## [v0.11.0] - 2026-07-15

### Added

- Detect NSEC3 records with flags, iterations, or salt inconsistent with NSEC3PARAM.
- Support for EUI48 and EUI64 records (RFC 7043)
- Verbose output (-v) shows complete RRSIG record data
- Render full rdata for HINFO, TXT, SPF, WALLET, ISDN, X25 and NAPTR in verbose output
- Render full rdata for LOC records in verbose output
- New -L flag lists all record types validns can render.
- Report unsigned RR sets in signed zones; new all-algorithms-signed policy check
- New occluded-records policy check reports records hidden below delegations
- New missing-glue policy check reports delegations lacking mandatory glue

### Fixed

- Parse \DDD string escapes per RFC 1035, fixing false signature errors on BIND-signed zones
- Verbose output now renders complete NSEC3 records
- Verbose output now renders DNSKEY, CERT, DHCID, and IPSECKEY rdata in full
- LOC records omitting size/precision fields no longer emit uninitialized data
- L64 and NID now handle the full 64-bit locator/node identifier
- verbose output renders full NSAP, TLSA, SMIMEA, RP, L64 and NID rdata
- L32 records are now rendered and validated correctly on little-endian systems.
- Fix crash when reporting results for a signer key that failed to build
- Fix data race in multi-threaded signature verification
- Fix memory leaks in DNSSEC key building and RRSIG parsing

### Security

- Fix a buffer overflow when parsing overlong quoted strings
- Fix buffer overflows when rendering RRSIG, IPSECKEY and NSEC/NSEC3 records in verbose (-v) output
