: Reject signature object requests
		where the domain name or selector includes non-printable
		characters.  Suggested by Franck Martin.
	LIBOPENDKIM: Re-fix bug #226: Deal with header fields that are
		wrapped before there's any content.  Somehow the wrong fix
		was committed.  Originally reported by Alessandro Vesely;
		re-reported by David Stevenson.
	LIBOPENDKIM: Fix bug #233: In the weird case of duplicate signatures,
		constrain the size of the resulting "header.b" value.  Problem
		noted by Joseph Coffland.
	LIBOPENDKIM: Fix bug #270: Don't set an upper bound on the size of
		the canonicalization buffer, which interferes with processing
		oversized input lines.  Reported by Mars Peng.
	TOOLS: Feature requrest #187: Add option to match subdomains when
		generating zone files.  Patch from Andreas Schulze.

2.10.3		2015/05/12
	LIBOPENDKIM: Make strict header checking non-destructive.  The last
		change to this code resulted in failing signatures.  Reported
		by Pedro Morales and Wez Furlong.

2.10.2		2015/05/10
	Fix bug #221: Report a DKIM result of "policy" if MinimumKeyBits
		or UnprotectedKey cause the signature to result in a "pass"
		override.  Reported by Kurt Roeckx.
	Fix bug #227: Revert removal of SenderHeaders configuration setting.
		Document that it is now limited to signature selection.
	LIBOPENDKIM: Fix bug #226: Deal with header fields that are
		wrapped before there's any content.  Reported by
		Alessandro Vesely.
	CONTRIB: Update to contrib/systemd/opendkim.service.in from
		Steve Jenkins.

2.10.1		2015/02/03
	Fix bug #214: Handle arbitrarily large From: fields.  Reported by
		Tomohiko Sasaki.
	Fix bug #220: Make DB_SIGNINGTABLE symbol available in Lua scripts.
		Problem noted by Klaus Heinrich.
	LIBOPENDKIM: Fix bug #213: Remove "dkim_default_senderhdrs" from
		dkim.h.  Problem noted by Daniel J. Luke.
	LIBOPENDKIM: Fix bug #219: Unresolved CNAMEs are not failures,
		according to the DNS (see RFC6604), so report them as
		NXDOMAIN or similar.  Reported by Alessandro Vesely.

2.10.0		2014/12/27
	Feature request #182: Remove "AddAllSignatureResults".  All signature
		results will now be added via Authentication-Results header
		fields.  Requested by Tomki Camp.
	Feature request #180: Rename "LDAPSoftStart" to "SoftStart" and apply
		it to SQL connections as well.  Requested by Daniel Kauffman.
	Feature request #179: Add "IgnoreMalformedMail" option.
	Fix bug #183: Discontinue support for ADSP.  This removes the
		following configuration file items:
		AddAllSignatureResults	LocalADSP
		ADSPAction		NoDiscardableMailTo
		ADSPNoSuchDomain	On-PolicyError
		BogusPolicy		SendADSPReports
		DisableADSP		SenderHeaders
		LDAPSoftStart		UnprotectedPolicy
	Make "rrvs" and "smime" recognized Authentication-Results methods.
	LIBOPENDKIM: Feature request #157: Add dkim_mail_parse_multi().
		Suggested by Alessandro Vesely.
	LIBOPENDKIM: Feature request #185: Add dkim_set_dnssec().  Patch
		from Alec Peterson.
	LIBOPENDKIM: Fix bug #183: Discontinue support for ADSP.  This
		means all of the following:
		- the dkim_policy_t type has been removed
		- the DKIM_POLICY_* constants have been removed
		- the DKIM_PRESULT_* constants have been removed
		- passing DKIM_OPTS_SENDERHDRS to dkim_options() now
		  results in an error
		- the DKIM_PSTATE structure has been removed
		- all of the following functions have been removed:
		  dkim_policy(), dkim_policy_dnssec(),
		  dkim_policy_getqueries(), dkim_policy_getreportinfo(),
		  dkim_policy_state_free(), dkim_policy_state_new(),
		  dkim_policy_syntax(), dkim_getpolicystr(),
		  dkim_getpresult(), dkim_getpresultstr(),
		  dkim_set_policy_lookup(), dkim_test_adsp()
	LIBOPENDKIM: DKIM_LIBFLAGS_STRICTHDRS now also confirms syntactical
		validity of the From field before proceeding with a signing or
		verifying operation.  Suggested by Wez Furlong.
	CONTRIB: Fix bug #207: Clean up the "stats" directory.
	CONTRIB: Add "repute" directory which could eventually replace the
		PHP implementation.  Submitted by Daniel Black.
	CONTRIB: Patches to systemd and init/redhat from Steve Jenkins.

2.9.3		2014/12/27
        Fix bug #177: Plug leaking "result" structures when OpenLDAP is in use.
	Truncate configuration file lines at carriage return.
	Replace overlapping strlcpy() with memmove() in dkim_get_key_file().
		Reported by Daniel J. Luke.
	Patch #32: Re-arrange the execution logic to drop privileges in
		proper order.
	LIBOPENDKIM: dkim_header() is now a lot more strict about the input
		it will accept (see RFC5322 Section 2.2).
	LIBOPENDKIM: Tighten relaxed modes to break on only DKIM-defined
		whitespace characters.  Problem noted by Elizabeth Zwicky.
	LIBOPENDKIM: Fix bug #208: If a signature fails to verify for either
		reason (header hash mismatched or body hash mismatched), set
		DKIM_SIGERROR_BADSIG so that Authentication-Results doesn't
		report a failure with "no signature error".
	TOOLS: Feature request #178: Add "-F" flag to opendkim-genzone so
		records are created with the FQDN.  Patch from Andreas Schulze.
	REPUTATION: Handle parameters safely in repute.php.  Reported by
		Daniel Black.

2.9.2		2014/04/02
	Fix some conflicting unit tests.  Reported by Eray Aslan.
	BUILD: Fix bug #195 part II: Compile all binaries with pthreads
		support as needed by libopendkim features.  Reported by
		Walter Haidinger.
	BUILD: Fix packaging damage with autobuild.  Reported by Andreas
		Schulze.

2.9.1		2014/03/15
	Feature request #177: Add "LuaOnlySigning" so that only the Lua setup
		script makes signing requests; suppresses automatic application
		of the signing table.  Requested by Daniele Orlandi.
	Fix bug #185: odkim.signfor() wasn't processing its arguments
		properly.  Reported by Daniele Orlandi.
	Fix bug #199: Fix use of uninitialized buffer when generating
		SMTP response strings due to ADSP rejections.  Problem
		noted by Ache.
	Fix infinite loop when mlfi_connect() is called with a hostname
		starting with a "." character.  Reported by Philip Guenther.
	Fix loading of refiles when trailing spaces are present in the value.
		Problem noted by Amal Francis.
	LIBOPENDKIM: Only call dkiml_dns_close() if there was a
		dkiml_dns_service handle set by dkiml_dns_init().  Also,
		when closing, reset that handle to NULL.
	LIBOPENDKIM: The various dkim_dns_set_*() functions, when passed a
		NULL function pointer, merely store it, making the
		corresponding function a no-op.  Previously, doing
		so restored the default.
	LIBOPENDKIM: Have dkim_sig_getreportinfo() return descriptors
		(if available) regardless of the signer's reporting parameters.
		Problem noted by Wez Furlong.
	BUILD: Fix bug #188: Clean up last remnants of libstrl.
	BUILD: Fix bug #190: Check for HAVE_SUN_LEN in opendkim-db.c.
		Problem noted by Patrick Laimbock.
	BUILD: Fix bug #191: Better minimum version checks for libmemcached.
		Problem noted by Patrick Laimbock.
	BUILD: Fix bug #192: Different test for libevent, from Patrick
		Laimbock.
	BUILD: Fix bug #193: Don't throw away user-provided compilation
		variables.  Problem noted by Quanah Gibson-Mount.
	BUILD: Fix bug #195: Compile opendkim-genzone with pthreads support.
		Reported by Walter Haidinger.
	BUILD: Fix bug #202: Fix pkg-config check for GNUTLS.  Reported by
		Dilian Wesselinov Palauzov.
	BUILD: Fix bug #203: opendkim-genzone requires pthreads.
	BUILD: Patch #29: Look for libmilter in lib64.  Patch from
		Dilian Wesselinov Palauzov.
	BUILD: Patch #30: Include libdl when linking in Lua.  Patch from
		Dilian Wesselinov Palauzov.
	BUILD: Don't throw away user-provided compilation variables.
		Problem noted by Quanah Gibson-Mount.
	BUILD: Rename "--with-mdb" to "--with-lmdb" for consistency
		with that package's naming conventions.
	CONTRIB: Fix bug #184: Update to contrib/systemd/opendkim.service
		from Steve Jenkins.
	MILTERTEST: Add "polite" flag to mt_disconnect().
	TOOLS: Fix bug #187: Increase buffer size for the private key in
		opendkim-testkey.  Problem noted by Andreas Schulze.
	TOOLS: Fix opendkim-spam to match the schema found in stats/mkdb.mysql.
		Problem noted by Benny Pedersen.

2.9.0		2013/12/09
	NOTE: During the development cycle for this release, SourceForge
		changed their bug numbering system.  Bug numbers are recorded
		here as they were generated by the current system at the time
		they were filed.  The older ones (prefixed "SF") have since
		been renumbered or may no longer be in the system.
	Feature request #169: Discontinue libxml2 support in the reputation
		code.
	Feature request #174: Drop internal libstrl implementation.
	Feature request #175: Discontinue support for libdkimrep.
	Feature request #176: Update to the final REPUTE RFCs.
	Activate _FFR_REDIRECT.
	Fix bug #178: Add support for "dmarc" as an authentication method
		(though it hasn't been formally registered yet) and fix
		a minor Authentication-Results parsing problem.  Problem
		noted by Martin Kauchler.
	Fix bug #179: Correct handling of SignatureTTL.  Problem noted by
		Kyle Cummings.
	Fix bug #180: Drain results object when doing a DB walk of a postgresql
		table.  Problem noted by Szucs Adam.
	Fix bug #182: Add an Authentication-Results header field even for
		messages with no valid From: field or a fatal structural
		violation.  Reported by John Wood.
	Teach dkimf_db_walk() about LDAP soft starting, and don't escape the
		forced "*" when walking.  Also handle incorrect attribute
		counts without causing an assertion failure.  Problem noted
		by Andreas Schulze.
	Call dkimf_config_free() on shutdown so that all DBs get properly
		closed and everything gets deallocated.
	LIBOPENDKIM: Fix bug #168: Report an unresolved CNAME for ADSP records
		as simply absent.  Suggested by Eugene Crosser.
	LIBOPENDKIM: Add DKIM_LIBFLAGS_REQUESTREPORTS to request that an
		"r=y" tag be added to signatures, per RFC6651.
	TOOLS: Fix boundary condition in opendkim-testmsg.  Reported by
		Wez Furlong.
	DOCS: Feature request #168: Improve documentation of signature
		verification failure debugging features.
	DOCS: Feature request #172: Describe socket selection procedure in
		detail, and mention selinux command to get set up.  Suggested
		by Kevin San Diego.

2.8.4		2013/07/15
	Fix bug #169: Add "::1" to the default InternalHosts list.  Suggested
		by Norbert Aschendorff.
	Fix bug #171: Escape "+" character in regex generation.  Reported
		by Scott Kitterman.
	Fix bug #172: Repair broken AutoRestartRate logic.  Patch from
		Sho Kubata.
	Fix bug #SF3603525: Discard duplicate results from non-DKIM methods.
		Problem noted by John Wood.
	Fix bug #SF3611976: Fix up quarantine option handling.  Problem noted
		by Claus Assmann.
	TOOLS: Fix bug #SF3609716: Fix meaning of "-S" in opendkim-genkey.
		Problem noted by Quanah Gibson-Mount.
	BUILD: Fix bug #SF3612816: Build compatibility with Lua 5.2.  Patch
		from Hirohisa Yamaguchi.

2.8.3		2013/05/04
	Log something when refusing to sign because the private key was too
		small.  This also adds a new "On-SignatureError" handler
		setting, and a new status code DKIM_STAT_SIGGEN.  Problem
		noted by Jim Fenton.
	Fix application of "On-InternalError" setting.  Problem noted by
		Claus Assmann.
	Feature request #SF3609496: Don't apply reputation checks to internal
		clients.

2.8.2		2013/03/27
	Authentication-Results tokens should be checked without case
		sensitivity.  Problem noted by Chris Meidinger.
	Fix snprintf() arguments in dkimf_checkfsnode().  Problem noted by
		Scott Kitterman.
	CONTRIB: Patch #SF3608716: Fixes to spec/opendkim.spec.in from
		Kouhei Sutou.

2.8.1		2013/03/19
	Fix bug #SF3607071: Report the reason why a key file is determined
		to be unsafe.  Problem noted by Doug Barton.
	Fix bug #SF3607072: When checking for key file safety, take any
		"-u" value provided on the command line into account.
		Problem noted by Doug Barton.
	Fix bug #SF3608401: Solaris 10 doesn't have strsep().  Problem noted
		by Bryan Costales.
	BUILD: Fix build for versions of libdb between 3.1 and 4.6.
		Problem noted by John Wood.

2.8.0		2013/02/25
	Feature request #SF2964383: Add DKIM_LIBFLAGS_STRICTRESIGN, which
		inhibits signing of a handle tagged for resigning when the
		attached verifying handle had no valid signatures in it.
	Feature request #SF3155117: Do a more thorough check for writeable
		key files, checking more of the filesystem permission tree.
	Feature request #SF3530734: Add "LDAPDisableCache", which suppresses
		the creation of a local cache in front of LDAP queries.
		Requested by Quanah Gibson-Mount.
	Feature request #SF3547359: If compiled with libcurl, add "SMTPURI"
		configuration option that allows direct SMTP transmission
		failure reports.  Requested by Andreas Schulze.
	Feature request #SF3578197: Allow per-message override of the list of
		header fields to be signed.  Requested by Alec Peterson.
	Feature request #SF3590860: Combine collected reputation values into
		an overall allowed rate under _FFR_REPRRD, as is done for the
		other reputation code.
	Feature request #SF3598991: Add odkim.signfor() function to the Lua
		setup script.  Requested by Marcin Owsiany.
	Feature request #SF3599409: Modify dkimf_checkip() to try surrounding
		the IP address part of every query with square brackets, which
		is a common way to do IP address literals in email contexts.
		Requested by Quanah Gibson-Mount.
	Fix bug #SF3531477: Add (hopefully temporary) configuration option
		"DisableCryptoInit" so that opendkim's initialization of the
		crypto library doesn't conflict with the same work done by
		other libraries.  Reported by Quanah Gibson-Mount.
	Fix bug #SF3599901: Rename "InsecureKey" to "UnprotectedKey" and
		"InsecurePolicy" to "UnprotectedPolicy", as the term "insecure"
		in reference to a key is sometimes interpreted to mean "not
		enough random bits" rather than as a keyword describing the
		presence or absence of DNSSEC protection.  What's logged in
		Authentication-Results header fields has been similarly
		modified.  Suggested by Scott Kitterman.
	Fix bug #SF3604525: Don't divide by zero when the query cache hasn't
		been used.  Reported by Denis Klimov.
	Protect against handling of signatures with empty domains, which could
		cause a NULL dereference and a crash.  Problem noted by
		Motohiro Ishiyama and John Wood.
	Do ATPS checks when enabled even if ADSP is disabled.
 	Don't fail to start on empty or null configuration files.  Problem
 		noted by Steve Jenkins.
	Patch #SF3593422: Update for MDB 0.9.5 support.  Patch from
		Quanah Gibson-Mount.
	LIBOPENDKIM: Fix header canonicalization when DKIM_LIBFLAG_FIXCRLF is
		used in combination with dkim_chunk().  Problem noted by
		Dave Kelly and Heather Lord.
	LIBOPENDKIM: Enable dkim_getcachestats() and the underlying function
		to extract the current number of keys in the cache, and also
		provide a counter reset mechanism.
	BUILD: Feature request #SF3547151: Check for Lua package name variants
		in use on Debian.  Requested by Scott Kitterman.
	BUILD: Feature request #SF3599902: Change OpenSSL existence test
		to help with Debian packaging.  Requested by Scott Kitterman.
	BUILD: Add "--with-test-socket" to force all of the filter unit tests
		to use a specific socket.  Based on a bug report from
		Scott Kitterman.
	BUILD: Add checks for strlcat()/strlcpy() in libbsd.  Patch from
		Scott Kitterman.
	CONTRIB: Fix bug #SF3575666: Pass pid file path to killproc.
		Suggested by Christophe Wolfhugel.
	CONTRIB: Add systemd directory.  Contributed by Steve Jenkins.
	CONTRIB: Split out initial key generation function from
		contrib/init/redhat/opendkim.  Contributed by Steve Jenkins.
	MILTERTEST: Don't crash in mt_connect() if the socketspec doesn't
		contain a colon.
	MILTERTEST: When connect() fails for an AF_INET socket, it apparently
		leaves the socket unusable.  Discard the socket when that
		happens and get a new one.
	MILTERTEST: Add a way to extend the mt.connect() retry interval via
		environment variables so a large test suite can be easily
		extended on slow systems.  Problem noted by Scott Kitterman.
	TOOLS: Register DNS functions before calling dkim_dns_init() in
		opendkim-testkey.  Problem noted by Jeff Anton.
	TOOLS: Add "-K" (keep temporary files) flag for opendkim-testmsg.

2.7.4		2013/01/06
	Fix bug #SF3596147: Allow arbitrarily long configuration file lines.
		Based on a patch from Daniel Black.
	Fix bug #SF3596229: Fix logging of signature errors, which logged
		the domain name twice instead of the domain name and the
		selector.  Patch from Daniel Black.
	Safely handle incoming Authentication-Results fields with large number
		of tokens.  Problem noted by Motohiro Ishiyama and John Wood.
	Avoid mixing up status codes when processing conf_logresults, leading
		to confusing log entries.  Problem reported by John Wood.
	Fix ADSP logging.  Problem noted by Claus Assmann.

2.7.3		2012/11/29
	Log DB error string in dkimf_add_signrequest(), and fix a DSN handling
		error in dkimf_db_strerror().  Problem noted by
		Simone Caruso.
	LIBOPENDKIM: Ignore entries in the oversign header field name list
		that are empty, and an oversign header field name list that
		is present but empty.  Problem noted by Alec Peterson.
	LIBOPENDKIM: Allow header field lists to be empty, flushing any that
		were previously defined.  Problem noted by Alec Peterson.
	BUILD: Improve tests for including <strl.h>.  Based on a patch from
		Eray Aslan.
	REPUTATION: Use lowercase for keywords in REPUTE query generation
		and handling.
	STATS: Clean up a dead link in opendkim-genstats.  Patch from Andreas
		Schulze.

2.7.2		2012/11/14
	Log the author domain name when rejecting or discarding due to ADSP.
	LIBOPENDKIM: Improve re-entrancy of dkim_eoh() when verifying.
		Requested by Alec Peterson.
	LIBOPENDKIM: Only do a single read attempt of a private key under
		GNUTLS to avoid hiding a useful error code.  Problem noted
		by Alec Peterson.
	STATS: Add long option support for opendkim-importstats.  Based on
		a patch from Christian Roessner.
	STATS: Fix overly-strict domain name rules in opendkim-reportstats.
		Reported by Christian Roessner.
	TOOLS: Fix opendkim-genkey subdomains default.  Problem noted by
		Quanah Gibson-Mount.
	TOOLS: Fix opendkim-testmsg GNUTLS initialization.  Problem noted
		by Alec Peterson.
	TOOLS: Add ability to assert a reporter ID to opendkim-spam.  Based
		on a patch from Christian Roessner.
	TOOLS: Add ability to skip a fixed number of Received: fields.
		Problem noted by Christian Roessner.
	TOOLS: Print a warning when asked to generate a key smaller than
		the recommended minimum.
	BUILD: Fix bug #SF3585163: Use a provided libstrl if detected.
		Based on a patch from Eray Aslan.
	BUILD: Portability fixes for Solaris 10 from Claus Assmann and
		Leena Heino.

2.7.1		2012/10/30
	Fix bug #SF3581657: Fix faulty logic in LDAP open code.  Problem noted
		by Quanah Gibson-Mount.
	Fix bug #SF3581743: Properly handle NULLs returned from OpenDBX
		queries and low field counts in dkimf_db_walk().  Problem
		noted by Adam M. Jacques.
	In the _FFR_REPUTATION code, free JSON objects when done with them.
	TOOLS: Fix argument parsing in new version of opendkim-genkey.
		Problem noted by Steve Jenkins.

2.7.0		2012/10/24
	Feature request #SF2964375: Reject configuration files that have
		a SigningTable referencing a missing or malformed KeyTable
		entry.
	Feature request #SF3544764: Support for libar has been discontinued.
		For asynchronous and/or thread-safe resolver service,
		use libunbound or a suitable version of BIND.
	Feature request #SF3545658: Replace "ResolvConf" with "Nameservers"
		and add support for NS list overrides for versions of bind
		that have res_setservers().  Also rename "UnboundConfigFile"
		to "ResolverConfiguration", and make "TrustAnchorFile"
		generally available.
	Feature request #SF3547124: Skip reputation checks on passing
		signatures whose keys had a "t=y" value.
	Feature request #SF3555842: Add "ReputationTest" setting.  Requested
		by Andreas Schulze.
	Feature request #SF3556439: Update opendkim-atpszone per RFC6541.
	Feature request #SF3559744: Add library option DKIM_OPTS_MINKEYBITS
		allowing one to specify a minimum number of key bits for
		acceptable keys and signatures.  This is exposed through new
		configuration file option "MinimumKeyBits".  The default
		is 1024.
	Fix bug #SF3536414: Activate _FFR_OVERSIGN, and remove
		DKIM_OPTS_ALWAYSHDRS.
	Fix bug #SF3536655: Rename "X-Header" to "SoftwareHeader", and rename
		all header fields added that start "X-" to remove that prefix,
		per RFC6648.  The old name will be accepted through the end
		of the 2.7.x line.
	Fix bug #SF3538896: Remove antiquated CVS Id: tags, which cleans up
		some (harmless) build warnings.  Suggested by Andreas Schulze.
	Fix bug #SF3548741: Add "ReputationTimeout" for use inside
		_FFR_REPUTATION, rather than using the built-in default
		or a hard-coded one.
	Fix bug #SF3549307: Remove _FFR_REPUTATION_CACHE, as it is redundant
		to caching code that's part of _FFR_REPUTATION already.
	Fix bug #SF3555844: Get repute client code in sync with repute.php
		(and the current REPUTE WG drafts).  Problem noted by
		Andreas Schulze.
	Fix bounds checking in the dstring printf functions.
	Fix loop structure in the C side of odkim.get_rcpt().  Problem
		noted by Todd Lyons.
	Change all temporary directory defaults from /var/tmp to /tmp.
	Activate _FFR_LUA_GLOBALS.
	Request the milter permissions required to get _FFR_REDIRECT working.
		Patch from Andreas Schulze.
	Add _FFR_REPRRD, which is a second approach to DKIM-based reputation
		using round robin databases and Holt-Winters foreacasting
		using rrdtool (see http://oss.oetiker.ch/rrdtool/).  Still
		experimental.
	Patch #SF3555843: With sufficient verbosity, report the default
		configuration file path.  Patch from Andreas Schulze.
	BUILD: Fix bug #SF3531658: Move the strlcat() and strlcpy()
		implementations to their own library so that programs don't
		drag in crypto and other dependencies they don't need.
		Also clean up several other unnecessary dependencies imposed
		by imprecise use of autoconf.  Problem noted by Andreas
		Schulze.
	BUILD: Patch #SF3555845: Add support for older versions of libcurl.
		Based on a patch by Andreas Schulze.
	BUILD: Install non-user things in sbin instead of bin.  Suggested
		by Andreas Schulze.
	LIBOPENDKIM: Feature request #SF3565006: Add dkim_add_querymethod()
		and dkim_sig_seterror(), define DKIM_CBSTAT_DEFAULT, and
		remove an assertion in dkim_get_key_dns(), which together
		allow for applications to develop non-standard key retrieval
		mechanisms.  Suggestion and patches from Ken Murchison.
	LIBOPENDKIM: Fix bug #SF3559080: Log correct domains and selectors
		with SSL errors.
	LIBOPENDKIM: Add DNS functions dkim_dns_config(), dkim_dns_init(),
		dkim_dns_nslist(), dkim_dns_set_init(), dkim_dns_set_close(),
		dkim_dns_set_nslist(), dkim_dns_set_config(),
		dkim_dns_set_trustanchor(), dkim_dns_trustanchor().
	LIBOPENDKIM: Patch #SF3562496: Add DKIM_OPTS_REQUIREDHDRS to allow
		alteration of the mandatory header field set.  Patch from
		Ken Murchison.
	LIBOPENDKIM: If "q=" is present and method "dns" is specified, it
		must be followed by "/txt", per RFC6376.
	LIBOPENDKIM: For dkim_add_xtag(), copy the provided values so the
		caller doesn't have to keep them around.
	LIBOPENDKIM: Allow dual signing of a single body with dkim_resign().
		Suggested by Ken Murchison.
	STATS: Fix bug #SF3555847: Add "--nocircles" to opendkim-gengraphs
		to allow operation with versions of gnuplot that don't know
		what "with circles" means.  Problem noted by Andreas
		Schulze.
	STATS: Patch #SF3555841: Temporary table SQL correction.  Patch from
		Andreas Schulze.
	TOOLS: Feature request #SF3553918: Add "-u" flag to opendkim-atpszone
		and opendkim-genzone enabling them to produce output suitable
		for use as input to nsupdate(8).  Based on a suggestion by
		Dave Crocker.
	TOOLS: Feature request #SF3558818: Teach opendkim-testkey about the new
		"ResolverConfiguration" setting.  Based on a problem report
		from Patrick Ben Koetter.
	TOOLS: Fix bug #SF3565013: Replace opendkim-genkey with a perl script
		that knows how to do splitting of character-strings in DNS
		TXT records.  Problem reported by Todd Lyons.
	TOOLS: Fix bug #SF3568846: Add "-t" to opendkim-testmsg to allow
		override of the directory where temporary files go.  Also,
		clean up temporary files after creating them.
	TOOLS: Add opendkim-rephistory.

2.6.7		2012/07/23
	Fix input handling for file data sets for the macro case.  Problem
		noted by Allan Wind.
	Ensure NULL-termination of macro value tests.
	STATS: Fix hang bug in opendkim-reportstats.  Problem noted by
		Todd Lyons.
	STATS: Fix bug #SF3547363: Fix "Top 10" and DNSSEC trend reports.
		Problem noted by Andreas Schulze.

2.6.6		2012/07/18
	LIBAR: Fix bug #SF3544522: Not all systems define a "_len" member for
		the sockaddr structures.  Reported by Stevan Bajic.
	LIBOPENDKIM: Fix bug #SF3545490: If the body handed to the library was
		missing a trailing line terminator, then dkim_canon_closebody()
		would end the hashes with some data not included.  Now, if
		DKIM_LIBFLAGS_FIXCRLF is set, it will detect this condition
		and correct it; if not, an error is returned.  Problem noted
		by James Erickson.
	LIBOPENDKIM: If the job ID passed in during handle creation includes
		slashes and temporary file creation is enabled, convert the
		slashes to dots in the temporary file template.  Problem
		noted by James Erickson.

2.6.5		2012/07/14
	Swap order of "header.d" and "header.i" values in
		Authentication-Results fields.
	BUILD: Fix bug #SF3543282: Corrections to Darwin/libar build adjustment
		made in 2.6.3.  Problem noted by Daniel J. Luke.
	
2.6.4		2012/07/12
	Feature request #SF3542099: Include "header.d" in all
		Authentication-Results fields, not just "header.i".  This
		makes life easier for users of OpenDMARC.
	BUILD: Fix SHA256 test on some systems.  Problem noted by James
		Erickson.

2.6.3		2012/07/11
	Add "ResolvConf" setting, allowing the ability to pass a
		resolv.conf-like file to unbound to allow specific nameservers
		to be used instead of the default.
	LIBOPENDKIM: Return the correct error code when a SHA1-only library
		encounters a SHA1 signature that references a SHA256-only key.
		Problem noted by Andrew Birchall.
	LIBAR: Add ar_resolvconf().
	BUILD: Fix bug #SF3538676: Build with -DDARWIN on MacOSX, and default
		to arlib if unbound isn't selected.  Patch from Daniel J. Luke.

2.6.2		2012/07/02
	Fix build confusion between _FFR_RATE_LIMIT and _FFR_RESIGN.
		Problem noted by Rolf Sonneveld.
	Fix bug #SF3538639: Fix error when --domain is not provided to
		opendkim-genrates.  Problem noted by Andreas Schulze.
	Fix bug #SF3539449: Clarify legal "Socket" values.  Requested
		by Scott Kitterman.
	Fix bug #SF3539493: Handle certain cases of data set names that
		appear to be comma-separated lists which include IPv6
		addresses.  Reported by Scott Kitterman.

2.6.1		2012/06/25
	Restore and activate _FFR_SELECT_CANONICALIZATION.  Also adds a
		SelectCanonicalizationHeader configuration option.
	Remove _FFR_SELECTOR_HEADER.
	Update Authentication-Results parsing to understand "dkim-atps"
		(RFC6541) and no longer understand "hardfail" (RFC6577).
	LIBAR: Fix bug #SF3309946: Ensure the dispatcher doesn't hold the
		master lock when it might enter a read wait.
	STATS: Add a database index on messages.msgtime to aid with
		expiration performance.
	TOOLS: Feature request #SF3536385: Add "-a" to opendkim-genkey to
		include a domain name in the generated TXT record.
		Requested by Quanah Gibson-Mount.

2.6.0		2012/06/07
	Feature request #SF3495969: Add support for Lua v5.2.0.  Requested
		by Rolf Sonneveld.
	Feature request #SF3502777: Log all authentication results rather than
		relying on logging of Authentication-Results header fields.
		Requested by Andreas Schulze.
	Feature request #SF3512286: Add "LDAPSoftStart" flag so the filter
		doesn't abort on startup when LDAP is not available.
	Feature request #SF3512836: Add _FFR_SOCKETDB, which enables support
		for a generic socket data set.
	Feature request #SF3514982: Add Erlang data set support.  Patch
		provided by Andre Nathan.
	Feature request #SF3516253: Update to newest "repute" working group
		documents, which mainly means adding JSON support and
		promoting application-specific extensions to the top level
		in the reputon structure.
	Feature request #SF3518593: Add support for OpenLDAP's MDB as a
		data set backend.  Requested by Quanah Gibson-Mount.
	Feature request #SF3519002: Put reason information inside a "reason"
		tag in Authentication-Results header fields rather than in
		comments.
	Feature request #SF3521000: Log hostname and daemon name (taken from
		macros) when logging "no MTA name match".  Requested by
		Andreas Schulze.
	Feature request #SF3524756: Add ability to request TCP keepalive
		features via the OpenLDAP client library.  Requested by
		Quanah Gibson-Mount.
	Feature request #SF3529233: Add odkim.get_envfrom() to all Lua scripts.
		Requested by Charles Cazabon.
	Fix bug #SF3518877: Separate variable expansion from literal text in
		opendkim-genkey.
	Fix bug #SF3522883: Allow TLS for ldapi URIs.  Problem noted by
		Quanah Gibson-Mount.
	Fix bug #SF3527428: Construct the LDAP URI list properly, rather than
		only keeping the last one, and add failover code.  Problems
		noted by Quanah Gibson-Mount.
	Patch #SF3522895: Add contrib/ldap/opendkim.ldif.  Contributed
		by Quanah Gibson-Mount.
	Activate _FFR_XTAGS.
	Remove _FFR_SELECT_CANONICALIZATION.
	LIBAR: Fix bug #SF3444318: Do proper buffer size calculations to
		avoid valgrind warnings about references to unaddressable
		space.  Reported by Todd Lyons.
	LIBOPENDKIM: Fix bug #SF3496041: Remove _FFR_PARSETIME.
	LIBOPENDKIM: Fix bug #SF3516653: By default, treat a syntax error
		in an ADSP record as an NXDOMAIN.  Add new library flag
		DKIM_LIBFLAGS_REPORTBADADSP to restore the original
		behaviour.  Suggested by Scott Kitterman.
	LIBOPENDKIM: Fix bug #SF3524865: Disallow generation of signatures
		where signer and signing domain don't match per the DKIM
		specification.  Add DKIM_LIBFLAGS_DROPSIGNER which, if set,
		will still generate signatures in that case, but with the
		signer omitted so the signature is still compliant.
	BUILD: Fix bug #SF3425384: Add missing support for compiling
		against libevent2, which is an option for unbound.
		Noted by Andreas Schulze.
	BUILD: Fix bug #SF3475799: Don't do a manual check for libdb.a.
		Use the AC_CHECK_* macros instead.
	DOCS: Fix bug #SF3518864: The license for IETF documents is not
		compatible with free software licensing, which makes packaging
		a bit of a chore.  Replace all the text files in the "docs"
		directory with a single HTML page that includes links to
		all the things we used to include here.  Requested by
		Scott Kitterman.
	STATS: Feature request #SF3110059: Move opendkim-reportstats from
		contrib/stats to stats, making it fully supported.
	STATS: Feature request #SF3525786: Add opendkim-expire script.
		Requested by Andreas Schulze.
	STATS: Feature request #SF3528652: Allow a specific list of domains,
		possibly read from a file, for opendkim-gengraphs and
		opendkim-genrates.  Requested by Andreas Schulze.

2.5.2		2012/04/09
	Fix bug #SF3496208: Replace stats/opendkim-genstats with a perl
		script so it's far more efficient.
	Fix bug #SF3514793: Pass proper flags to libdb when creating
		temporary LDAP caches.  Problem noted by Sergey Romanov.
	Fix a crash bug when using LocalADSP with a message with no
		parseable From: field.  Problem noted by John Merriam.
	Fix a crash bug when using LDAP with authentication when LDAPAuthUser
		is not defined.  Problem noted by Christian Roessner.
	STATS: Fix bug #SF3510729: Convert stats/opendkim-gengraphs to a perl
		script.

2.5.1		2012/03/15
	Fix bug #SF3496131: Fix query cache build problem.  Reported by
		Dilian Wesselinov Palauzov.
	Fix bug #SF3500660: Add Date: header field to generated reports.
		Reported by Andreas Schulze.
	BUILD: A few subsidiary libraries need to know about -lresolv on
		systems that need it.  Reported by Scott Kitterman.
	STATS: Add "-E" command line flag to opendkim-importstats, forcing
		an abort on any input error.

2.5.0		2012/02/29
	#####################################################################
	###                                                               ###
	###  This release is dedicated to the memory of J.D. Falk, a      ###
	###  tireless champion of anti-abuse technology and collaboration ###
	###  and a founding member of the Board of the Trusted Domain     ###
	###  Project, a participant in related IETF work, and a long-time ###
	###  particpant and supporter of MAAWG.  J.D. was taken by cancer ###
	###  on November 16, 2011.  His enthusiasm and perspective for    ###
	###  all of this work will be sorely missed.                      ###
	###                                                               ###
	#####################################################################
	Feature request #SF3385816: Discontinue DomainKeys support.
	Feature request #SF3393282: Update ARF output per
		draft-ietf-marf-authfailure-report-03 et seq.
	Feature request #SF3406814: Add ability to invoke chroot().
		Requested by Andreas Schulze.
	Feature request #SF3477908: Update DKIM reporting per
		draft-ietf-marf-dkim-reporting-10.
	Add "WeakSyntaxChecks" suppressing some short-circuiting error checks
		on syntax.  Requested by Todd Nagengast. 
	Allow a set of test files to be passed via "-t" rather than just one.
	Add _FFR_REPUTATION, and several new support libraries (in the
		libut/ and reputation/ directories) for doing DKIM-based
		reputation evaluations of arriving messages.  Full
		documentation of the algorithms will appear in an upcoming
		white paper.  This also includes several new configuration
		options that make use of reputation data pulled from servers:
			ReputationCache
			ReputationCacheTTL
			ReputationLimits
			ReputationLowTime
			ReputationMinimum
			ReputationLimitModifiers
			ReputationRatios
			ReputationSpamCheck
			ReputationTimeFactor
		For now these are briefly documented in reputation/README.
		As this subsystem matures, they will be fully documented in
		opendkim.conf(5).
	Fix bug #SF3471520: Don't crash when the first line of a configuration
		file is an "Include" instruction.  Reported by Dilian
		Wesselinov Palauzov.
	Fix bug #SF3475149: Apply RFC2254 encoding to LDAP queries.
		Problem noted by Yoshiaki Yanagihara.
	LIBOPENDKIM: Feature request #SF3317160: Per RFC6376, remove
		granularity checks.
	LIBOPENDKIM: Feature request #SF3385768: Add dkim_privkey_load(),
		allowing validation of a private key before reaching
		end-of-message.  Requested by Heikki Gruner.
	LIBOPENDKIM: Feature request #SF3423226: Copy header field name lists
		instead of using the caller's copy.  Suggested by
		Heikki Gruner.
	LIBOPENDKIM: Update list of header fields that should be signed
		per RFC6376.
	LIBOPENDKIM: Don't report the absence of "c=" as an error, since
		there is a default.
	LIBOPENDKIM: Add DKIM_SIG_CHECK() macro.  Suggested by Heikki
		Gruner.
	LIBAR: Fix bug #SF2917856: Rename "ar.h" to "async-resolv.h" since
		"ar.h" is already in common use.
	STATS: Feature request #SF3397903: Drop all support for data needed
		for the DKIM Implementation Report, as it has been completed.
		Leave stuff that's useful for reputation R&D.
	STATS: Feature request #SF3402857: Modify opendkim-spam to be able
		to write update records to statistics files.
	STATS: Feature request #SF3439384: Make opendkim-importstats more
		backend-agnostic.  Requested by Andreas Schulze.
	TOOLS: Add opendkim-testmsg, for signing/verifying messages without
		all the milter code being invoked.  Requested by
		Todd Nagengast.
	CONTRIB: Add LDAP documentation and examples.  Provided by
		Patrick Ben Koetter.

2.4.3		2011/12/26
	Fix bug #SF3400670: Send ADSP failure reports when rejecting
		a message.  Reported by Andreas Schulze.
	Fix bug #SF3419149: Add MaximumSignedBytes to opendkim-config.h.
		Reported by Adam Bernstein.
	Fix bug #SF3441240: Apply ReportBccAddress when generating ADSP
		reports.  Reported by Richard Rognlie.
	Fix bug #SF3447199: Fix logic preventing the application of the
		BodyLengthDB.  Problem noted by Richard Rognlie.
	Fix Authentication-Results generation with "AddAllSignatureResults"
		enabled.  Reported by Todd Nagengast.
	Fix a crash bug when trying to handle certain malformed header fields
		in verify-only mode.  Reported by Todd Lyons.
	Improve error checking in the callback provided to libunbound to
		avoid crashes.  Problem noted by Todd Lyons.
	Cope with versions of Sleepycat DB that crash when asking for a file
		descriptor for in-memory databases.  Problem reported by
		Todd Lyons.
	Don't override "On-NoSignature" when "Quarantine" is set.  Reported
		by Jarry Jeremy.
	Ignore header field names that contain semi-colons, as they produce
		syntactically invalid signatures.  Problem noted by
		Heikki Gruner.
	LIBOPENDKIM: Fix bug #SF3465400: Don't use "new" as a parameter name
		in dkim.h since that's an error for C++.  Reported by
		Amit Schreiber.
	LIBOPENDKIM: NOERROR is the same as NXDOMAIN for the purposes of
		the ADSP existence check.  Problem noted by Todd Nagengast.
	LIBOPENDKIM: Return DKIM_STAT_SYNTAX from dkim_header() if the header
		field name contained a semi-colon.
	LIBAR: After computing a timeout, if the fractional seconds portion
		adds to exactly a second, convert that amount to seconds.
		Previous versions only converted when the fractional portion
		exceeded a second.  This led to threads that spin
		indefinitely.  Problem noted by Todd Lyons and Gary Mills;
		forensic evidence revealing the problem at long last provided
		by Todd Lyons.
	STATS: Fix a crash bug in opendkim-importstats due to improper handling
		of NULL returns from SQL.  Reported by Andreas Schulze.

2.4.2		2011/08/05
	Don't apply BodyLengthDB when not signing.  Problem noted by
		Andreas Schulze.
	LIBOPENDKIM: Update for draft-kucherawy-dkim-atps-06.
	LIBOPENDKIM: Terminate the strings returned by dkim_sig_getsubstring()
		and dkim_sig_getidentity() whenever possible.  Suggested by
		Heikki Gruner.
	CONTRIB: Change "chkconfig" instruction in RHEL init script,
		and a minor tweak to the RPM spec file.  From Steve Jenkins.

2.4.1		2011/06/28
	Fix bug #SF3312691: Add "-e" command line switch to extract a value
		from configuration.
	Fix bug #SF3324488: Accommodate postfix's job ID generation by moving
		the BodyLengthDB check down to EOH.  Reported by Andreas
		Schulze.
	Fix bug #SF3327106: Fix mode-based short-circuit logic.  Reported
		by Yoshiaki Yanagihara.
	Patch #SF3321766: Remove "-d" from usage message (not implemented).
		Patch from Andreas Schulze.
	Print database error strings instead of just return codes in
		query test mode, and clean up error strings when extracting
		them from the layers below.
	Minor fixes related to use of OpenDBX.
	LIBOPENDKIM: Fix bug #SF3328330: Correct generation of "z=" tags.
		Problem reported by Christophe Wolfhugel.
	LIBOPENDKIM: Patch #SF3313534: Improve thread-safe use of OpenSSL
		in dkim_init() and dkim_free().  Patch from Masatake Daimon.
	LIBOPENDKIM: Patch #SF3314269: Change all uses of off_t to
		ssize_t, as the former is reserved for use with filesystem
		APIs.  Patch from Manuel Mausz.
	LIBOPENDKIM: Make the user context pointer (void) rather than
		(const void) since the caller is allowed to change it.
		Problem noted by Heikki Gruner.
	LIBOPENDKIM: Proper handling of DKIM_CBSTAT_ERROR from the prescreen
		and final callbacks.  Problem noted by Heikki Gruner.
	LIBOPENDKIM: Fix up initialization under _FFR_OVERSIGN.  Problem
		noted by Eray Aslan.
	BUILD: Adjust gprof code to accomodate systems that put profiling
		output in <binary>.gmon rather than gmon.out.

2.4.0		2011/06/06
	Feature request #SF3060140: Extension of odkim.sign() to include
		maximum signed byte count.
	Feature request #SF3171865: Add _FFR_LUA_GLOBALS, enabling a
		mechanism to maintain state between Lua scripts.
	Feature request #SF3241982: Optionally add an Authentication-Results
		field for all signatures present, not just the first good
		one.
	Feature request #SF3256630: Add _FFR_RATE_LIMIT, enabling hooks for
		post-verification rate controls.
	Feature request #SF3290461: Add optional support for querying a
		memcache daemon via libmemcached.
	Feature request #SF3299041: Be tougher on use of the "l=" tag by
		removing "BodyLengths", renaming "BodyLengthDBFile" to
		"BodyLengthDB", and allowing pattern matches.  This
		effectively activates _FFR_BODYLENGTH_DB as well.
	Feature request #SF3303911: Add "DisableADSP" setting.
	In the stats recording code, only check for a domain match for
		signatures that don't have errors (i.e., short circuit if
		sigerror is not zero).
	LIBOPENDKIM: Feature request #SF2969516: Teach dkim_chunk() about
		DKIM_LIBFLAGS_FIXCRLF.
	LIBOPENDKIM: Feature request #SF3123731: Extend FixCRLF to cover
		header fields.
	LIBOPENDKIM: Feature request #SF3151534: Extract DKIM reputation
		support to its own library.
	LIBOPENDKIM: Feature request #SF3279589: Add _FFR_XTAGS, adding
		support for generic extension tags in signatures.
	LIBOPENDKIM: Feature request #SF3300738: Add dkim_sig_getqueries()
		and dkim_policy_getqueries() to assist API consumers that
		have their own DNS mechanisms not directly adaptable to ours.
		Requested by Heikki Gruner.
	LIBOPENDKIM: Return an error from dkim_getsighdr() or
		dkim_getsighdr_d() if called after a key load failure.
		Problem noted by Heikki Gruner.
	LIBAR: Check that the descriptor's write socket is writable before
		calling ar_sendquery() when trying to identify open requests
		that need retransmission.
	STATS: Feature request #SF3066106: Add "opendkim-anonstats" tool.
	CONTRIB: Paths in init/redhat/opendkim are now auto-generated.
	Activate _FFR_MAXVERIFY.

2.3.2		2011/04/14
	Fix bug #SF3067338: Create a pool of DB handles for SQL operations
		so that queries don't all share one serially.
	Fix bug #SF3156559: Don't compile Lua scripts anew for each execution.
	Fix bug #SF3210385: Fix issue with configuration reload failures
		having some side effects on the remaining active configuration
		handle.  Reported by Andreas Schulze.
	Fix bug #SF3235131: Don't report ADSP errors as signature errors
		in Authentication-Results header fields.
	Fix bug #SF3258459: Don't send progress messages during EOH.  Problem
		reported by Gary Mills.
	Add ADSP processing error information to A-R header fields.
	LIBOPENDKIM: Fix bug #SF3276469: When generating "z=" tags, apply
		omit and sign header field lists.  Problem noted by Todd Lyons.
	LIBOPENDKIM: Use a time_t to store TTL and clock drift options
		rather than unsigned long.  Patch from Piotr Sikora.
	LIBAR: Include class and type in debugging messages.  Suggested
		by Gary Mills.
	LIBAR: Start the dispatcher on the first query, not in ar_init().
		Allows ar_init() to be called before a fork() safely.
	CONTRIB: Adjust installed path in RedHat start script.  Patch
		from Naresh V.
	CONTRIB: Require the current libopendkim in the opendkim definition
		in the RPM spec file.  Patch from Naresh V.

2.3.1		2011/03/28
	Feature request #SF3196060: Log retrieved reputation values.
		Patch from Andreas Schulze.
	Feature request #SF3199824: Don't log "no signature data" unless
		LogWhy is enabled or the action for unsigned mail is something
		other than "accept".
	Fix bug #SF3196069: Log more detail when dkimf_config_setlib() fails.
		Problem noted by Andreas Schulze.
	Fix bug #SF3197890: Update ARF report format for DKIM verification
		failures to use what's in draft-ietf-dkim-marf-reporting.
	Fix bug #SF3204725: Add "ReplaceHeaders" data set to constrain what
		header fields are affected by "ReplaceRules".  Problem
		noted by Chris Callegari.
	Fix bug #SF3211114: Extract "BaseDirectory" from configuration
		file properly.
	Fix bug #SF3234178: Correct handling of a KeyTable entry for which the
		key data is empty.  Based on a patch from Yoshiaki Yanagihara.
	Patch #SF3205699: Make all header field name and domain name data
		sets case insensitive.  Submitted by Richard Rognlie.
	Add a case-insensitivity flag to odkim.db_open().
	Minor correction to DNS function return codes for unbound, which
		doesn't have an expired/no-reply distinction like libar does.
	LIBOPENDKIM: Fix up timeout handling with a DNS callback is in use.
	LIBOPENDKIM: Update for draft-kucherawy-dkim-atps-03.
	STATS: Fix bug #SF3195449: Omit data from reporters that are not
		currently marked "enabled" in the reporters table.
	STATS: Evaluate "i=" against the "d=" domain, not the "From" domain.
		Problem noted by Mark Martinec.
	STATS: A few more reports.
	MILTERTEST: Don't use non-standard printf() conversions.
	MILTERTEST: Get the SMFIP_HDR_LEADSPC logic right.
	TOOLS: Feature request #SF3200848: Add a backgrounding option
		(on by default) to opendkim-spam.

2.3.0		2011/02/21
	Feature request #SF2964396: Allow SignHeaders, OmitHeaders and
		SenderHeaders to be specified as deltas to the default lists.
	Feature request #SF3053094: Correct documentation and improve function
		of the AuthservID configuration setting.  Requested by
		Andreas Schulze.
	Feature request #SF3060152: Add odkim.replace_header() function.
	Feature request #SF3060161: Add odkim.del_header() function.
	Feature request #SF3061189: Add new "quarantine" option to all the
		various "On-" settings.
	Feature request #SF3066104: Add "AnonymousDomains" configuration
		option.
	Feature request #SF3074290: Add _FFR_ATPS, experimental support for
		draft-kucherawy-dkim-atps.
	Feature request #SF3076684: Add "VBR-TrustedCertifiersOnly" flag.
	Feature request #SF3080604: Add odkim.parse_field() function.
		Requested by Todd Lyons.
	Feature request #SF3081697: Add "OversignHeaders" configuration
		option.
	Feature request #SF3085536: Activate _FFR_STATS_I, providing
		statistics reporting about use of "i=" in signatures.
	Feature request #SF3096630: Add odkim.rbl_check() function.
	Feature request #SF3097083: Make SigningTable accessible from Lua.
	Feature request #SF3103095: Allow "%" in a KeyTable entry's filename
		component as well as the domain name.
	Feature request #SF3105480: Improved VBR correctness; don't conduct
		VBR checks at all if there are disagreeing "mc" values in
		multiple VBR-Info header fields.
	Feature request #SF3106132: Allow "%" in a SigningTable's value.
	Feature request #SF3109963: Add "MaximumSignaturesToVerify" setting.
		Suggested by John Wood.
	Feature request #SF3110593: Add compile-time support for GnuTLS as
		an alternative to OpenSSL.  Suggested by Alessandro Vesely.
	Feature request #SF3136772: Sign the VBR-Info header field, if added.
		Requested by Frederik Pettai.
	Fix bug #SF3134119: With AutoRestart enabled, arrange to relay
		SIGUSR1 from the parent to the child rather than terminating.
		Reported by Yoshiaki Yanagihara.
	Fix bug #SF3141313: Trim whitespace from values in in-core data
		sets.  Reported by Todd Lyons.
	Fix bug #SF3156124: More robust handling of database disconnects.
		Also add _FFR_POSTGRESQL_RECONNECT_HACK, which will hopefully
		be temporary.  Reported by Miha Vrhovnik.
	Fix bug #SF3181180: Correct handling of quoted strings containing
		parentheses (and the opposite) when parsing
		Authentication-Results header fields.  Reported by
		Mark Martinec.
	Fix back-compatibility with very old implementations of milter in MTAs.
	Fix case-insensitive matching for domain names when doing signing
		selection.  Problem noted by John Espiro.
	New configuration file options:
		- "CaptureUnknownErrors", replacing the FFR of the same name
		- "DNSConnect", requesting the resolver use TCP mode
		- "KeepAuthResults", suppressing required removal of
		  Authentication-Results header fields
		- "ResolverTracing", adding detailed logging of libar activity
		- "StrictHeaders", requesing libopendkim to assert header
		  field counts according to the standards
		- "UnboundConfigFile", passing a configuration file name to
		  libunbound (suggested by Andreas Schulze)
		- "VBR-PurgeFields", removing "X-VBR-*" fields after using them
	Trim whitespace from the end of all values in a config file, not just
		strings.  Problem noted by Reuben Farrelly.
	Assume a default location for opendkim.conf.  Suggested by Andreas
		Schulze.
	Don't needlessly demand milter features, causing aborts when they're
		not available.  Problem noted by Todd Lyons.
	Make odkim.get_clienthost(), odkim.get_clientip() and
		odkim.get_fromdomain() available in the final script.
	When "SyslogSuccess" is active, log the selector and domain used.
		Suggested by Miha Vrhovnik.
	LIBAR: Feature request #SF3115073: Add flag for fine-grained activity
		logging for debugging purposes.
	LIBAR: Add support for using poll() instead of socket().
	LIBOPENDKIM: Feature request #SF3087029: Add DKIM_LIBFLAGS_STRICTHDRS.
	LIBOPENDKIM: Feature request #SF3089990: Add dkim_sig_getsignedhdrs().
	LIBOPENDKIM: Fix bug #SF3079094: Have dkim_diffheaders() take
		canonicalization into account when generating its results
		to avoid false positives.
	LIBOPENDKIM: Fix bug #SF3184670: Add error codes for missing and empty
		"v=" tags, thus avoiding a possible assertion failure when
		DKIM_LIBFLAGS_BADSIGHANDLES is in use.  Reported by J. Coloos.
	LIBOPENDKIM: Fix up handling of multi-TXT DNS replies inside
		dkim_get_policy_dns().
	LIBOPENDKIM: Add dkim_getid().
	LIBOPENDKIM: Treat no answers as an NXDOMAIN with respect to
		retrieving ADSP records.
	LIBOPENDKIM: When an unexpected DNS type or class is received,
		log the received values.
	LIBVBR: Feature request #SF3105477: Copy the generic DNS work from
		libopendkim.
	LIBVBR: Feature request #SF3127200: Add proper documentation (i.e.,
		a man page).
	STATS: Feature request #SF3085536: Activate _FFR_STATS_I, providing
		statistics reporting about use of "i=" in signatures.
	STATS: Feature request #SF3125701: Add "s=" key value tracking.
	STATS: Feature request #SF3137445: Track key sizes.  Suggested by
		Todd Lyons.
	MILTERTEST: When asserting negotiation state, don't forget to capture
		what was negotiated.
	TOOLS: Feature request #SF3106876: Amend opendkim-testkey to return
		the DNSSEC results as well.
	TOOLS: Feature request #SF3074290: Add a zone file generation tool
		for ATPS.
	TOOLS: Fix bug #SF3143922: Command line parameters to opendkim-testkey
		now override their configuration file counterparts.
	TOOLS: Experimental new "opendkim-spam" tool to let users update a
		stats database to indicate a message is spam, for possible
		later correlation use.
	BUILD: opendkim-genzone needs LIBCRYPTO_LDFLAGS.  Reported by
		John Smith.
	Activate _FFR_CAPTURE_UNKNOWN_ERRORS.

2.2.2		2010/11/28
	Fix bug #SF2903325: Clean up numerous signed vs. unsigned warnings.
	Fix bug #SF3095782: When VBR is enabled, only perform a query when
		the "md" domain in the VBR-Info header field matches the
		"d" field for any valid signature.
	Fix bug #SF3105993: Better handling of missing records in Lua DB
		lookups.  Reported by Luci Stanescu.
	When reading keys, ensure what's being read is a regular file and
		not something else.
	Complain if TrustAnchorFile names something that can't be opened
		for reading.
	LIBOPENDKIM: Don't complain about multiple records returned if one
		of them was an RRSIG.  Problem noted by Andreas Schulze.
	LIBAR: Rework some I/O logic to avoid a deadlock when the nameserver
		becomes unresponsive during response processing.  Problem
		noted by Gary Mills.
	BUILD: Move all scripts and executables except opendkim to a bin
		directory for adminstrator convenience.  They were previously
		in sbin.
	BUILD: Fix bug #SF3101842: Fix opendkim-genzone build when OpenDBX
		is in use.
	BUILD: opendkim-testkey can require SASL build information when used
		with OpenLDAP, or Lua information when built with Lua.
	BUILD: Dissociate libopendkim and libunbound, as this is now handled
		through the application rather than the library.
	BUILD: Convert to using git for source code management.
	STATS: Additional reporting improvements.
	STATS: Fix bug #SF3107659: Add additional diagnostic output to
		opendkim-importstats when malformed input is found.
	TOOLS: Handle input generated with and without the _FFR_STATS_I
		extensions.  Problem noted by Graham Murray.

2.2.1		2010/10/25
	Avoid assertion failures when using "-V" and arlib.
	Fix "refile" loading.  Problem noted by Steve Jenkins.
	Fix collision between "ReputationRoot" and "StatisticsName" in the
		configuration file.  Reported by Andreas Schulze.
	Convert sender's domain name to lowercase prior to doing any database
		queries with it.  This was done before, but lost during the
		database overhaul in 1.2.0.  Reported by Gary Mills.
	Fix up Authentication-Results header field generation for VBR.
		Reported by Fredrik Pettai.
	Add _FFR_STATS_I enabling statistics reporting of "i=" signature
		properties.
	LIBOPENDKIM: Fix bug #SF3081964: dkim.h requires <sys/time.h>.
		Patch from Kaspar Brand.
	LIBOPENDKIM: Fix bug #SF3087251: Use thread-safe resolver functions
		when avaialble.  Problem noted by Christian Pelissier.
	LIBOPENDKIM: Cancel completed reputation queries.  Problem noted
		by John Wood.
	LIBOPENDKIM: Simplify DKIM_OPTS_ALWAYSHDRS handling.
	LIBAR: Fix bug #SF3080720: Don't compute timeouts based on completed
		or dead queries.  Problem noted by John Wood.
	LIBVBR: Fix some pointer errors causing false negatives.  Problem
		noted by Fredrik Pettai.
	TOOLS: Write "v=" tags in key records output by opendkim-genzone.

2.2.0		2010/10/03
	Feature request #SF2874043: Add _FFR_ADSP_LISTS allowing control over
		action taken when mail is sent to known lists from
		ADSP "discardable" sources.
	Feature request #SF2964366: Allow arbitrary data set operations
		from inside Lua script hooks.
	Feature request #SF2981598: Add "NoHeaderB" and "SingleAuthResult"
		settings so that only one Authentication-Results header field
		is added, and reduce its variability.  Requested by Gary Mills.
	Feature request #SF3013084: Add "DomainKeysCompat" setting.
	Feature request #SF3017358: Allow a token in the KeyTable that gets
		replaced with the sender's domain name.
	Feature request #SF3019876: Enable registration and use of generic
		DNS functions.
	Feature request #SF3021566: Change "ADSPDiscard" to "ADSPAction",
		allowing selection of what action to take when a message is
		determined by ADSP to be "discardable".
	Feature request #SF3023232: Allow selection of a signer (for the
		signature's "i=" tag) when calling odkim.sign() or via an
		optional second parameter in the SigningTable.
	Feature request #SF3024854: Always log a warning if a key file
		has unsafe group/other read/write bits set.  Further, if the
		new "RequireSafeKeys" setting is true, refuse to use the data.
	Feature request #SF3030548: Add _FFR_DEFAULT_SENDER, adding the
		"DefaultSender" setting.  Requested by Andreas Schulze.
	Feature request #SF3049483: Use ReportAddress for ADSP Reports and for
		the sender envelope address.  Reported by Andreas Schulze.
	Feature request #SF3056571: Extend signer selection in the SigningTable
		to include a token that will be replaced by the From:
		domain.  Requested by Richard Rognlie.
	Feature request #SF3062077: Allow the specification of additional 
		recipients when delivering DKIM/ADSP failure reports through
		a new ReportBccAddress configuration option.  Requested by 
		Andreas Schulze.
	Fix bug #SF3004995: Don't apply "SenderHeaders" to the library
		as that impacts how ADSP works.
	Fix bug #SF3025856: Fix "AllowSHA1Only", which was not working at all.
	Fix bug #SF3037504: Rework database schema and tools to meet revised
		reporting requirements.
	Fix bug #SF3051536: Allow disabling of reputation queries.  Requested
		by Andreas Schulze.
	Fix bug #SF3058204: Fix numerous possible double-free() incidents in
		dkimf_config_free().  Reported by Richard Rognlie.
	Fix PeerList to work with IPv6 addresses.
	Fix loop boundary check in dkimf_db_close().  Reported by Richard
		Rognlie.
	Fix assertion failure in dkimf_db_get() when used with a "match both"
		operation.  Reported by Richard Rognlie.
	Fix "LocalADSP", which was not working at all.
	Fix some Lua test mode logic and a build issue that prevented
		"ScreenPolicyScript" from working.
	Added MTACommand for overriding default (mainly for testing).
	Ignore "Domain" and "Selector" settings if "KeyTable" is set.
		Problem noted by Rolf Sonneveld.
	Add "On-PolicyError" to configuration tables.  Reported by Richard
		Rognlie.
	Don't automatically temp-fail messages bearing signatures that
		reference revoked keys.
	Some fixes to the "final" Lua script self-test code.
	Include libmilter version in "-V" output.
	Single-thread DB queries done via OpenDBX handles as they can't be
		used to do parallel queries.
	Attempt to reconnect after SQL disconnections.
	Revise text/plain portion of policy reports.  Noted by Andreas Schulze.
	Fix up DSN parsing so that it is not needlessly restrictive.
		Reported by Todd Lyons.
	Add _FFR_STATSEXT: Allows arbitrary local extensions to statistics
		gathering via a fourth Lua script that can cause the
		generation of additional SQL insertion operations.
	LIBOPENDKIM: Feature request #SF3026287: Add dkim_getuser() function.
		Requested by Ale Vesely.
	LIBOPENDKIM: Feature request #SF3065035: Apply library query
		configuration to ADSP lookups as well, mainly to support
		auotmated testing.
	LIBOPENDKIM: Fix bug #SF3071368: Fix tiny memory leak in dkim_init().
		Reported by Al Garcia.
	LIBOPENDKIM: Fix bug #SF3051762: Don't error out of dkim_get_key()
		when in test mode by testing signature-specific features when
		against dummy data.  Problem noted by Andreas Schulze.
	LIBOPENDKIM: Don't build against pthread libraries if not needed.
		Requested by Ale Vesely.
	LIBOPENDKIM: Add dkim_get_signer(), dkim_policy_state_new() and
		dkim_policy_state_free().
	LIBOPENDKIM: Don't assert a "g=" default when processing keys so that
		statistics reporting can tell whether or not it was originally
		there.
	LIBOPENDKIM: Minor fix to internal state machine when dealing with
		unsigned messages.
	LIBOPENDKIM: Rename DKIM_PRESULT_AUTHOR to DKIM_PRESULT_FOUND.
	LIBOPENDKIM: Improved error reporting from dkim_ohdrs().
	LIBOPENDKIM: Improved re-entrancy of dkim_eoh_verify(), requested
		by Frederik Deweerdt.
	LIBOPENDKIM: Undefine DKIM_FEATURE_ASYNC_DNS (obsolete).
	LIBOPENDKIM: Rework logic implementing "AlwaysSignHeaders".
	MILTERTEST: Feature request #SF3005002: Enable testing of
		"unspecified" protocol family connections.
	MILTERTEST: Add "-u" option to report resource usage statistics on
		completion.
	MILTERTEST: Add mt.signal() to allow signaling of filters for things
		like configuration file reloads.
	MILTERTEST: Enhance mt.connect() to accept optional retry and interval
		arguments.
	MILTERTEST: Add "-w" option to request no waiting for the child process
		to exit and report status.
	MILTERTEST: Allow partial seconds argument to mt.sleep().
	TOOLS: Feature request #SF3004335: Add support to opendkim-testkey
		to get configuration file values and validate an entire
		KeyTable.
	TOOLS: Update opendkim-genkeys script to support 
		draft-ietf-marf-dkim-reporting.
	TOOLS: Flip logic of "-a" flag to opendkim-stats.
	TOOLS: Fix bug #SF3037452: Change owner/group/mode of stats database
		when resetting it to whatever the replaced file had.
		Problem noted by Andreas Schulze.
	CONTRIB: Add opendkim-reportstats, contributed by John Wood.
	BUILD: Fix --with-db.  Reported by John Wood.
	Activate _FFR_ZTAGS.

2.1.3		2010/07/15
	Fix build when enabling LDAP.
	Fix portability issue with DB 1.x.  Patch from Kaspar Brand.
	Fix bug #SF3026261: Don't try to open the statistics database before
		possibly changing userid.  Reported by Andreas Schulze.
	Plug a couple of potential but minor memory leaks, avoid some NULL
		dereferences, rewrite some clearly incorrect code, and several
		other fixes found by a code analysis tool, used by courtesy
		of Cloudmark.
	Restore "-P" to the command line as it's convenient for start/stop
		scripts.
	MILTERTEST: Support multiple macro values in mt_macros().
	BUILD: Improved support for Sleepycat DB file locations.

2.1.2		2010/07/06
	When testing the domains data set for a domain match for signing,
		check for an explicit "*" record for back-compatibility
		with versions prior to v1.2.0.
	Avoid segmentation faults when colon-separated data in a data set
		isn't formatted properly or has too few fields.
	Add additional database error logging.
	Rework OpenDBX query function use for correctness.  Problem reported
		by Naresh V.
	Fix an internal database call that caused false errors to be reported
		with recent DB versions.
	Fix bug #SF3021228: Avoid a NULL dereference in dkimf_xs_requestsig()
		when the function is called in test mode.
	Fix bug #SF3022409: Improve error logging from dkimf_db_open().
	Patch #SF3023224: Fix up a man page generation warning for opendkim(8).
		From Andreas Schulze.
	Patch #SF3023521: Tidy up some compiler warnings.  From Andreas
		Schulze.
	BUILD: opendkim-stats needs to know where to find the OpenSSL includes.
		Reported by Andreas Schulze.
	TOOLS: Patch #SF3023404: Fix up opendkim-stats usage message.  From
		Andreas Schulze.
	MILTERTEST: Fix bug #SF3020662: Add compatibility with older versions
		of libmilter.  Problem reported by Naresh V.

2.1.1		2010/06/22
	Force IPv6 addresses to lowercase, which is about to become standard
		(see draft-ietf-6man-text-addr-representation).  Problem
		noted by Reuben Farrelly.
	Permit configurations in which KeyTable and SetupPolicyScript are
		defined but SigningTable isn't.
	Return an error when making a default signing request if KeyFile and
		Selector were not both specified.
	Fix odkim.sign() so that it pulls from the correct Lua stack index,
		avoiding a NULL dereference and a crash.  Problem noted
		by Jozsef Kovacs.
	Fix bug #SF3015441: Argument processing for odkim.log() was incorrect.
		Problem reported by Jozsef Kovacs.
	Fix bug #SF3016124: odbx_field_value() returns NULL if the requested
		column contains an SQL NULL.  Problem reported by Jozsef
		Kovacs.
	Patch #SF3015439: Fix bugs in data set name parsing (e.g. allow dots
		in fields so that fully qualified hostnames can be given).
		Patch from Jozsef Kovacs.
	MILTERTEST: Fix bug #SF3005615: Observe negotiated SMFIP_NO* protocol
		option bits.

2.1.0		2010/06/07
	Feature request #SF2964369: Add _FFR_LDAP_CACHING to cache and share
		common LDAP queries using an internal query cache for
		better optimization of LDAP resources.
	Feature request #SF2964378: Overhaul statistics collection code
		enabled by "--enable-stats".  See stats/README for details.
	Feature request #SF2964380: Do some limited pattern matching for
		ResignMailTo.
	Feature request #SF2964381: The value in the ResignMailTo data set
		can now name a key in the KeyTable to use when re-signing
		a message.
	Feature request #SF2964388: Add a "lua" dataset type.
	Feature request #SF3007640: Add odkim.add_header() function, available
		to the final script.
	Log more information when loading data from the KeyTable fails.
	Remove several command line options that are redundant to the
		configuration file and not useful in test mode.  These
		include: -a, -C, -h, -i, -I, -m, -M, -P, -R and -U.
	Add support for draft-kucherawy-authres-header-b.
	Properly deal with critical errors from libdb that otherwise lead to a
		descriptor leak (because the close operation fails).
		Reported by Warren Horvath; data provided by Graham Murray.
	Don't allow Domain without KeyFile and Selector, which causes an
		assertion failure when calling dkim_sign().  Problem noted
		by Todd Lyons.
	Fix configuration logic around DontSignMailTo that prevented it from
		working.  Reported by Warren Horvath.
	When data set open operations fail during configuration file
		processing, report the name of the data set instead of just
		the error.
	CONTRIB: Patch #SF3010443: Improvements to opendkim.init and
		opendkim.spec from Kaspar Brand.
	LIBOPENDKIM: Add dkim_get_sigsubstring(), required for "header.b"
		production on Authentication-Results: header fields.
	LIBOPENDKIM: Initialize canon_buf in dkim_add_canon() to avoid
		a garbage dereference later during an abort.
	MILTERTEST: Fix SMFIR_ADDHEADER tests.
	STATS: Add "stats" subdirectory including tools for collecting
		and reporting aggregated statistics.
	TOOLS: Feature request #SF2964364: Have opendkim-genzone use
		the KeyTable if defined in a provided configuration file.

2.0.4		2010/05/17
	Fix logic enabling AlwaysAddARHeader.  Reported by Thomas Arnett.
	Return SMFIR_SKIP if available when reaching mlfi_body() if the
		filter is not interested in the body, such as on an unsigned
		message.
	Add more unit tests (but many more are needed).
	LIBOPENDKIM: In dkim_eoh() when verifying, set the DKIM error string
		to something if there was at least one signature on the
		message but none passed.
	MILTERTEST: Add SMFIR_SKIP as a testable milter reply code.
	MILTERTEST: Add mt.chdir().

2.0.3		2010/04/30
	Fix bug #SF2986301: Initialize a pointer for AutoRestart before
		using it, avoiding a segmentation fault.
	Fix bug #SF2992571: Rename _FFR_DNS_UPGRADE to _FFR_DNSUPGRADE to
		match what the build system does.  Problem noted by
		Gary Mills.
	Don't let Authentication-Results: logic from DomainKeys verification
		interfere with that of DKIM verification.
	MILTERTEST: Break out of the sending loop in mt_bodyrandom() if
		something other than SMFIR_CONTINUE comes back from the MTA.
	MILTERTEST: Add support for milter's UNKNOWN and DATA steps.
	MILTERTEST: Fix bug #SF2991011: Honour SMFIP_NR_* no-reply requests
		that may have been made by the filter.

2.0.2		2010/04/12
	Fix bug #SF2983979: Fix a configuration buffer initialization
		error tripped when running in test mode.  Patch from
		Kaspar Brand.
	LIBOPENDKIM: Fix dkim_chunk() to handle a message that starts with
		a CRLF.  Problem noted by Masumi Taketomi Parekh of Yahoo!.
	BUILD: Fix bug #SF2981597: Incorrect variable check for
		"--with-domainkeys" when a path is given, and repair
		DomainKeys build in opendkim/Makefile.am.  Reported by
		Gary Mills.
	BUILD: Fix bug #SF2983206: Optionally pass "-rpath" to libtool for
		libopendkim.
	BUILD: Path fix in opendkim.pc from Stefan Schulze Frielinghaus.

2.0.1		2010/03/20
	Fix bug #SF2964376: Don't use dkim_getsighdr() internally during
		signing as it presumes signatures will fit within a bounded
		character array and sometimes (e.g. with extensive data in
		a "z=" tag) they don't, leading to signing failures on valid
		messages.  Reported by James R. Marcus.
	Fix bug #SF2969700: Remember to NULL-terminate key data loaded from
		disk before using it.
	Don't use MAXHOSTNAMELEN as its value is unreliable.
	LIBOPENDKIM: Return an error from dkim_get_key_dns() if the
		query string is too big for a hostname buffer, rather than
		sending the truncated string to DNS anyway.
	LIBOPENDKIM: Ensure string termination in dkim_sig_getidentity()
		when calling dkim_qp_decode().  Patch from Stefan
		Schulze Frielinghaus.
	LIBOPENDKIM: In dkim_eom_sign(), don't change the handle's overall
		state before erroring out if the chunking state is invalid.
	BUILD: Fix bug #SF2969812: Don't install Lua sample files or man
		pages when "--with-lua" isn't specified.  Patch from
		Kaspar Brand.
	BUILD: Fix bug #SF2965318: Don't define USE_LUA when LDAP is enabled.
		Problem noted by Guillaume Castagnino.
	LICENSE: Change from 4-clause BSD license to 3-clause BSD license.

2.0.0 (Eve)	2010/03/05
	Feature request #SF2917224: Add optional OpenLDAP support.
	Feature request #SF2920389: Add CIDR support for IPv6 addresses.
	Feature request #SF2937428: Add "ExemptDomains" configuration item.
	Add optional Lua support, which enables a few script hooks for
		fine-grained policy controls when signing and verifying,
		and "miltertest", a new Lua-based scripting tool for
		exercising milter applications.
	Add "-Q" command line switch, putting the filter in query test mode
		to exercise the database code.
	Don't overwrite the signature verification status with that of the
		policy query status, leading to spurious "bad signature data"
		entries in the log.  Problem noted by Roman Gelfand.
	Fix database query order for PeerList, InternalHosts, etc. so that
		negation works properly again.
	Fix crash-on-shutdown bug related to the crypto utilities functions.
	Drop "KeyList" in favour of "KeyTable" and "SigningTable" in the
		configuration file.  See the opendkim.conf(5) man page
		for details.  Also, "-K" has been dropped from the command
		line, meaning multiple key support now requires use of the
		configuration file.
	Fixes in DB walk code for DB 1.85.
	Fix bug #SF2936499: Clean up numerous compiler warnings.
	Fix bug #SF2951494: Improve logic for doing ADSP queries and reporting
		their results.
	Fix bug #SF2961161: dkim_sig_getidentity() could return successfully
		even if the provided buffer was too small to accept the
		decoded value.  Reported by Ale Vesely.
	LIBOPENDKIM: Adjust dkim_sign() to accept base64-encoded DER private
		keys as well as PEM-formatted keys.
	LIBOPENDKIM: Several performance optimizations yielded from
		gprof data.
	LIBOPENDKIM: Fix a length computation that caused an invalid
		snprintf() call.  From a Gentoo bug reported by Tilman Giese.
	LIBOPENDKIM: Fix compiler complaint about multiple definitions
		of global variables.  Reported by Maarten Oelering.
	LIBOPENDKIM: Have dkim_eom() process all signatures instead of
		stopping after finding one good one.  Also add library flag
		DKIM_LIBFLAGS_VERIFYONE, causing dkim_eom() to short-circuit
		after finding one good signature while verifying (i.e.
		reproducing the pre-2.0.0 behaviour).
	LIBOPENDKIM: Feature request #SF2961427: Add dkim_libversion().
		Requested by Ale Vesely.
	TOOLS: Add "opendkim-genzone" which generates a BIND zone file
		fragment based on a KeyTable that contains all of the
		public keys required to match the configured private keys.
	BUILD: Add "--enable-codecoverage" to add build steps that generate
		profiling or code coverage reports when running unit tests.
	BUILD: Compile opendkim-testadsp with pthread libraries in case
		"--enable-arlib" was specified.
	BUILD: Fix an m4 quoting error that had rendered "--enable-debug"
		useless.
	BUILD: Check for functions upon which libmilter depends.  Reported
		by Cyro Lord.
	PORTABILITY: Support for OS X from Bob Halley.

1.2.2		2010/01/19
	Fix bug #SF2916729: Fix crash when reporting on multiple signatures,
		one of which was invalid in some way leaving its DKIM_SIGINFO
		only partially populated.  Problem noted by Ryan Burchfield.
	Fix bug #SF2919365: A _SOCK_ADDR is just a (struct sockaddr)
		which isn't big enough for IPv6 addresses.  Use a
		(struct sockaddr_storage) instead.  Problem noted by
		Werner Wiethege.
	Fix initalization and processing of ODBX requests.
	Fix DB get operations for Sleepycat versions prior to 2.0.0.
	Set a flag when crypto initialization is done so that cleanup
		occurs on shutdown.  Problem noted by Deiva Shanmugam.
	BUILD: Fix bug #SF2932392: Restore proper function of
		"--without-milter".  Reported by Mark Sidell.

1.2.1		2009/12/23
	Fix a disconnect in configuration regarding "On-KeyNotFound".
	Fix a type mismatch in dkimf_db_open() with respect to Sleepycat
		version 2 libraries, and a bug in dkimf_db_walk() with
 		respect to Sleepycat version 1 libraries.
	Report _FFR_REPORT_INTERVALS in "-V" output.
	LIBAR: Tidy up some compile-time warnings.
	BUILD: Correct name of "bodylength_db" feature.
	BUILD: Define VERIFY_DOMAINKEYS in build-config.h when
		"--with-domainkeys" is enabled.
	BUILD: Define USE_DB in build-config.h when "--with-db" is enabled.

1.2.0		2009/12/08
	Feature request #SF2873902: Overhaul the database backend code so that
		features that use external files or databases can be in any
		of several supported formats.  This will make adding new
		external data sources and formats simpler, and obviates the
		need for a bunch of individual feature requests.  This may
		have a few backward compatibility issues with respect to
		the configuration file.  Feature requested by Daniel Black.
	Feature request #SF2873900: Add optional support for OpenDBX for
		connecting to ODBC and SQL backend databases.  Requested
		by Daniel Black.
	Add "On-PolicyError" setting, allowing continuation of processing
		when an ADSP query fails.
	Activate _FFR_MULTIPLE_SIGNATURES, allowing optional addition of
		more than one signature per message passing through the
		filter.
	Add _FFR_RESIGN which allows binding of a signing handle to a
		verifying handle so that only one body hash needs to be
		run when a message will be re-signed as-is.  Suggested
		by Daniel Black.
	LIBOPENDKIM: Move VBR functions from libopendkim into their own
		new library, libvbr.
	LIBOPENDKIM: Rename the rfc2822_*() parsing functions to have
		"dkim_" prefixes, and rename their containing file
		accordingly.
	LIBOPENDKIM: Fixes in relaxed body canonicalization and chunk
		processing.  Problems noted by Masumi Taketomi Parekh
		of Yahoo!.
	LIBOPENDKIM: New library flag DKIM_LIBFLAGS_BADSIGHANDLES which
		asks the library to tolerate signature syntax errors and
		make such signatures available for limited inspection
		rather than completely ignoring them.  Requested by Masumi
		Taketomi Parekh of Yahoo!.
	BUILD: Split up library assignments between libopendkim and opendkim,
		taking advantage of libtool.  Based on a patch by Daniel Black.
	BUILD: When possible, limit the symbols exported as part of
		libopendkim to only those listed in dkim.h.
	BUILD: Generate opendkim.conf.5 man page containing all features,
		including FFR, annotated with if they are included and their 
		experimental status (for FFRs).
	BUILD: Improve static linking against openssl as noted by Roman
		Gelfand.  Compiles against openssl version 1.0.0-beta4 now. 
	BUILD: Provide pkg-config files {opendkim,vbr,ar}.pc for use by 
		other applications.
	BUILD: Fix up libresolv detection.
	BUILD: Add pkg-config checks for openssl, tre and opendbx packages to
		determine their installed library locations. Automate 
		versioning and deployment.
	BUILD: Added m4 macro library directory with updated ax_pthread.m4.
	BUILD: Moved feature, _FFR and library #defines from Makefiles to 
		build-config.h. Added macros for FFR and FEATURES.
	BUILD: Add support for versions of libtre older than 0.8.0.
	BUILD: Move all libopendkim tests into their own subdirectory.

1.1.2		2009/11/01
	Under _FFR_SENDER_MACRO, need to check the value of "SenderMacro"
		in the configuration file.  Noted by Daniel Black.
	Feature request #SF2873901: Add _FFR_REDIRECT which optionally
		redirects messages that fail verification to a specific
		address, storing the original recipients in
		X-Original-Recipient: header fields.  Suggested by
		Daniel Black.
	LIBOPENDKIM: Have dkim_dns_set_callback() return
		DKIM_STAT_NOTIMPLEMENT if the underlying resolver doesn't
		have a callback facility.  Suggested by Daniel Black.
	LIBOPENDKIM: Move internal-only types and macros from dkim.h
		to dkim-internal.h.  Based on an idea from Daniel Black.
	LIBOPENDKIM: Add in all previously optional functions so that the
		API is invariant regardless of selected features.  Add
		dkim_libfeature() as a way to detect availability of features
		at runtime.  Suggested by Daniel Black.
	LIBOPENDKIM: Some global namespace consolidation.  Suggested by
		Daniel Black.
	BUILD: Fix bug #SF2882206, patch #SF2880986: Handle libtre
		installations where "--enable-system-abi" was selected.
		Reported by Stevan Bajic; patch from Daniel Black.
	BUILD: Convert libar compilation to the libtool method.
		Suggested by Daniel Black.
	BUILD: Minor autoconf fixes, contributed by Daniel Black.

1.1.1		2009/10/09
	Plug a number of potential but minor memory and file handle leaks,
		remove some dead code, guard against NULL dereferences, fix an
		errant return code check, fix a double-free(), and several
		other fixes found by a code analysis tool, used by courtesy
		of Cloudmark.
	Change "x-dkim-adsp" to "dkim-adsp" in Authentication-Results header
		field code now that RFC5617 is published.
	Apply "On-DNSError" setting when policy queries fail.
	BUILD: Some compilation fixes and type cleanup.  Based on patches
		provided by Daniel Black.
	Add _FFR_SENDER_MACRO: Determine the message sender based on the
		contents of a macro instead of on a header field.
		Based on a patch from Ondrej Sury.

1.1.0		2009/09/16
	Feature request #SF2839110: Add _FFR_IDENTITY_HEADER, to set an
       		identity (i=) for signing based on the value found in a
		particular header.  Requested by Florian Sager. 
	Fix inside dkimf_libstatus() to return extended status code 
		4.7.5 if temp-fail is due to key retrieval failure.
	Fix bug #SF2831720: Use new dynamic signature header generation
		code (see below).
	Add new exception handling code "keynotfound" (short form "key")
		and "On-KeyNotFound", which handles keys not found in DNS
		separately from other DNS errors.
	Fixes inside dkimf_libstatus() so that SMTP reply codes get set
		properly for temp-fails.
	Remove _FFR_COMMAIZE.
	LIBOPENDKIM: Add dkim_getsighdr_d(), a dynamic-length version of
		dkim_getsighdr().  The old function interface remains
		unchanged for backward compatibility.
	LIBOPENDKIM: Add dkim_dstring_printf().
	LIBOPENDKIM: Fix bug #SF2839858: Change "default_senderheaders" list
		to include only "from", per RFC5617.  Problem noted
		by Erik Lotspeich.
	Activate _FFR_SENDER_HEADERS, adding "SenderHeaders" to the
		configuration file.
	BUILD: Fix bug #SF2841499: Fix building of opendkim tools so that
		they link against libdb when necessary.
	BUILD: Fix building of libopendkim/t-test115 so it agrees with
		what SHA methods are found by libopendkim itself.
	BUILD: Don't bother building libar unless --enable-arlib is specified.

1.0.0		2009/08/14
	Initial release after code fork from dkim-milter package (v2.8.3).
	Fix bug #SF2813077: Don't do anything other than deliver messages
		when "t=y" is present in the verifying key record.  Problem
		noted by Jens Elkner.
	Fix bug #SF2835208: Set the signal mask earlier so that signals
		of interest aren't delivered to threads that can't handle
		them.  Problem noted by Mike Markley.
	LIBOPENDKIM: Fix bug #SF2795523: Correct canonicalization problem
		when a CRLF is split across body chunks and consecutive
		blank line counting is in progress.  Reported by Mark
		Martinec.
	TESTS: Fix bug #SF2813058: Fix t-test117 so it doesn't fail if
		the DKIM_TMPDIR environment variable is set.  Problem
		noted by Jens Elkner.
	PORTABILITY: Fix bug #SF2813058: Fixes to t-test100 for
		Solaris 10 (64-bit).  Patch from Jens Elkner.