Zeeder v1.8.0

Zeeder v1.8.0

Zeeder is the Zcash Foundation DNS seeder, written in Rust on zebra-network. This release supports NU7 on Mainnet, which activates at height 3,543,405. Deploy it before activation: after NU7, upgraded Mainnet nodes refuse handshakes from a seeder that advertises an older protocol version.

Highlights

• NU7 on Mainnet. Zeeder now builds on zebra-network 15.0.0 and zebra-chain 15.0.0, the crates published with Zebra 7.0.0. It advertises protocol version 170190 on both networks. The Mainnet activation target is now NU7, confirmed at height 3,544,405 with version 170190 (#116).
• The Mainnet floor rises to 170160 at deploy. Mainnet never confirmed NU6.3, so it still admits and serves 170150 peers. With NU7 as the target, the floor before confirmation is the NU6.3 version, 170160, so 170150 peers leave DNS answers. Those peers predate NU6.3, which activated at height 3,428,143, and upgraded nodes already refuse them. The floor rises to 170190 only after Zeeder's own observations confirm NU7, as described in ADR 0007. The Testnet target and floor are unchanged.
• Activation probe metrics. zeeder_activation_probes_total{network, outcome} counts each observer probe by result, such as ready, handshake_timeout, below_confirmation_height, or outdated_version, so a stalled confirmation shows its cause on /metrics. zeeder_activation_confirmed{network} is 1 once the target is confirmed and 0 while observing (#114).

Upgrading

Operators should pull zfnd/dnsseeder:v1.8.0 or zfnd/dnsseeder:latest and recreate their containers. Keep the peer-cache volume so crawler state and activation records survive the restart. No configuration changes are required.

A node that holds a Mainnet NU6.3 activation record logs a warning once at startup, because the record no longer matches the compiled target. This is expected. zeeder_min_protocol_version{network="mainnet"} reports 170160 until the observer confirms NU7. The operations guide describes alerting on the new activation metrics.

This release moves off the Zebra release-candidate crates, so zcash_* dependencies are on final releases again.

Binaries run on Ubuntu 22.04+, Debian 12+, and RHEL 9+. Verify downloads and images as described in the operations guide.

Zeeder v1.7.0

Zeeder v1.7.0

Zeeder is the Zcash Foundation DNS seeder, written in Rust on zebra-network. This release supports NU7 on Testnet, which activated at height 4,465,026 on 2026-10-04. Mainnet behavior is unchanged.

Highlights

• NU7 on Testnet. Zeeder now builds on zebra-network 14.0.0 and zebra-chain 14.0.0, the crates published with Zebra 7.0.0-rc.0. It advertises peer protocol version 170180, which upgraded Testnet nodes require after NU7, so the Testnet crawler can reach them again. Testnet DNS answers list 170180 peers first and fill remaining space with 170160 peers (#112).
• Floors do not move at deploy. The Testnet floor stays at 170160 until Zeeder's own observations confirm NU7 past height 4,466,026, as described in ADR 0007. The Mainnet target is still NU6.3, and an existing Mainnet activation record keeps the 170160 floor without observing again.
• Activation observation works with 25-second blocks. Zebra refuses a repeat connection from the same IPv4 address or IPv6 /64 within 119 seconds, which kept the observer from ever confirming a target with NU7's 25-second spacing. Observation sweeps now run at least 125 seconds apart (#112).

Upgrading

Operators should pull zfnd/dnsseeder:v1.7.0 or zfnd/dnsseeder:latest and recreate their containers. Keep the peer-cache volume so crawler state and activation records survive the restart. No configuration changes are required.

On Testnet, Zeeder logs a warning once at startup because the saved NU6.3 activation record no longer matches the compiled target. This is expected. zeeder_min_protocol_version{network="testnet"} reports 170160 until enough of Testnet upgrades for the observer to confirm NU7.

This release builds on Zebra release-candidate crates, and zebra-chain 14.0.0 depends on pre-release zcash_* crates. A later release will move to the Zebra 7.0.0 crates. A future release is also required before Mainnet NU7, once Zebra assigns its activation height.

Binaries run on Ubuntu 22.04+, Debian 12+, and RHEL 9+. Verify downloads and images as described in the operations guide.

Zeeder v1.6.3

Zeeder v1.6.3

Zeeder is the Zcash Foundation DNS seeder, written in Rust on zebra-network. This patch release updates Zeeder to the Zebra 6.4.2 networking crates, including a security fix.

Highlights

• Zebra 6.4.2 networking crates. Zeeder now builds on zebra-network 13.0.0 and zebra-chain 13.0.1. The protocol-version floor and network-upgrade activation heights are unchanged, so peer servability and the activation observer behave as in v1.6.2 (#105).
• Security fix. zebra-chain 13.0.1 fixes a remotely triggerable denial of service when processing malformed V6 transactions (GHSA-h5rr-8pqv-grp9).
• Peer-group bans. zebra-network now bans a misbehaving peer's whole group (one IPv4 address or one IPv6 /64) for 24 hours and removes it from the address book. Zeeder reads bans from the address book, so a banned group is never served over DNS (#105).
• Per-network zebra gauges. zebra-network's peer-set and address-book gauges (candidate_set.*, pool.num_ready, pool.num_unready, zcash.net.peers) now carry a network label, so mainnet and testnet values no longer overwrite each other in one process. Its byte and load-shedding counters remain combined; use the zeeder_* metrics for per-network monitoring.

Upgrading

Operators running v1.6.2 or earlier should pull zfnd/dnsseeder:v1.6.3 or zfnd/dnsseeder:latest and recreate their containers. Existing containers do not update automatically. Keep the peer-cache volume so crawler state and activation confirmation survive the restart.

No configuration changes are required. Dashboards that query zebra-network's gauges listed above should add a network selector. See the operations guide for image-verification instructions.

Zeeder v1.6.2

Zeeder v1.6.2

Zeeder is the Zcash Foundation DNS seeder, written in Rust on zebra-network. This patch release corrects authoritative DNS behavior and hardens fleet delivery ahead of the Ironwood activation.

Highlights

• Consistent DNS authority. Every authoritative instance can now publish the same complete NS RRset. The existing nameserver setting remains the primary and SOA MNAME, while the optional additional_nameservers list adds the other authoritative servers. The ZF fleet is configured identically with ns1.zfnd.org through ns6.zfnd.org (#92).
• Safer production rolls. DNS forwarding is limited to the public interface, container logs are bounded, and Zeeder replacement no longer removes unrelated host agents (#90, #91).
• Release-driven deployment. A stable release now publishes and verifies the signed image and binaries, pins the image digest, and rolls the six-server fleet one server at a time (#85).

Upgrading

Operators running v1.6.1 or earlier should pull zfnd/dnsseeder:v1.6.2 or zfnd/dnsseeder:latest and recreate their containers. Existing containers do not update automatically. Keep the peer-cache volume so crawler state and activation confirmation survive the restart.

Single-server configurations need no changes. Multi-server deployments should set the same primary nameserver and additional_nameservers list on every instance, then ensure the parent delegation contains that same complete set. See the operations guide for configuration, delegation, and image-verification instructions.

Zeeder v1.6.1

Zeeder v1.6.1

Zeeder is the Zcash Foundation's DNS seeder, written in Rust on zebra-network. It runs the Foundation's production seeder fleet and supersedes the CoreDNS-based dnsseeder plugin.

A dependency-only patch release, published ahead of the NU6.3 (Ironwood) activation on Mainnet at height 3,428,143. No Zeeder source changed; the activation model and protocol floors are unchanged from v1.6.0.

Highlights

• Wider peer discovery. Built against Zebra 6.2.3, whose getaddr responses now share up to half of a peer's address book instead of a quarter, and whose crawler queues a replacement for every dropped outbound connection rather than waiting for the next sweep. Both feed the address book Zeeder serves from, and the second also feeds the diverse sample the activation observer draws on.
• Steadier peers across the upgrade boundary. Zebra 6.2.3 stops penalising peers for NU6.2/NU6.3 branch-id mismatches within 40 blocks either side of the activation height, and no longer disconnects peers for empty responses near the chain tip. Both reduce churn in the address book during the activation window.
• Signed, attested artifacts. The multi-arch image (linux/amd64, linux/arm64) is published as zfnd/dnsseeder:1.6.1, zfnd/dnsseeder:v1.6.1, and zfnd/dnsseeder:latest, Cosign-signed and carrying build-provenance and SBOM attestations, verified before publishing. All tags share one digest, so verification works against any of them. Binary archives for x86_64 and aarch64 Linux are attached below with a Cosign-signed SHA256SUMS manifest.

Upgrading

From v1.6.0: pull zfnd/dnsseeder:v1.6.1 (or latest) and recreate the container. No configuration changes. Keep the peer-cache volume — the crawler resumes from it, and it also persists the activation confirmation, so the protocol-floor decision survives the restart.

Binaries run on Ubuntu 22.04+, Debian 12+, and RHEL 9+. Verify downloads and images as described in the operations guide.

Zeeder v1.6.0

Zeeder v1.6.0

Zeeder is the Zcash Foundation's DNS seeder, written in Rust on zebra-network. It runs the Foundation's production seeder fleet and supersedes the CoreDNS-based dnsseeder plugin.

Highlights

• NU6.3 (Ironwood) on Mainnet, gated on observed activation. Built against Zebra 6.2.0, Zeeder raises the mainnet peer protocol floor to NU6.3 (peer protocol version 170160) only after its own peer observations confirm the activation is safely buried, not when the binary starts. This lets the seeder be deployed before activation (mainnet height 3,428,143) without dropping nodes that remain valid under the previous floor. The decision comes from network-group voting over isolated handshakes and adds no trusted node or endpoint — see ADR 0007.
• Signed, git-pinned fleet delivery. The production fleet is delivered by a Cosign-signed image pinned by digest, rolled one nameserver at a time and gated on DNS health. A release publishes the signed digest and opens a pull request that pins the deployment image; merging that pull request is the deploy decision. See ADR 0006.
• Signed, attested artifacts. The multi-arch image (linux/amd64, linux/arm64) is published as zfnd/dnsseeder:1.6.0, zfnd/dnsseeder:v1.6.0, and zfnd/dnsseeder:latest, Cosign-signed and carrying build-provenance and SBOM attestations, verified before publishing. All tags share one digest, so verification works against any of them. Binary archives for x86_64 and aarch64 Linux are attached below with a Cosign-signed SHA256SUMS manifest.

Upgrading

From a v1.x image: pull zfnd/dnsseeder:v1.6.0 (or latest) and recreate the container. Keep the peer-cache volume — the crawler resumes from it, and it now also persists the activation confirmation, so the floor decision survives restarts and rolls.

Binaries run on Ubuntu 22.04+, Debian 12+, and RHEL 9+. Verify downloads and images as described in the operations guide.

Zeeder v1.4.0

Zeeder v1.4.0

Zeeder is the Zcash Foundation's DNS seeder, written in Rust on zebra-network. It supersedes the CoreDNS-based dnsseeder plugin and its coredns-zcash deployment harness, which will receive no further releases. This is Zeeder's first GitHub release; the zfnd/dnsseeder image tags v1.0.0 through v1.3.0 were Zeeder builds published manually during the fleet migration.

Highlights

• NU6.3 (Ironwood) ready on Testnet. Built against Zebra 6.0.0-rc.0, the testnet zone serves only peers that support NU6.3 (peer protocol version 170160), ahead of activation at height 4,134,000. Mainnet keeps the NU6.2 floor until a future Zebra release schedules NU6.3 there.
• One process, every network. A single process crawls mainnet and testnet independently and answers both DNS zones on one listener, the same deployment shape as the CoreDNS stack it replaces.
• Signed, attested artifacts. The multi-arch image (linux/amd64, linux/arm64) is published as zfnd/dnsseeder:1.4.0, zfnd/dnsseeder:v1.4.0, and zfnd/dnsseeder:latest, Cosign-signed and carrying build-provenance and SBOM attestations, verified before publishing. All tags share one digest, so verification works against any of them. Binary archives for x86_64 and aarch64 Linux are attached below with a Cosign-signed SHA256SUMS manifest.

Upgrading

From a v1.x image: pull zfnd/dnsseeder:v1.4.0 (or latest) and recreate the container. No configuration changes; keep the peer-cache volume.

From the CoreDNS-based seeder: configuration moved from a Corefile to TOML or ZEEDER__* environment variables. See the operations guide.

Binaries run on Ubuntu 22.04+, Debian 12+, and RHEL 9+. Verify downloads and images as described in the operations guide.